Play interactive tour

Edit tour

Analysis Report http___citycapproperty.ru_localmod_nmode.exe

Overview

General Information

Sample Name:	http___citycapproperty.ru_localmod_nmode.exe
Analysis ID:	399051
MD5:	c178795733e8a84f750aff12e49ca3ef
SHA1:	af9e5de54778ef903c892f4d0f46e39b7b07c417
SHA256:	d73e37b3ed710e4128e3c76e2f0fd61dbb2fdcddfd8cfa51ffe244fa19433bb2
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to download HTTP data from a sinkholed server

Yara detected SmokeLoader

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Renames NTDLL to bypass HIPS

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

PE file does not import any functions

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

http___citycapproperty.ru_localmod_nmode.exe (PID: 4192 cmdline: 'C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe' MD5: C178795733E8A84F750AFF12E49CA3EF)

explorer.exe (PID: 3472 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

eurbbce (PID: 6392 cmdline: C:\Users\user\AppData\Roaming\eurbbce MD5: C178795733E8A84F750AFF12E49CA3EF)

eurbbce (PID: 6364 cmdline: C:\Users\user\AppData\Roaming\eurbbce MD5: C178795733E8A84F750AFF12E49CA3EF)

cleanup

Malware Configuration

Threatname: SmokeLoader

{"C2 list": ["http://autopartswarehouses.ru/", "http://memoloves.ru/", "http://powerglasspot.ru/", "http://smbproperty.ru/", "http://gmbshop.ru/", "http://baksproperty.gov.ug/", "http://magistralpsw.ru/", "http://mpmanagertzz.ru/", "http://alfavanilin.ru/"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
0000001A.00000002.495234089.0000000000400000.00000040.00020000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000000.00000003.235077807.0000000000620000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
0000001A.00000003.484031694.0000000001F90000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000011.00000003.330508330.00000000005B0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
26.2.eurbbce.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
17.2.eurbbce.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
17.2.eurbbce.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
26.2.eurbbce.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
17.3.eurbbce.5b0000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
26.3.eurbbce.1f90000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
0.3.http___citycapproperty.ru_localmod_nmode.exe.620000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://smbproperty.ru/

Avira URL Cloud: Label: phishing

Found malware configuration

Show sources

Source: 00000011.00000002.343548571.00000000020F0000.00000004.00000001.sdmp

Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://autopartswarehouses.ru/", "http://memoloves.ru/", "http://powerglasspot.ru/", "http://smbproperty.ru/", "http://gmbshop.ru/", "http://baksproperty.gov.ug/", "http://magistralpsw.ru/", "http://mpmanagertzz.ru/", "http://alfavanilin.ru/"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: alfavanilin.ru	Virustotal: Detection: 8%	Perma Link
Source: smbproperty.ru	Virustotal: Detection: 11%	Perma Link
Source: magistralpsw.ru	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\eurbbce

ReversingLabs: Detection: 27%

Multi AV Scanner detection for submitted file

Show sources

Source: http___citycapproperty.ru_localmod_nmode.exe	Virustotal: Detection: 31%			Perma Link
Source: http___citycapproperty.ru_localmod_nmode.exe	ReversingLabs: Detection: 27%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\eurbbce

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: http___citycapproperty.ru_localmod_nmode.exe

Joe Sandbox ML: detected

Source: http___citycapproperty.ru_localmod_nmode.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 93.170.123.43:443 -> 192.168.2.5:49718 version: TLS 1.2

Source:	Binary string: C:\ducasilot26\wenuboki\pobimojepig\wohemeligowub_laluw.pdb source: http___citycapproperty.ru_localmod_nmode.exe
Source:	Binary string: GC:\ducasilot26\wenuboki\pobimojepig\wohemeligowub_laluw.pdbibecoki.pdb source: http___citycapproperty.ru_localmod_nmode.exe
Source:	Binary string: wntdll.pdbUGP source: http___citycapproperty.ru_localmod_nmode.exe, 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, eurbbce, 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, eurbbce, 0000001A.00000002.497653342.000000006DFE1000.00000020.00020000.sdmp, 9419.tmp.26.dr
Source:	Binary string: wntdll.pdb source: http___citycapproperty.ru_localmod_nmode.exe, eurbbce, eurbbce, 0000001A.00000002.497653342.000000006DFE1000.00000020.00020000.sdmp, 9419.tmp.26.dr
Source:	Binary string: ibecoki.pdb source: http___citycapproperty.ru_localmod_nmode.exe

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 185.14.31.88:80 -> 192.168.2.5:49719
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 185.14.31.88:80 -> 192.168.2.5:49720
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 185.14.31.88:80 -> 192.168.2.5:49721
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 185.14.31.88:80 -> 192.168.2.5:49723
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 185.14.31.88:80 -> 192.168.2.5:49724

Tries to download HTTP data from a sinkholed server

Show sources

Source: global traffic	HTTP traffic detected: HTTP/1.0 404 Not FoundDate: Wed, 28 Apr 2021 08:58:50 GMTServer: Apache/2.4.18 (Ubuntu)X-Sinkhole: Malware sinkholeContent-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.0 404 Not FoundDate: Wed, 28 Apr 2021 08:58:56 GMTServer: Apache/2.4.18 (Ubuntu)X-Sinkhole: Malware sinkholeContent-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.0 404 Not FoundDate: Wed, 28 Apr 2021 08:58:57 GMTServer: Apache/2.4.18 (Ubuntu)X-Sinkhole: Malware sinkholeContent-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.0 404 Not FoundDate: Wed, 28 Apr 2021 08:58:58 GMTServer: Apache/2.4.18 (Ubuntu)X-Sinkhole: Malware sinkholeContent-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.0 404 Not FoundDate: Wed, 28 Apr 2021 08:58:58 GMTServer: Apache/2.4.18 (Ubuntu)X-Sinkhole: Malware sinkholeContent-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://autopartswarehouses.ru/
Source: Malware configuration extractor	URLs: http://memoloves.ru/
Source: Malware configuration extractor	URLs: http://powerglasspot.ru/
Source: Malware configuration extractor	URLs: http://smbproperty.ru/
Source: Malware configuration extractor	URLs: http://gmbshop.ru/
Source: Malware configuration extractor	URLs: http://baksproperty.gov.ug/
Source: Malware configuration extractor	URLs: http://magistralpsw.ru/
Source: Malware configuration extractor	URLs: http://mpmanagertzz.ru/
Source: Malware configuration extractor	URLs: http://alfavanilin.ru/

Source: Joe Sandbox View	IP Address: 93.170.123.43 93.170.123.43
Source: Joe Sandbox View	IP Address: 93.170.123.43 93.170.123.43

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: IHOR-ASRU IHOR-ASRU

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://smbproperty.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: smbproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gmbshop.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 165Host: gmbshop.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://magistralpsw.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: magistralpsw.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://powerglasspot.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: powerglasspot.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://autopartswarehouses.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: autopartswarehouses.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://memoloves.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: memoloves.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://alfavanilin.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: alfavanilin.ru

Source: unknown

DNS traffic detected: queries for: smbproperty.ru

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://smbproperty.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: smbproperty.ru

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 28 Apr 2021 08:58:49 GMTServer: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40X-Powered-By: PHP/5.6.40Content-Length: 327Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown

HTTPS traffic detected: 93.170.123.43:443 -> 192.168.2.5:49718 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.495234089.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.235077807.0000000000620000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.484031694.0000000001F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.330508330.00000000005B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.eurbbce.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.eurbbce.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.eurbbce.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.eurbbce.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.eurbbce.5b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.eurbbce.1f90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.http___citycapproperty.ru_localmod_nmode.exe.620000.0.raw.unpack, type: UNPACKEDPE

Source: http___citycapproperty.ru_localmod_nmode.exe, 00000000.00000002.272121823.000000000083A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_00401718 Sleep,NtTerminateProcess,	0_2_00401718
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_004012E3 NtAllocateVirtualMemory,	0_2_004012E3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_00401288 NtAllocateVirtualMemory,NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401288
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_004016B6 Sleep,NtTerminateProcess,	0_2_004016B6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_00402368 NtClose,	0_2_00402368
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_00401723 Sleep,NtTerminateProcess,	0_2_00401723
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_0040172E Sleep,NtTerminateProcess,	0_2_0040172E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89780 ZwMapViewOfSection,LdrInitializeThunk,	0_2_6DF89780
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89660 ZwAllocateVirtualMemory,LdrInitializeThunk,	0_2_6DF89660
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89600 ZwOpenKey,LdrInitializeThunk,	0_2_6DF89600
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF899A0 ZwCreateSection,LdrInitializeThunk,	0_2_6DF899A0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF898C0 ZwDuplicateObject,LdrInitializeThunk,	0_2_6DF898C0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89860 ZwQuerySystemInformation,LdrInitializeThunk,	0_2_6DF89860
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89820 ZwEnumerateKey,LdrInitializeThunk,	0_2_6DF89820
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF495F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,	0_2_6DF495F0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	0_2_6DFFBDFA
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF895F0 ZwQueryInformationFile,	0_2_6DF895F0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89DE0 ZwAssociateWaitCompletionPacket,	0_2_6DF89DE0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E013E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	0_2_6E013E22
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF445D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	0_2_6DF445D0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF895D0 ZwClose,	0_2_6DF895D0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6DFFFDD3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6EDC4 ZwCancelWaitCompletionPacket,	0_2_6DF6EDC4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,	0_2_6DF44DC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF895C0 ZwSetEvent,	0_2_6DF895C0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF895B0 ZwSetInformationThread,	0_2_6DF895B0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89DB0 ZwAlpcSetInformation,	0_2_6DF89DB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF465A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	0_2_6DF465A0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89DA0 ZwAlpcSendWaitReceivePort,	0_2_6DF89DA0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43591 ZwSetInformationFile,	0_2_6DF43591
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	0_2_6DF5DD80
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89D70 ZwAlpcQueryInformation,	0_2_6DF89D70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	0_2_6DFD1570
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1D6A ZwWaitForMultipleObjects,	0_2_6DFD1D6A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E013EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6E013EBC
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1D43 ZwQueryInformationThread,	0_2_6DFD1D43
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	0_2_6DF74D3B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018ED6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6DF71520
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89520 ZwWaitForSingleObject,	0_2_6DF89520
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFFD22 ZwQueryInformationProcess,RtlUniform,	0_2_6DFFFD22
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1D0B ZwSetInformationProcess,	0_2_6DFD1D0B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	0_2_6DFF64FB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	0_2_6DF4F4E3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1CE4 ZwQueryInformationProcess,	0_2_6DFD1CE4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42CDB RtlFreeHeap,ZwClose,ZwSetEvent,	0_2_6DF42CDB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CCC0 memcpy,RtlGetNtSystemRoot,RtlInitUnicodeString,memcpy,ZwOpenKey,ZwClose,ZwEnumerateKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,	0_2_6DF7CCC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018F6A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC3C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	0_2_6DFC3C93
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8A480 ZwInitializeNlsFiles,	0_2_6DF8A480
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89C70 ZwAlpcConnectPort,	0_2_6DF89C70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF85C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	0_2_6DF85C70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1C76 ZwQueryInformationProcess,	0_2_6DFD1C76
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	0_2_6DF6746D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	0_2_6DFF3C60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,	0_2_6DF45450
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1C49 ZwQueryInformationProcess,	0_2_6DFD1C49
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89C40 ZwAllocateVirtualMemoryEx,	0_2_6DF89C40
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6FC39 ZwAssociateWaitCompletionPacket,	0_2_6DF6FC39
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8A420 ZwGetNlsSectionPtr,	0_2_6DF8A420
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF80413 ZwUnmapViewOfSection,	0_2_6DF80413
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF50FFD RtlInitUnicodeString,ZwQueryValueKey,	0_2_6DF50FFD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD0FEC ZwDuplicateObject,ZwDuplicateObject,	0_2_6DFD0FEC
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001411 ZwTraceEvent,	0_2_6E001411
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018C14
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF737EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	0_2_6DF737EB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,	0_2_6DF7DFDF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8AFD0 ZwShutdownWorkerFactory,	0_2_6DF8AFD0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,	0_2_6DF4F7C0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF897C0 ZwTerminateProcess,	0_2_6DF897C0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7D7CA RtlImageNtHeader,RtlFreeHeap,ZwCreateSection,ZwMapViewOfSection,ZwClose,RtlImageNtHeader,ZwClose,RtlFreeHeap,ZwClose,ZwClose,ZwUnmapViewOfSection,	0_2_6DF7D7CA
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF897A0 ZwUnmapViewOfSection,	0_2_6DF897A0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF83FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,	0_2_6DF83FA0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7FF9C RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlInitUnicodeString,	0_2_6DF7FF9C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018C75
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF5F87 ZwUnmapViewOfSection,	0_2_6DFF5F87
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD5780 DbgPrompt,ZwWow64DebuggerCall,	0_2_6DFD5780
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89F70 ZwCreateIoCompletion,	0_2_6DF89F70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89770 ZwSetInformationFile,	0_2_6DF89770
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	0_2_6DFFCF70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	0_2_6DFD176C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlGetPersistedStateLocation,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,	0_2_6DF46F60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8AF60 ZwSetTimer2,	0_2_6DF8AF60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CF6A memcpy,memcpy,RtlDosPathNameToRelativeNtPathName_U,ZwOpenFile,memcpy,RtlFreeHeap,RtlDeleteBoundaryDescriptor,DbgPrintEx,DbgPrintEx,DbgPrintEx,ZwClose,RtlFreeHeap,DbgPrintEx,memcpy,DbgPrintEx,ZwClose,	0_2_6DF7CF6A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD5F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,	0_2_6DFD5F5F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89750 ZwQueryInformationThread,	0_2_6DF89750
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E014CAB ZwTraceControl,	0_2_6E014CAB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF80F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	0_2_6DF80F48
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E019CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E019CB3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89740 ZwOpenThreadToken,	0_2_6DF89740
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	0_2_6DF7174B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,	0_2_6DF7E730
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89730 ZwQueryVirtualMemory,	0_2_6DF89730
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFCF30 ZwAlertThreadByThreadId,	0_2_6DFFCF30
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018CD6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89710 ZwQueryInformationToken,	0_2_6DF89710
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD6715 memset,memcpy,ZwTraceEvent,	0_2_6DFD6715
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF79702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	0_2_6DF79702
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0014FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E0014FB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	0_2_6DF4B6F0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD16FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	0_2_6DFD16FA
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF9DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	0_2_6DF9DEF0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF576FE RtlInitUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,ZwOpenKey,ZwClose,	0_2_6DF576FE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6E6F9 ZwAlpcSetInformation,	0_2_6DF6E6F9
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF896E0 ZwFreeVirtualMemory,	0_2_6DF896E0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF466D4 RtlInitUnicodeString,ZwQueryValueKey,	0_2_6DF466D4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF79ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	0_2_6DF79ED0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF896D0 ZwCreateKey,	0_2_6DF896D0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	0_2_6DF42ED8
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018D34
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF896C0 ZwSetInformationProcess,	0_2_6DF896C0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,	0_2_6DF6E6B0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E011D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,	0_2_6E011D55
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD2EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6DFD2EA3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E006D61 ZwAllocateVirtualMemoryEx,	0_2_6E006D61
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	0_2_6DFFBE9B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	0_2_6DF7DE9E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42E9F ZwCreateEvent,ZwClose,	0_2_6DF42E9F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6DF43E80
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00B581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E00B581
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001582 ZwTraceEvent,	0_2_6E001582
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8967A NtQueryInformationProcess,	0_2_6DF8967A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8AE70 ZwSetInformationWorkerFactory,	0_2_6DF8AE70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89670 ZwQueryInformationProcess,	0_2_6DF89670
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,	0_2_6DF7BE62
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	0_2_6DF8B650
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89650 ZwQueryValueKey,	0_2_6DF89650
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD6652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,	0_2_6DFD6652
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	0_2_6DF8B640
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6DFFFE3F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B630 ZwWaitForKeyedEvent,	0_2_6DF4B630
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89E30 ZwCancelWaitCompletionPacket,	0_2_6DF89E30
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89E20 ZwCancelTimer2,	0_2_6DF89E20
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD2E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6DFD2E14
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	0_2_6DF4C600
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	0_2_6E018214
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD19C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	0_2_6DFD19C8
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC51BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,	0_2_6DFC51BE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8A9B0 ZwQueryLicenseValue,	0_2_6DF8A9B0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7C9BF DbgPrintEx,wcsrchr,memcpy,DbgPrintEx,ZwClose,DbgPrintEx,DbgPrintEx,RtlDosPathNameToRelativeNtPathName_U,DbgPrintEx,ZwOpenFile,ZwClose,RtlFreeHeap,DbgPrintEx,DbgPrintEx,DbgPrintEx,RtlDeleteBoundaryDescriptor,ZwClose,RtlFreeHeap,	0_2_6DF7C9BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8B1A0 ZwWaitForKeyedEvent,	0_2_6DF8B1A0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018A62
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89990 ZwQueryVolumeInformationFile,	0_2_6DF89990
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	0_2_6DF4519E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	0_2_6DF6C182
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8B180 ZwWaitForAlertByThreadId,	0_2_6DF8B180
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89980 ZwCreateEvent,	0_2_6DF89980
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	0_2_6DFF6186
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7D976 ZwCreateFile,ZwCreateFile,	0_2_6DF7D976
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	0_2_6DF4B171
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1976 ZwCreateEvent,	0_2_6DFD1976
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8B160 ZwUpdateWnfStateData,	0_2_6DF8B160
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8A160 ZwCreateWorkerFactory,	0_2_6DF8A160
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,	0_2_6DF4F150
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8B150 ZwUnsubscribeWnfStateChange,	0_2_6DF8B150
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	0_2_6DF4395E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	0_2_6DF6B944
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD193B ZwRaiseException,ZwTerminateProcess,	0_2_6DFD193B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8A130 ZwCreateWaitCompletionPacket,	0_2_6DF8A130
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89920 ZwDuplicateToken,	0_2_6DF89920
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018ADD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,	0_2_6DF49100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF50100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	0_2_6DF50100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89900 ZwOpenEvent,	0_2_6DF89900
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFE5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,RtlAssert,ZwTerminateProcess,	0_2_6DFE5100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	0_2_6DF4B8F0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF440FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	0_2_6DF440FD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF60E9 ZwOpenKey,ZwClose,ZwClose,	0_2_6DFF60E9
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E00131B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF898D0 ZwQueryAttributesFile,	0_2_6DF898D0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8A0D0 ZwCreateTimer2,	0_2_6DF8A0D0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF810D7 ZwOpenKey,ZwCreateKey,	0_2_6DF810D7
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF470C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	0_2_6DF470C0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF800C2 ZwAlertThreadByThreadId,	0_2_6DF800C2
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	0_2_6DF7F0BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8B0B0 ZwTraceControl,	0_2_6DF8B0B0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF718B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	0_2_6DF718B9
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6F0AE ZwSetInformationWorkerFactory,	0_2_6DF6F0AE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018B58
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF60A2 ZwQueryInformationFile,	0_2_6DFF60A2
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	0_2_6DF6E090
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8A890 ZwQueryDebugFilterState,	0_2_6DF8A890
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89890 ZwFsControlFile,	0_2_6DF89890
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8108B ZwClose,	0_2_6DF8108B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	0_2_6DF43880
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,	0_2_6DF7A080
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	0_2_6DFD1879
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E00138A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5106F ZwOpenKey,ZwClose,	0_2_6DF5106F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,	0_2_6DF45050
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E001BA8
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89850 ZwQueryDirectoryFile,	0_2_6DF89850
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018BB6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89840 ZwDelayExecution,	0_2_6DF89840
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E019BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E019BBE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89830 ZwOpenFile,	0_2_6DF89830
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,	0_2_6DF74020
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	0_2_6DF4F018
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF423F6 ZwClose,RtlFreeHeap,	0_2_6DF423F6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89BF0 ZwAlertThreadByThreadId,	0_2_6DF89BF0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	0_2_6DF5A3E0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01F019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	0_2_6E01F019
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	0_2_6DF42BC2
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8A3A0 ZwGetCompleteWnfStateSubscription,	0_2_6DF8A3A0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018858 ZwAlertThreadByThreadId,	0_2_6E018858
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	0_2_6DF74BAD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	0_2_6DF42B93
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	0_2_6DF7939F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8AB70 ZwReleaseWorkerFactoryWorker,	0_2_6DF8AB70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42B7E ZwSetInformationThread,ZwClose,	0_2_6DF42B7E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	0_2_6DF73B7A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD8372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	0_2_6DFD8372
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	0_2_6DFF6369
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8AB60 ZwReleaseKeyedEvent,	0_2_6DF8AB60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD6365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,	0_2_6DFD6365
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73B48 ZwClose,ZwClose,	0_2_6DF73B48
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49335 ZwClose,ZwClose,	0_2_6DF49335
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF75306 ZwReleaseKeyedEvent,	0_2_6DF75306
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	0_2_6DF44B00
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89B00 ZwSetValueKey,	0_2_6DF89B00
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89AE0 ZwTraceEvent,	0_2_6DF89AE0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8AAE0 ZwRaiseException,	0_2_6DF8AAE0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,	0_2_6DF6FAD0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1AD6 ZwFreeVirtualMemory,	0_2_6DFD1AD6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8AAC0 ZwQueryWnfStateNameInformation,	0_2_6DF8AAC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01F13B ZwOpenKey,ZwCreateKey,	0_2_6E01F13B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89AB0 ZwWaitForMultipleObjects,	0_2_6DF89AB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7E2BB ZwWaitForAlertByThreadId,	0_2_6DF7E2BB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF41AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	0_2_6DF41AA0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF75AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,	0_2_6DF75AA0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	0_2_6DF7D294
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E018966
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8AA90 ZwQuerySystemInformationEx,	0_2_6DF8AA90
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	0_2_6DF4429E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF62280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,	0_2_6DF62280
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8B280 ZwWow64DebuggerCall,	0_2_6DF8B280
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,	0_2_6DF7DA88
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00A189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	0_2_6E00A189
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0049A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	0_2_6E0049A4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89A50 ZwCreateFile,	0_2_6DF89A50
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	0_2_6DF49240
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01F1B5 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	0_2_6E01F1B5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD1242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	0_2_6DFD1242
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,	0_2_6DF7B230
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89A30 ZwTerminateThread,	0_2_6DF89A30
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF48239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	0_2_6DF48239
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	0_2_6DF44A20
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD4A28 ZwOpenKey,DbgPrintEx,ZwQueryValueKey,DbgPrintEx,DbgPrintEx,memcpy,ZwClose,	0_2_6DFD4A28
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	0_2_6DF45210
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0189E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,	0_2_6E0189E7
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF89A00 ZwProtectVirtualMemory,	0_2_6DF89A00
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_00401718 Sleep,NtTerminateProcess,	17_2_00401718
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_004012E3 NtAllocateVirtualMemory,	17_2_004012E3
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_00401288 NtAllocateVirtualMemory,NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,	17_2_00401288
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_004016B6 Sleep,NtTerminateProcess,	17_2_004016B6
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_00402368 NtClose,	17_2_00402368
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_00401723 Sleep,NtTerminateProcess,	17_2_00401723
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_0040172E Sleep,NtTerminateProcess,	17_2_0040172E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049600 ZwOpenKey,LdrInitializeThunk,	17_2_6E049600
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049660 ZwAllocateVirtualMemory,LdrInitializeThunk,	17_2_6E049660
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049780 ZwMapViewOfSection,LdrInitializeThunk,	17_2_6E049780
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049820 ZwEnumerateKey,LdrInitializeThunk,	17_2_6E049820
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049860 ZwQuerySystemInformation,LdrInitializeThunk,	17_2_6E049860
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0498C0 ZwDuplicateObject,LdrInitializeThunk,	17_2_6E0498C0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0499A0 ZwCreateSection,LdrInitializeThunk,	17_2_6E0499A0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	17_2_6E00C600
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E092E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E092E14
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049E20 ZwCancelTimer2,	17_2_6E049E20
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D3E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	17_2_6E0D3E22
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00B630 ZwWaitForKeyedEvent,	17_2_6E00B630
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0BFE3F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049E30 ZwCancelWaitCompletionPacket,	17_2_6E049E30
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	17_2_6E04B640
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	17_2_6E04B650
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049650 ZwQueryValueKey,	17_2_6E049650
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E096652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,	17_2_6E096652
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,	17_2_6E03BE62
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04AE70 ZwSetInformationWorkerFactory,	17_2_6E04AE70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049670 ZwQueryInformationProcess,	17_2_6E049670
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04967A NtQueryInformationProcess,	17_2_6E04967A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E003E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E003E80
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	17_2_6E0BBE9B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	17_2_6E03DE9E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002E9F ZwCreateEvent,ZwClose,	17_2_6E002E9F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E092EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E092EA3
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D3EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	17_2_6E0D3EBC
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,	17_2_6E02E6B0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0496C0 ZwSetInformationProcess,	17_2_6E0496C0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E039ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	17_2_6E039ED0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0496D0 ZwCreateKey,	17_2_6E0496D0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0066D4 RtlInitUnicodeString,ZwQueryValueKey,	17_2_6E0066D4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	17_2_6E002ED8
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8ED6
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0496E0 ZwFreeVirtualMemory,	17_2_6E0496E0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	17_2_6E00B6F0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0916FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	17_2_6E0916FA
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E05DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	17_2_6E05DEF0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02E6F9 ZwAlpcSetInformation,	17_2_6E02E6F9
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E039702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	17_2_6E039702
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049710 ZwQueryInformationToken,	17_2_6E049710
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E096715 memset,memcpy,ZwTraceEvent,	17_2_6E096715
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,	17_2_6E03E730
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049730 ZwQueryVirtualMemory,	17_2_6E049730
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BCF30 ZwAlertThreadByThreadId,	17_2_6E0BCF30
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049740 ZwOpenThreadToken,	17_2_6E049740
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	17_2_6E03174B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E040F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	17_2_6E040F48
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049750 ZwQueryInformationThread,	17_2_6E049750
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E095F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,	17_2_6E095F5F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E006F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlGetPersistedStateLocation,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,	17_2_6E006F60
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04AF60 ZwSetTimer2,	17_2_6E04AF60
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E09176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	17_2_6E09176C
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8F6A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049F70 ZwCreateIoCompletion,	17_2_6E049F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049770 ZwSetInformationFile,	17_2_6E049770
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	17_2_6E0BCF70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E095780 DbgPrompt,ZwWow64DebuggerCall,	17_2_6E095780
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0B5F87 ZwUnmapViewOfSection,	17_2_6E0B5F87
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0497A0 ZwUnmapViewOfSection,	17_2_6E0497A0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E043FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,	17_2_6E043FA0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,	17_2_6E00F7C0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0497C0 ZwTerminateProcess,	17_2_6E0497C0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04AFD0 ZwShutdownWorkerFactory,	17_2_6E04AFD0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,	17_2_6E03DFDF
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E090FEC ZwDuplicateObject,ZwDuplicateObject,	17_2_6E090FEC
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0337EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	17_2_6E0337EB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E010FFD RtlInitUnicodeString,ZwQueryValueKey,	17_2_6E010FFD
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E040413 ZwUnmapViewOfSection,	17_2_6E040413
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8C14
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C1411 ZwTraceEvent,	17_2_6E0C1411
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04A420 ZwGetNlsSectionPtr,	17_2_6E04A420
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02FC39 ZwAssociateWaitCompletionPacket,	17_2_6E02FC39
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091C49 ZwQueryInformationProcess,	17_2_6E091C49
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049C40 ZwAllocateVirtualMemoryEx,	17_2_6E049C40
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E005450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,	17_2_6E005450
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0B3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	17_2_6E0B3C60
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	17_2_6E02746D
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049C70 ZwAlpcConnectPort,	17_2_6E049C70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E045C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	17_2_6E045C70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	17_2_6E03AC7B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8C75
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091C76 ZwQueryInformationProcess,	17_2_6E091C76
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04A480 ZwInitializeNlsFiles,	17_2_6E04A480
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C4496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	17_2_6E0C4496
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E083C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	17_2_6E083C93
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D4CAB ZwTraceControl,	17_2_6E0D4CAB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D9CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D9CB3
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8CD6
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002CDB RtlFreeHeap,ZwClose,ZwSetEvent,	17_2_6E002CDB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	17_2_6E00F4E3
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091CE4 ZwQueryInformationProcess,	17_2_6E091CE4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0B64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	17_2_6E0B64FB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C14FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0C14FB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091D0B ZwSetInformationProcess,	17_2_6E091D0B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E031520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E031520
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049520 ZwWaitForSingleObject,	17_2_6E049520
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BFD22 ZwQueryInformationProcess,RtlUniform,	17_2_6E0BFD22
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E034D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	17_2_6E034D3B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8D34
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091D43 ZwQueryInformationThread,	17_2_6E091D43
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D1D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,	17_2_6E0D1D55
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091D6A ZwWaitForMultipleObjects,	17_2_6E091D6A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C6D61 ZwAllocateVirtualMemoryEx,	17_2_6E0C6D61
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049D70 ZwAlpcQueryInformation,	17_2_6E049D70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	17_2_6E091570
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E01DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	17_2_6E01DD80
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0CB581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0CB581
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C1582 ZwTraceEvent,	17_2_6E0C1582
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E003591 ZwSetInformationFile,	17_2_6E003591
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0065A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	17_2_6E0065A0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049DA0 ZwAlpcSendWaitReceivePort,	17_2_6E049DA0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0495B0 ZwSetInformationThread,	17_2_6E0495B0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049DB0 ZwAlpcSetInformation,	17_2_6E049DB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E004DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,	17_2_6E004DC0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0495C0 ZwSetEvent,	17_2_6E0495C0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02EDC4 ZwCancelWaitCompletionPacket,	17_2_6E02EDC4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0045D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	17_2_6E0045D0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0495D0 ZwClose,	17_2_6E0495D0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0BFDD3
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049DE0 ZwAssociateWaitCompletionPacket,	17_2_6E049DE0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0095F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,	17_2_6E0095F0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	17_2_6E0BBDFA
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0495F0 ZwQueryInformationFile,	17_2_6E0495F0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049A00 ZwProtectVirtualMemory,	17_2_6E049A00
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E005210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	17_2_6E005210
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	17_2_6E0D8214
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E004A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	17_2_6E004A20
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	17_2_6E02A229
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,	17_2_6E03B230
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049A30 ZwTerminateThread,	17_2_6E049A30
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E008239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	17_2_6E008239
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E009240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	17_2_6E009240
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	17_2_6E091242
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8A62
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E022280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,	17_2_6E022280
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04B280 ZwWow64DebuggerCall,	17_2_6E04B280
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,	17_2_6E03DA88
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04AA90 ZwQuerySystemInformationEx,	17_2_6E04AA90
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	17_2_6E03D294
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	17_2_6E00429E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E001AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	17_2_6E001AA0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E035AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,	17_2_6E035AA0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0052A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,	17_2_6E0052A5
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049AB0 ZwWaitForMultipleObjects,	17_2_6E049AB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03E2BB ZwWaitForAlertByThreadId,	17_2_6E03E2BB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04AAC0 ZwQueryWnfStateNameInformation,	17_2_6E04AAC0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8ADD
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,	17_2_6E02FAD0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091AD6 ZwFreeVirtualMemory,	17_2_6E091AD6
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049AE0 ZwTraceEvent,	17_2_6E049AE0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04AAE0 ZwRaiseException,	17_2_6E04AAE0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E004B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	17_2_6E004B00
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049B00 ZwSetValueKey,	17_2_6E049B00
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E035306 ZwReleaseKeyedEvent,	17_2_6E035306
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0C131B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E009335 ZwClose,ZwClose,	17_2_6E009335
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E033B48 ZwClose,ZwClose,	17_2_6E033B48
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8B58
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0B6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	17_2_6E0B6369
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04AB60 ZwReleaseKeyedEvent,	17_2_6E04AB60
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E096365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,	17_2_6E096365
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04AB70 ZwReleaseWorkerFactoryWorker,	17_2_6E04AB70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E033B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	17_2_6E033B7A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E098372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	17_2_6E098372
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002B7E ZwSetInformationThread,ZwClose,	17_2_6E002B7E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0C138A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	17_2_6E002B93
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	17_2_6E03939F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04A3A0 ZwGetCompleteWnfStateSubscription,	17_2_6E04A3A0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C1BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0C1BA8
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E034BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	17_2_6E034BAD
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D9BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D9BBE
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8BB6
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	17_2_6E002BC2
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E01A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	17_2_6E01A3E0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049BF0 ZwAlertThreadByThreadId,	17_2_6E049BF0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0023F6 ZwClose,RtlFreeHeap,	17_2_6E0023F6
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0DF019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	17_2_6E0DF019
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	17_2_6E00F018
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E034020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,	17_2_6E034020
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049830 ZwOpenFile,	17_2_6E049830
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049840 ZwDelayExecution,	17_2_6E049840
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E005050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,	17_2_6E005050
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049850 ZwQueryDirectoryFile,	17_2_6E049850
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8858 ZwAlertThreadByThreadId,	17_2_6E0D8858
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E01106F ZwOpenKey,ZwClose,	17_2_6E01106F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	17_2_6E091879
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E003880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	17_2_6E003880
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,	17_2_6E03A080
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04108B ZwClose,	17_2_6E04108B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	17_2_6E02E090
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04A890 ZwQueryDebugFilterState,	17_2_6E04A890
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049890 ZwFsControlFile,	17_2_6E049890
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0B60A2 ZwQueryInformationFile,	17_2_6E0B60A2
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02F0AE ZwSetInformationWorkerFactory,	17_2_6E02F0AE
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04B0B0 ZwTraceControl,	17_2_6E04B0B0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0318B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	17_2_6E0318B9
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	17_2_6E03F0BF
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0070C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	17_2_6E0070C0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0400C2 ZwAlertThreadByThreadId,	17_2_6E0400C2
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0410D7 ZwOpenKey,ZwCreateKey,	17_2_6E0410D7
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0498D0 ZwQueryAttributesFile,	17_2_6E0498D0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04A0D0 ZwCreateTimer2,	17_2_6E04A0D0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0B60E9 ZwOpenKey,ZwClose,ZwClose,	17_2_6E0B60E9
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	17_2_6E00B8F0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0040FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	17_2_6E0040FD
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E009100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,	17_2_6E009100
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E010100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	17_2_6E010100
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049900 ZwOpenEvent,	17_2_6E049900
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0A5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,RtlAssert,ZwTerminateProcess,	17_2_6E0A5100
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049920 ZwDuplicateToken,	17_2_6E049920
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E09193B ZwRaiseException,ZwTerminateProcess,	17_2_6E09193B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04A130 ZwCreateWaitCompletionPacket,	17_2_6E04A130
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0DF13B ZwOpenKey,ZwCreateKey,	17_2_6E0DF13B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	17_2_6E02B944
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,	17_2_6E00F150
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04B150 ZwUnsubscribeWnfStateChange,	17_2_6E04B150
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	17_2_6E00395E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04B160 ZwUpdateWnfStateData,	17_2_6E04B160
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04A160 ZwCreateWorkerFactory,	17_2_6E04A160
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	17_2_6E0D8966
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	17_2_6E00B171
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E091976 ZwCreateEvent,	17_2_6E091976
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	17_2_6E02C182
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04B180 ZwWaitForAlertByThreadId,	17_2_6E04B180
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049980 ZwCreateEvent,	17_2_6E049980
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0CA189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	17_2_6E0CA189
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0B6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	17_2_6E0B6186
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E049990 ZwQueryVolumeInformationFile,	17_2_6E049990
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	17_2_6E00519E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04B1A0 ZwWaitForKeyedEvent,	17_2_6E04B1A0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C49A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	17_2_6E0C49A4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E04A9B0 ZwQueryLicenseValue,	17_2_6E04A9B0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0851BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,	17_2_6E0851BE
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0919C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	17_2_6E0919C8

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF62D50	0_2_6DF62D50
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF40D20	0_2_6DF40D20
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E012EF7	0_2_6E012EF7
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF62430	0_2_6DF62430
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0067E2	0_2_6E0067E2
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E011D55	0_2_6E011D55
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFCAE60	0_2_6DFCAE60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF66E30	0_2_6DF66E30
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF62990	0_2_6DF62990
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0132A9	0_2_6E0132A9
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00E2C5	0_2_6E00E2C5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5B090	0_2_6DF5B090
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF78840	0_2_6DF78840
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A830	0_2_6DF6A830
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46800	0_2_6DF46800
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001002	0_2_6E001002
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF98BE8	0_2_6DF98BE8
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF23E3	0_2_6DFF23E3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7ABD8	0_2_6DF7ABD8
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7EBB0	0_2_6DF7EBB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFEEB8A	0_2_6DFEEB8A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF63360	0_2_6DF63360
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6AB40	0_2_6DF6AB40
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFFA2B	0_2_6DFFFA2B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E026E30	17_2_6E026E30
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D2EF7	17_2_6E0D2EF7
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E032F70	17_2_6E032F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C67E2	17_2_6E0C67E2
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C4496	17_2_6E0C4496
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E000D20	17_2_6E000D20
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E022D50	17_2_6E022D50
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D1D55	17_2_6E0D1D55
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0335D0	17_2_6E0335D0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BFA2B	17_2_6E0BFA2B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D32A9	17_2_6E0D32A9
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0CE2C5	17_2_6E0CE2C5
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C4AEF	17_2_6E0C4AEF
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02A309	17_2_6E02A309
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02AB40	17_2_6E02AB40
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E023360	17_2_6E023360
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0AEB8A	17_2_6E0AEB8A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03EBB0	17_2_6E03EBB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03ABD8	17_2_6E03ABD8
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0B23E3	17_2_6E0B23E3
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E058BE8	17_2_6E058BE8
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E006800	17_2_6E006800
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0C1002	17_2_6E0C1002
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02A830	17_2_6E02A830
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E038840	17_2_6E038840
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E01B090	17_2_6E01B090
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0299BF	17_2_6E0299BF
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_0041246A	17_2_0041246A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_004108BE	17_2_004108BE
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_004129AE	17_2_004129AE
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_00412EF2	17_2_00412EF2
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_004143DF	17_2_004143DF
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 26_2_0041246A	26_2_0041246A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 26_2_00412EF2	26_2_00412EF2
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 26_2_004108BE	26_2_004108BE
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 26_2_004143DF	26_2_004143DF
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 26_2_004129AE	26_2_004129AE

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: String function: 6DF4B150 appears 128 times
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: String function: 6DFD5720 appears 76 times
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: String function: 6DF9D08C appears 40 times
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: String function: 6E095720 appears 48 times
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: String function: 6E05D08C appears 39 times
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: String function: 004115A0 appears 46 times
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: String function: 6E00B150 appears 128 times

Source: http___citycapproperty.ru_localmod_nmode.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: http___citycapproperty.ru_localmod_nmode.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: http___citycapproperty.ru_localmod_nmode.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: http___citycapproperty.ru_localmod_nmode.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eurbbce.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eurbbce.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eurbbce.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eurbbce.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 9419.tmp.26.dr	Static PE information: No import functions for PE file found
Source: 9419.tmp.17.dr	Static PE information: No import functions for PE file found
Source: 9419.tmp.0.dr	Static PE information: No import functions for PE file found

Source: http___citycapproperty.ru_localmod_nmode.exe, 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs http___citycapproperty.ru_localmod_nmode.exe

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: http___citycapproperty.ru_localmod_nmode.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 9419.tmp.26.dr

Binary string: \Device\IPT

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/5@12/4

Source: C:\Users\user\AppData\Roaming\eurbbce

Code function: 17_2_0040E397 EnumTimeFormatsW,DebugBreakProcess,RtlLeaveCriticalSection,BuildCommDCBAndTimeoutsA,GetPriorityClass,LoadResource,SizeofResource,

17_2_0040E397

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\eurbbce

Jump to behavior

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

File created: C:\Users\user\AppData\Local\Temp\9419.tmp

Jump to behavior

Source: http___citycapproperty.ru_localmod_nmode.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: http___citycapproperty.ru_localmod_nmode.exe	Virustotal: Detection: 31%
Source: http___citycapproperty.ru_localmod_nmode.exe	ReversingLabs: Detection: 27%

Source: unknown	Process created: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe 'C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\eurbbce C:\Users\user\AppData\Roaming\eurbbce
Source: unknown	Process created: C:\Users\user\AppData\Roaming\eurbbce C:\Users\user\AppData\Roaming\eurbbce

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: http___citycapproperty.ru_localmod_nmode.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\ducasilot26\wenuboki\pobimojepig\wohemeligowub_laluw.pdb source: http___citycapproperty.ru_localmod_nmode.exe
Source:	Binary string: GC:\ducasilot26\wenuboki\pobimojepig\wohemeligowub_laluw.pdbibecoki.pdb source: http___citycapproperty.ru_localmod_nmode.exe
Source:	Binary string: wntdll.pdbUGP source: http___citycapproperty.ru_localmod_nmode.exe, 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, eurbbce, 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, eurbbce, 0000001A.00000002.497653342.000000006DFE1000.00000020.00020000.sdmp, 9419.tmp.26.dr
Source:	Binary string: wntdll.pdb source: http___citycapproperty.ru_localmod_nmode.exe, eurbbce, eurbbce, 0000001A.00000002.497653342.000000006DFE1000.00000020.00020000.sdmp, 9419.tmp.26.dr
Source:	Binary string: ibecoki.pdb source: http___citycapproperty.ru_localmod_nmode.exe

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Unpacked PE file: 0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\eurbbce	Unpacked PE file: 17.2.eurbbce.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\eurbbce	Unpacked PE file: 26.2.eurbbce.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Source: 9419.tmp.0.dr

Static PE information: 0xC8733C73 [Sun Jul 26 13:21:55 2076 UTC]

Source: 9419.tmp.0.dr	Static PE information: section name: RT
Source: 9419.tmp.0.dr	Static PE information: section name: .mrdata
Source: 9419.tmp.0.dr	Static PE information: section name: .00cfg
Source: 9419.tmp.17.dr	Static PE information: section name: RT
Source: 9419.tmp.17.dr	Static PE information: section name: .mrdata
Source: 9419.tmp.17.dr	Static PE information: section name: .00cfg
Source: 9419.tmp.26.dr	Static PE information: section name: RT
Source: 9419.tmp.26.dr	Static PE information: section name: .mrdata
Source: 9419.tmp.26.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_0040541E push es; retf	0_2_0040542B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_00402CC2 push eax; ret	0_2_00402D82
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_00406EA1 push eax; ret	0_2_00406EA2
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_004030A8 push ecx; ret	0_2_004030B9
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_00406F0D push eax; ret	0_2_00406F0E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF9D0D1 push ecx; ret	0_2_6DF9D0E4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_0040541E push es; retf	17_2_0040542B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_00402CC2 push eax; ret	17_2_00402D82
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_00406EA1 push eax; ret	17_2_00406EA2
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_004030A8 push ecx; ret	17_2_004030B9
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_00406F0D push eax; ret	17_2_00406F0E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E05D0D1 push ecx; ret	17_2_6E05D0E4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 26_2_0069546E push es; retf	26_2_0069547B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 26_2_006930F8 push ecx; ret	26_2_00693109

Source: initial sample	Static PE information: section name: .text entropy: 6.85305507137
Source: initial sample	Static PE information: section name: .text entropy: 6.85305507137
Source: initial sample	Static PE information: section name: .text entropy: 6.85305507137

Source: C:\Users\user\AppData\Roaming\eurbbce	File created: C:\Users\user\AppData\Local\Temp\9419.tmp			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\eurbbce			Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\eurbbce

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\http___citycapproperty.ru_localmod_nmode.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\eurbbce:Zone.Identifier read attributes | delete

Jump to behavior

Malware Analysis System Evasion:

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Renames NTDLL to bypass HIPS

Show sources

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	File opened: C:\Windows\SysWOW64\ntdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	File opened: C:\Windows\SysWOW64\ntdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	File opened: C:\Windows\SysWOW64\ntdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	File opened: C:\Windows\SysWOW64\ntdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	File opened: C:\Windows\SysWOW64\ntdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	File opened: C:\Windows\SysWOW64\ntdll.dll	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: http___citycapproperty.ru_localmod_nmode.exe, 00000000.00000002.272138149.0000000000848000.00000040.00000001.sdmp

Binary or memory string: ASWHOOK

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

Code function: 0_2_6DF76B90 rdtsc

0_2_6DF76B90

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 570	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 411	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 449	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 449	Jump to behavior

Source: C:\Windows\explorer.exe TID: 4252	Thread sleep count: 570 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5688	Thread sleep count: 411 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5688	Thread sleep time: -41100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5896	Thread sleep count: 449 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5896	Thread sleep time: -44900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6672	Thread sleep count: 449 > 30	Jump to behavior

Source: C:\Users\user\AppData\Roaming\eurbbce

Last function: Thread delayed

Source: explorer.exe, 00000003.00000000.249153033.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.250416090.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.262858489.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.250455141.0000000003767000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000000.249153033.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000003.00000000.263247793.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000003.00000000.262858489.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.257679142.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000003.00000000.262858489.0000000008270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.263247793.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: explorer.exe, 00000003.00000000.262858489.0000000008270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\explorer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

Code function: 0_2_6DF76B90 rdtsc

0_2_6DF76B90

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

Code function: 0_2_6DF89780 ZwMapViewOfSection,LdrInitializeThunk,

0_2_6DF89780

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF495F0 mov eax, dword ptr fs:[00000030h]	0_2_6DF495F0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF495F0 mov ecx, dword ptr fs:[00000030h]	0_2_6DF495F0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF8DF1 mov eax, dword ptr fs:[00000030h]	0_2_6DFF8DF1
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF795EC mov eax, dword ptr fs:[00000030h]	0_2_6DF795EC
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFFDD3 mov eax, dword ptr fs:[00000030h]	0_2_6DFFFDD3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF415C1 mov eax, dword ptr fs:[00000030h]	0_2_6DF415C1
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71DB5 mov eax, dword ptr fs:[00000030h]	0_2_6DF71DB5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71DB5 mov eax, dword ptr fs:[00000030h]	0_2_6DF71DB5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71DB5 mov eax, dword ptr fs:[00000030h]	0_2_6DF71DB5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43591 mov eax, dword ptr fs:[00000030h]	0_2_6DF43591
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6C577 mov eax, dword ptr fs:[00000030h]	0_2_6DF6C577
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6C577 mov eax, dword ptr fs:[00000030h]	0_2_6DF6C577
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF67D50 mov eax, dword ptr fs:[00000030h]	0_2_6DF67D50
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4354C mov eax, dword ptr fs:[00000030h]	0_2_6DF4354C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4354C mov eax, dword ptr fs:[00000030h]	0_2_6DF4354C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF8D47 mov eax, dword ptr fs:[00000030h]	0_2_6DFF8D47
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF3D40 mov eax, dword ptr fs:[00000030h]	0_2_6DFF3D40
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4AD30 mov eax, dword ptr fs:[00000030h]	0_2_6DF4AD30
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74D3B mov eax, dword ptr fs:[00000030h]	0_2_6DF74D3B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74D3B mov eax, dword ptr fs:[00000030h]	0_2_6DF74D3B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74D3B mov eax, dword ptr fs:[00000030h]	0_2_6DF74D3B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018ED6 mov eax, dword ptr fs:[00000030h]	0_2_6E018ED6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71520 mov eax, dword ptr fs:[00000030h]	0_2_6DF71520
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71520 mov eax, dword ptr fs:[00000030h]	0_2_6DF71520
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71520 mov eax, dword ptr fs:[00000030h]	0_2_6DF71520
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71520 mov eax, dword ptr fs:[00000030h]	0_2_6DF71520
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF71520 mov eax, dword ptr fs:[00000030h]	0_2_6DF71520
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4F51D mov eax, dword ptr fs:[00000030h]	0_2_6DF4F51D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42CDB mov eax, dword ptr fs:[00000030h]	0_2_6DF42CDB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CCC0 mov eax, dword ptr fs:[00000030h]	0_2_6DF7CCC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CCC0 mov eax, dword ptr fs:[00000030h]	0_2_6DF7CCC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CCC0 mov eax, dword ptr fs:[00000030h]	0_2_6DF7CCC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CCC0 mov eax, dword ptr fs:[00000030h]	0_2_6DF7CCC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44CB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF44CB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7D4B0 mov eax, dword ptr fs:[00000030h]	0_2_6DF7D4B0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018F6A mov eax, dword ptr fs:[00000030h]	0_2_6E018F6A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4649B mov eax, dword ptr fs:[00000030h]	0_2_6DF4649B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4649B mov eax, dword ptr fs:[00000030h]	0_2_6DF4649B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF41480 mov eax, dword ptr fs:[00000030h]	0_2_6DF41480
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5FC77 mov eax, dword ptr fs:[00000030h]	0_2_6DF5FC77
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5FC77 mov eax, dword ptr fs:[00000030h]	0_2_6DF5FC77
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5FC77 mov eax, dword ptr fs:[00000030h]	0_2_6DF5FC77
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5FC77 mov eax, dword ptr fs:[00000030h]	0_2_6DF5FC77
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF85C70 mov eax, dword ptr fs:[00000030h]	0_2_6DF85C70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7AC7B mov eax, dword ptr fs:[00000030h]	0_2_6DF7AC7B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6746D mov eax, dword ptr fs:[00000030h]	0_2_6DF6746D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF62430 mov eax, dword ptr fs:[00000030h]	0_2_6DF62430
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF62430 mov eax, dword ptr fs:[00000030h]	0_2_6DF62430
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44439 mov eax, dword ptr fs:[00000030h]	0_2_6DF44439
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7BC2C mov eax, dword ptr fs:[00000030h]	0_2_6DF7BC2C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5FC01 mov eax, dword ptr fs:[00000030h]	0_2_6DF5FC01
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5FC01 mov eax, dword ptr fs:[00000030h]	0_2_6DF5FC01
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5FC01 mov eax, dword ptr fs:[00000030h]	0_2_6DF5FC01
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5FC01 mov eax, dword ptr fs:[00000030h]	0_2_6DF5FC01
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001C06 mov eax, dword ptr fs:[00000030h]	0_2_6E001C06
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01740D mov eax, dword ptr fs:[00000030h]	0_2_6E01740D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01740D mov eax, dword ptr fs:[00000030h]	0_2_6E01740D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01740D mov eax, dword ptr fs:[00000030h]	0_2_6E01740D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF837F5 mov eax, dword ptr fs:[00000030h]	0_2_6DF837F5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018C14 mov eax, dword ptr fs:[00000030h]	0_2_6E018C14
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF737EB mov eax, dword ptr fs:[00000030h]	0_2_6DF737EB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF737EB mov eax, dword ptr fs:[00000030h]	0_2_6DF737EB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF737EB mov eax, dword ptr fs:[00000030h]	0_2_6DF737EB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF737EB mov eax, dword ptr fs:[00000030h]	0_2_6DF737EB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF737EB mov eax, dword ptr fs:[00000030h]	0_2_6DF737EB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF737EB mov eax, dword ptr fs:[00000030h]	0_2_6DF737EB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF737EB mov eax, dword ptr fs:[00000030h]	0_2_6DF737EB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43FC5 mov eax, dword ptr fs:[00000030h]	0_2_6DF43FC5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43FC5 mov eax, dword ptr fs:[00000030h]	0_2_6DF43FC5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43FC5 mov eax, dword ptr fs:[00000030h]	0_2_6DF43FC5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7D7CA mov eax, dword ptr fs:[00000030h]	0_2_6DF7D7CA
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7D7CA mov eax, dword ptr fs:[00000030h]	0_2_6DF7D7CA
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov ecx, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42FB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF42FB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018450 mov eax, dword ptr fs:[00000030h]	0_2_6E018450
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018C75 mov eax, dword ptr fs:[00000030h]	0_2_6E018C75
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46F60 mov eax, dword ptr fs:[00000030h]	0_2_6DF46F60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46F60 mov eax, dword ptr fs:[00000030h]	0_2_6DF46F60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004496 mov eax, dword ptr fs:[00000030h]	0_2_6E004496
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6E760 mov eax, dword ptr fs:[00000030h]	0_2_6DF6E760
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6E760 mov eax, dword ptr fs:[00000030h]	0_2_6DF6E760
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CF6A mov eax, dword ptr fs:[00000030h]	0_2_6DF7CF6A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CF6A mov eax, dword ptr fs:[00000030h]	0_2_6DF7CF6A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD5F5F mov eax, dword ptr fs:[00000030h]	0_2_6DFD5F5F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD5F5F mov eax, dword ptr fs:[00000030h]	0_2_6DFD5F5F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD5F5F mov eax, dword ptr fs:[00000030h]	0_2_6DFD5F5F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD5F5F mov eax, dword ptr fs:[00000030h]	0_2_6DFD5F5F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD5F5F mov eax, dword ptr fs:[00000030h]	0_2_6DFD5F5F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4A745 mov eax, dword ptr fs:[00000030h]	0_2_6DF4A745
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E019CB3 mov eax, dword ptr fs:[00000030h]	0_2_6E019CB3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DF4C mov eax, dword ptr fs:[00000030h]	0_2_6DF7DF4C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46730 mov eax, dword ptr fs:[00000030h]	0_2_6DF46730
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46730 mov eax, dword ptr fs:[00000030h]	0_2_6DF46730
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46730 mov eax, dword ptr fs:[00000030h]	0_2_6DF46730
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7E730 mov eax, dword ptr fs:[00000030h]	0_2_6DF7E730
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6B73D mov eax, dword ptr fs:[00000030h]	0_2_6DF6B73D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6B73D mov eax, dword ptr fs:[00000030h]	0_2_6DF6B73D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018CD6 mov eax, dword ptr fs:[00000030h]	0_2_6E018CD6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44F2E mov eax, dword ptr fs:[00000030h]	0_2_6DF44F2E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44F2E mov eax, dword ptr fs:[00000030h]	0_2_6DF44F2E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6F716 mov eax, dword ptr fs:[00000030h]	0_2_6DF6F716
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74710 mov eax, dword ptr fs:[00000030h]	0_2_6DF74710
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFDFF10 mov eax, dword ptr fs:[00000030h]	0_2_6DFDFF10
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFDFF10 mov eax, dword ptr fs:[00000030h]	0_2_6DFDFF10
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7C707 mov eax, dword ptr fs:[00000030h]	0_2_6DF7C707
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7C707 mov ecx, dword ptr fs:[00000030h]	0_2_6DF7C707
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7C707 mov eax, dword ptr fs:[00000030h]	0_2_6DF7C707
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0014FB mov eax, dword ptr fs:[00000030h]	0_2_6E0014FB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF716E0 mov ecx, dword ptr fs:[00000030h]	0_2_6DF716E0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E003518 mov eax, dword ptr fs:[00000030h]	0_2_6E003518
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E003518 mov eax, dword ptr fs:[00000030h]	0_2_6E003518
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E003518 mov eax, dword ptr fs:[00000030h]	0_2_6E003518
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF83EE4 mov eax, dword ptr fs:[00000030h]	0_2_6DF83EE4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF83EE4 mov eax, dword ptr fs:[00000030h]	0_2_6DF83EE4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF83EE4 mov eax, dword ptr fs:[00000030h]	0_2_6DF83EE4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018D34 mov eax, dword ptr fs:[00000030h]	0_2_6E018D34
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC46A7 mov eax, dword ptr fs:[00000030h]	0_2_6DFC46A7
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD2EA3 mov eax, dword ptr fs:[00000030h]	0_2_6DFD2EA3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DE9E mov eax, dword ptr fs:[00000030h]	0_2_6DF7DE9E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DE9E mov eax, dword ptr fs:[00000030h]	0_2_6DF7DE9E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DE9E mov eax, dword ptr fs:[00000030h]	0_2_6DF7DE9E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43E80 mov eax, dword ptr fs:[00000030h]	0_2_6DF43E80
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43E80 mov eax, dword ptr fs:[00000030h]	0_2_6DF43E80
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00B581 mov eax, dword ptr fs:[00000030h]	0_2_6E00B581
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00B581 mov eax, dword ptr fs:[00000030h]	0_2_6E00B581
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00B581 mov eax, dword ptr fs:[00000030h]	0_2_6E00B581
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00B581 mov eax, dword ptr fs:[00000030h]	0_2_6E00B581
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73E70 mov eax, dword ptr fs:[00000030h]	0_2_6DF73E70
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CE6C mov eax, dword ptr fs:[00000030h]	0_2_6DF7CE6C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7CE6C mov ecx, dword ptr fs:[00000030h]	0_2_6DF7CE6C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFCAE60 mov eax, dword ptr fs:[00000030h]	0_2_6DFCAE60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFCAE60 mov eax, dword ptr fs:[00000030h]	0_2_6DFCAE60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFCAE60 mov eax, dword ptr fs:[00000030h]	0_2_6DFCAE60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFCAE60 mov eax, dword ptr fs:[00000030h]	0_2_6DFCAE60
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD6652 mov eax, dword ptr fs:[00000030h]	0_2_6DFD6652
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFFE3F mov eax, dword ptr fs:[00000030h]	0_2_6DFFFE3F
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7C63D mov eax, dword ptr fs:[00000030h]	0_2_6DF7C63D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4A63B mov eax, dword ptr fs:[00000030h]	0_2_6DF4A63B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4A63B mov eax, dword ptr fs:[00000030h]	0_2_6DF4A63B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF80E21 mov eax, dword ptr fs:[00000030h]	0_2_6DF80E21
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC5623 mov eax, dword ptr fs:[00000030h]	0_2_6DFC5623
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD2E14 mov eax, dword ptr fs:[00000030h]	0_2_6DFD2E14
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4C600 mov eax, dword ptr fs:[00000030h]	0_2_6DF4C600
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4C600 mov eax, dword ptr fs:[00000030h]	0_2_6DF4C600
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4C600 mov eax, dword ptr fs:[00000030h]	0_2_6DF4C600
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF431E0 mov eax, dword ptr fs:[00000030h]	0_2_6DF431E0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD41E8 mov eax, dword ptr fs:[00000030h]	0_2_6DFD41E8
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B1E1 mov eax, dword ptr fs:[00000030h]	0_2_6DF4B1E1
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B1E1 mov eax, dword ptr fs:[00000030h]	0_2_6DF4B1E1
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B1E1 mov eax, dword ptr fs:[00000030h]	0_2_6DF4B1E1
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC51BE mov eax, dword ptr fs:[00000030h]	0_2_6DFC51BE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC51BE mov eax, dword ptr fs:[00000030h]	0_2_6DFC51BE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC51BE mov eax, dword ptr fs:[00000030h]	0_2_6DFC51BE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC51BE mov eax, dword ptr fs:[00000030h]	0_2_6DFC51BE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7C9BF mov eax, dword ptr fs:[00000030h]	0_2_6DF7C9BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7C9BF mov eax, dword ptr fs:[00000030h]	0_2_6DF7C9BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov eax, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov eax, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov eax, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF699BF mov eax, dword ptr fs:[00000030h]	0_2_6DF699BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF761A0 mov eax, dword ptr fs:[00000030h]	0_2_6DF761A0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF761A0 mov eax, dword ptr fs:[00000030h]	0_2_6DF761A0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018A62 mov eax, dword ptr fs:[00000030h]	0_2_6E018A62
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74190 mov eax, dword ptr fs:[00000030h]	0_2_6DF74190
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF72990 mov eax, dword ptr fs:[00000030h]	0_2_6DF72990
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4519E mov eax, dword ptr fs:[00000030h]	0_2_6DF4519E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4519E mov ecx, dword ptr fs:[00000030h]	0_2_6DF4519E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7A185 mov eax, dword ptr fs:[00000030h]	0_2_6DF7A185
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6C182 mov eax, dword ptr fs:[00000030h]	0_2_6DF6C182
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B171 mov eax, dword ptr fs:[00000030h]	0_2_6DF4B171
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4B171 mov eax, dword ptr fs:[00000030h]	0_2_6DF4B171
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4395E mov eax, dword ptr fs:[00000030h]	0_2_6DF4395E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4395E mov eax, dword ptr fs:[00000030h]	0_2_6DF4395E
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6B944 mov eax, dword ptr fs:[00000030h]	0_2_6DF6B944
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6B944 mov eax, dword ptr fs:[00000030h]	0_2_6DF6B944
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43138 mov ecx, dword ptr fs:[00000030h]	0_2_6DF43138
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7513A mov eax, dword ptr fs:[00000030h]	0_2_6DF7513A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7513A mov eax, dword ptr fs:[00000030h]	0_2_6DF7513A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018ADD mov eax, dword ptr fs:[00000030h]	0_2_6E018ADD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E004AEF mov eax, dword ptr fs:[00000030h]	0_2_6E004AEF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49100 mov eax, dword ptr fs:[00000030h]	0_2_6DF49100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49100 mov eax, dword ptr fs:[00000030h]	0_2_6DF49100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49100 mov eax, dword ptr fs:[00000030h]	0_2_6DF49100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF50100 mov eax, dword ptr fs:[00000030h]	0_2_6DF50100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF50100 mov eax, dword ptr fs:[00000030h]	0_2_6DF50100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF50100 mov eax, dword ptr fs:[00000030h]	0_2_6DF50100
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528FD mov eax, dword ptr fs:[00000030h]	0_2_6DF528FD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528FD mov eax, dword ptr fs:[00000030h]	0_2_6DF528FD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528FD mov eax, dword ptr fs:[00000030h]	0_2_6DF528FD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6B8E4 mov eax, dword ptr fs:[00000030h]	0_2_6DF6B8E4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6B8E4 mov eax, dword ptr fs:[00000030h]	0_2_6DF6B8E4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF440E1 mov eax, dword ptr fs:[00000030h]	0_2_6DF440E1
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF440E1 mov eax, dword ptr fs:[00000030h]	0_2_6DF440E1
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF440E1 mov eax, dword ptr fs:[00000030h]	0_2_6DF440E1
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF458EC mov eax, dword ptr fs:[00000030h]	0_2_6DF458EC
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00131B mov eax, dword ptr fs:[00000030h]	0_2_6E00131B
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF470C0 mov eax, dword ptr fs:[00000030h]	0_2_6DF470C0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF470C0 mov eax, dword ptr fs:[00000030h]	0_2_6DF470C0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7F0BF mov ecx, dword ptr fs:[00000030h]	0_2_6DF7F0BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7F0BF mov eax, dword ptr fs:[00000030h]	0_2_6DF7F0BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7F0BF mov eax, dword ptr fs:[00000030h]	0_2_6DF7F0BF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF890AF mov eax, dword ptr fs:[00000030h]	0_2_6DF890AF
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018B58 mov eax, dword ptr fs:[00000030h]	0_2_6E018B58
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528AE mov eax, dword ptr fs:[00000030h]	0_2_6DF528AE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528AE mov eax, dword ptr fs:[00000030h]	0_2_6DF528AE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528AE mov eax, dword ptr fs:[00000030h]	0_2_6DF528AE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528AE mov ecx, dword ptr fs:[00000030h]	0_2_6DF528AE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528AE mov eax, dword ptr fs:[00000030h]	0_2_6DF528AE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF528AE mov eax, dword ptr fs:[00000030h]	0_2_6DF528AE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43880 mov eax, dword ptr fs:[00000030h]	0_2_6DF43880
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43880 mov eax, dword ptr fs:[00000030h]	0_2_6DF43880
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00138A mov eax, dword ptr fs:[00000030h]	0_2_6E00138A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6F86D mov eax, dword ptr fs:[00000030h]	0_2_6DF6F86D
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF47055 mov eax, dword ptr fs:[00000030h]	0_2_6DF47055
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45050 mov eax, dword ptr fs:[00000030h]	0_2_6DF45050
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45050 mov eax, dword ptr fs:[00000030h]	0_2_6DF45050
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45050 mov eax, dword ptr fs:[00000030h]	0_2_6DF45050
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E001BA8 mov eax, dword ptr fs:[00000030h]	0_2_6E001BA8
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018BB6 mov eax, dword ptr fs:[00000030h]	0_2_6E018BB6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E019BBE mov eax, dword ptr fs:[00000030h]	0_2_6E019BBE
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A830 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A830
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A830 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A830
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A830 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A830
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A830 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A830
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74020 mov edi, dword ptr fs:[00000030h]	0_2_6DF74020
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4F018 mov eax, dword ptr fs:[00000030h]	0_2_6DF4F018
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4F018 mov eax, dword ptr fs:[00000030h]	0_2_6DF4F018
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46800 mov eax, dword ptr fs:[00000030h]	0_2_6DF46800
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46800 mov eax, dword ptr fs:[00000030h]	0_2_6DF46800
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF46800 mov eax, dword ptr fs:[00000030h]	0_2_6DF46800
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF58800 mov eax, dword ptr fs:[00000030h]	0_2_6DF58800
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF423F6 mov eax, dword ptr fs:[00000030h]	0_2_6DF423F6
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E014015 mov eax, dword ptr fs:[00000030h]	0_2_6E014015
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E014015 mov eax, dword ptr fs:[00000030h]	0_2_6E014015
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01F019 mov eax, dword ptr fs:[00000030h]	0_2_6E01F019
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01F019 mov eax, dword ptr fs:[00000030h]	0_2_6E01F019
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF23E3 mov ecx, dword ptr fs:[00000030h]	0_2_6DFF23E3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF23E3 mov ecx, dword ptr fs:[00000030h]	0_2_6DFF23E3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFF23E3 mov eax, dword ptr fs:[00000030h]	0_2_6DFF23E3
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF41BE9 mov eax, dword ptr fs:[00000030h]	0_2_6DF41BE9
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6DBE9 mov eax, dword ptr fs:[00000030h]	0_2_6DF6DBE9
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC53CA mov eax, dword ptr fs:[00000030h]	0_2_6DFC53CA
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFC53CA mov eax, dword ptr fs:[00000030h]	0_2_6DFC53CA
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74BAD mov eax, dword ptr fs:[00000030h]	0_2_6DF74BAD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74BAD mov eax, dword ptr fs:[00000030h]	0_2_6DF74BAD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF74BAD mov eax, dword ptr fs:[00000030h]	0_2_6DF74BAD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44B94 mov edi, dword ptr fs:[00000030h]	0_2_6DF44B94
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E002073 mov eax, dword ptr fs:[00000030h]	0_2_6E002073
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFEEB8A mov ecx, dword ptr fs:[00000030h]	0_2_6DFEEB8A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFEEB8A mov eax, dword ptr fs:[00000030h]	0_2_6DFEEB8A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFEEB8A mov eax, dword ptr fs:[00000030h]	0_2_6DFEEB8A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFEEB8A mov eax, dword ptr fs:[00000030h]	0_2_6DFEEB8A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E011074 mov eax, dword ptr fs:[00000030h]	0_2_6E011074
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73B7A mov eax, dword ptr fs:[00000030h]	0_2_6DF73B7A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73B7A mov eax, dword ptr fs:[00000030h]	0_2_6DF73B7A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD6365 mov eax, dword ptr fs:[00000030h]	0_2_6DFD6365
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD6365 mov eax, dword ptr fs:[00000030h]	0_2_6DFD6365
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD6365 mov eax, dword ptr fs:[00000030h]	0_2_6DFD6365
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73B5A mov eax, dword ptr fs:[00000030h]	0_2_6DF73B5A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73B5A mov eax, dword ptr fs:[00000030h]	0_2_6DF73B5A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73B5A mov eax, dword ptr fs:[00000030h]	0_2_6DF73B5A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF73B5A mov eax, dword ptr fs:[00000030h]	0_2_6DF73B5A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF4F340 mov eax, dword ptr fs:[00000030h]	0_2_6DF4F340
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD4320 mov eax, dword ptr fs:[00000030h]	0_2_6DFD4320
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A309 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A309
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF72AE4 mov eax, dword ptr fs:[00000030h]	0_2_6DF72AE4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45AC0 mov eax, dword ptr fs:[00000030h]	0_2_6DF45AC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45AC0 mov eax, dword ptr fs:[00000030h]	0_2_6DF45AC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45AC0 mov eax, dword ptr fs:[00000030h]	0_2_6DF45AC0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF72ACB mov eax, dword ptr fs:[00000030h]	0_2_6DF72ACB
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF43ACA mov eax, dword ptr fs:[00000030h]	0_2_6DF43ACA
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5AAB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF5AAB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF5AAB0 mov eax, dword ptr fs:[00000030h]	0_2_6DF5AAB0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF712BD mov esi, dword ptr fs:[00000030h]	0_2_6DF712BD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF712BD mov eax, dword ptr fs:[00000030h]	0_2_6DF712BD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF712BD mov eax, dword ptr fs:[00000030h]	0_2_6DF712BD
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF41AA0 mov eax, dword ptr fs:[00000030h]	0_2_6DF41AA0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF75AA0 mov eax, dword ptr fs:[00000030h]	0_2_6DF75AA0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF75AA0 mov eax, dword ptr fs:[00000030h]	0_2_6DF75AA0
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00E962 mov eax, dword ptr fs:[00000030h]	0_2_6E00E962
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7D294 mov eax, dword ptr fs:[00000030h]	0_2_6DF7D294
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7D294 mov eax, dword ptr fs:[00000030h]	0_2_6DF7D294
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E018966 mov eax, dword ptr fs:[00000030h]	0_2_6E018966
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DA88 mov eax, dword ptr fs:[00000030h]	0_2_6DF7DA88
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF7DA88 mov eax, dword ptr fs:[00000030h]	0_2_6DF7DA88
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF8927A mov eax, dword ptr fs:[00000030h]	0_2_6DF8927A
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00A189 mov eax, dword ptr fs:[00000030h]	0_2_6E00A189
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E00A189 mov ecx, dword ptr fs:[00000030h]	0_2_6E00A189
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFB260 mov eax, dword ptr fs:[00000030h]	0_2_6DFFB260
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFFB260 mov eax, dword ptr fs:[00000030h]	0_2_6DFFB260
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0049A4 mov eax, dword ptr fs:[00000030h]	0_2_6E0049A4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0049A4 mov eax, dword ptr fs:[00000030h]	0_2_6E0049A4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0049A4 mov eax, dword ptr fs:[00000030h]	0_2_6E0049A4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0049A4 mov eax, dword ptr fs:[00000030h]	0_2_6E0049A4
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD4257 mov eax, dword ptr fs:[00000030h]	0_2_6DFD4257
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42240 mov ecx, dword ptr fs:[00000030h]	0_2_6DF42240
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF42240 mov eax, dword ptr fs:[00000030h]	0_2_6DF42240
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49240 mov eax, dword ptr fs:[00000030h]	0_2_6DF49240
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49240 mov eax, dword ptr fs:[00000030h]	0_2_6DF49240
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49240 mov eax, dword ptr fs:[00000030h]	0_2_6DF49240
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF49240 mov eax, dword ptr fs:[00000030h]	0_2_6DF49240
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01F1B5 mov eax, dword ptr fs:[00000030h]	0_2_6E01F1B5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E01F1B5 mov eax, dword ptr fs:[00000030h]	0_2_6E01F1B5
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFD4248 mov eax, dword ptr fs:[00000030h]	0_2_6DFD4248
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF48239 mov eax, dword ptr fs:[00000030h]	0_2_6DF48239
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF48239 mov eax, dword ptr fs:[00000030h]	0_2_6DF48239
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF48239 mov eax, dword ptr fs:[00000030h]	0_2_6DF48239
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44A20 mov eax, dword ptr fs:[00000030h]	0_2_6DF44A20
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF44A20 mov eax, dword ptr fs:[00000030h]	0_2_6DF44A20
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DFCEA20 mov eax, dword ptr fs:[00000030h]	0_2_6DFCEA20
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF6A229 mov eax, dword ptr fs:[00000030h]	0_2_6DF6A229
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45210 mov eax, dword ptr fs:[00000030h]	0_2_6DF45210
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45210 mov ecx, dword ptr fs:[00000030h]	0_2_6DF45210
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45210 mov eax, dword ptr fs:[00000030h]	0_2_6DF45210
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF45210 mov eax, dword ptr fs:[00000030h]	0_2_6DF45210
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6E0189E7 mov eax, dword ptr fs:[00000030h]	0_2_6E0189E7
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF63A1C mov eax, dword ptr fs:[00000030h]	0_2_6DF63A1C
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Code function: 0_2_6DF58A0A mov eax, dword ptr fs:[00000030h]	0_2_6DF58A0A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00C600 mov eax, dword ptr fs:[00000030h]	17_2_6E00C600
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00C600 mov eax, dword ptr fs:[00000030h]	17_2_6E00C600
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00C600 mov eax, dword ptr fs:[00000030h]	17_2_6E00C600
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E092E14 mov eax, dword ptr fs:[00000030h]	17_2_6E092E14
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E040E21 mov eax, dword ptr fs:[00000030h]	17_2_6E040E21
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E085623 mov eax, dword ptr fs:[00000030h]	17_2_6E085623
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0BFE3F mov eax, dword ptr fs:[00000030h]	17_2_6E0BFE3F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00A63B mov eax, dword ptr fs:[00000030h]	17_2_6E00A63B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00A63B mov eax, dword ptr fs:[00000030h]	17_2_6E00A63B
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E096652 mov eax, dword ptr fs:[00000030h]	17_2_6E096652
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E033E70 mov eax, dword ptr fs:[00000030h]	17_2_6E033E70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E003E80 mov eax, dword ptr fs:[00000030h]	17_2_6E003E80
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E003E80 mov eax, dword ptr fs:[00000030h]	17_2_6E003E80
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03DE9E mov eax, dword ptr fs:[00000030h]	17_2_6E03DE9E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03DE9E mov eax, dword ptr fs:[00000030h]	17_2_6E03DE9E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03DE9E mov eax, dword ptr fs:[00000030h]	17_2_6E03DE9E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E092EA3 mov eax, dword ptr fs:[00000030h]	17_2_6E092EA3
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0846A7 mov eax, dword ptr fs:[00000030h]	17_2_6E0846A7
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0336CC mov eax, dword ptr fs:[00000030h]	17_2_6E0336CC
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8ED6 mov eax, dword ptr fs:[00000030h]	17_2_6E0D8ED6
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E043EE4 mov eax, dword ptr fs:[00000030h]	17_2_6E043EE4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E043EE4 mov eax, dword ptr fs:[00000030h]	17_2_6E043EE4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E043EE4 mov eax, dword ptr fs:[00000030h]	17_2_6E043EE4
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0316E0 mov ecx, dword ptr fs:[00000030h]	17_2_6E0316E0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E034710 mov eax, dword ptr fs:[00000030h]	17_2_6E034710
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02F716 mov eax, dword ptr fs:[00000030h]	17_2_6E02F716
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E09FF10 mov eax, dword ptr fs:[00000030h]	17_2_6E09FF10
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E09FF10 mov eax, dword ptr fs:[00000030h]	17_2_6E09FF10
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E004F2E mov eax, dword ptr fs:[00000030h]	17_2_6E004F2E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E004F2E mov eax, dword ptr fs:[00000030h]	17_2_6E004F2E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E006730 mov eax, dword ptr fs:[00000030h]	17_2_6E006730
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E006730 mov eax, dword ptr fs:[00000030h]	17_2_6E006730
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E006730 mov eax, dword ptr fs:[00000030h]	17_2_6E006730
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03E730 mov eax, dword ptr fs:[00000030h]	17_2_6E03E730
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02B73D mov eax, dword ptr fs:[00000030h]	17_2_6E02B73D
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02B73D mov eax, dword ptr fs:[00000030h]	17_2_6E02B73D
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E00A745 mov eax, dword ptr fs:[00000030h]	17_2_6E00A745
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E03DF4C mov eax, dword ptr fs:[00000030h]	17_2_6E03DF4C
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E095F5F mov eax, dword ptr fs:[00000030h]	17_2_6E095F5F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E095F5F mov eax, dword ptr fs:[00000030h]	17_2_6E095F5F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E095F5F mov eax, dword ptr fs:[00000030h]	17_2_6E095F5F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E095F5F mov eax, dword ptr fs:[00000030h]	17_2_6E095F5F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E095F5F mov eax, dword ptr fs:[00000030h]	17_2_6E095F5F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E006F60 mov eax, dword ptr fs:[00000030h]	17_2_6E006F60
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E006F60 mov eax, dword ptr fs:[00000030h]	17_2_6E006F60
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02E760 mov eax, dword ptr fs:[00000030h]	17_2_6E02E760
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E02E760 mov eax, dword ptr fs:[00000030h]	17_2_6E02E760
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0D8F6A mov eax, dword ptr fs:[00000030h]	17_2_6E0D8F6A
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E032F70 mov eax, dword ptr fs:[00000030h]	17_2_6E032F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E032F70 mov eax, dword ptr fs:[00000030h]	17_2_6E032F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E032F70 mov eax, dword ptr fs:[00000030h]	17_2_6E032F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E032F70 mov eax, dword ptr fs:[00000030h]	17_2_6E032F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E032F70 mov eax, dword ptr fs:[00000030h]	17_2_6E032F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E032F70 mov eax, dword ptr fs:[00000030h]	17_2_6E032F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E032F70 mov eax, dword ptr fs:[00000030h]	17_2_6E032F70
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov ecx, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E002FB0 mov eax, dword ptr fs:[00000030h]	17_2_6E002FB0
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E003FC5 mov eax, dword ptr fs:[00000030h]	17_2_6E003FC5
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E003FC5 mov eax, dword ptr fs:[00000030h]	17_2_6E003FC5
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E003FC5 mov eax, dword ptr fs:[00000030h]	17_2_6E003FC5
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0337EB mov eax, dword ptr fs:[00000030h]	17_2_6E0337EB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0337EB mov eax, dword ptr fs:[00000030h]	17_2_6E0337EB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0337EB mov eax, dword ptr fs:[00000030h]	17_2_6E0337EB
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_6E0337EB mov eax, dword ptr fs:[00000030h]	17_2_6E0337EB

Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 17_2_0040B52E _raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,		17_2_0040B52E
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: 26_2_0040B52E _raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,		26_2_0040B52E

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: eurbbce.3.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: baksproperty.gov.ug
Source: C:\Windows\explorer.exe	Domain query: smbproperty.ru
Source: C:\Windows\explorer.exe	Domain query: magistralpsw.ru
Source: C:\Windows\explorer.exe	Domain query: gmbshop.ru
Source: C:\Windows\explorer.exe	Domain query: mpmanagertzz.ru
Source: C:\Windows\explorer.exe	Network Connect: 93.170.123.43 187	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: memoloves.ru
Source: C:\Windows\explorer.exe	Domain query: alfavanilin.ru
Source: C:\Windows\explorer.exe	Domain query: powerglasspot.ru
Source: C:\Windows\explorer.exe	Domain query: autopartswarehouses.ru

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Thread created: C:\Windows\explorer.exe EIP: 30C1AB8			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Thread created: unknown EIP: 5DB1AB8			Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eurbbce	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

Code function: 0_2_6DF7E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,

0_2_6DF7E730

Source: explorer.exe, 00000003.00000000.260531067.0000000005EA0000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.249258083.0000000001640000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.249258083.0000000001640000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000003.00000000.249088962.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000003.00000000.249258083.0000000001640000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000003.00000000.249258083.0000000001640000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: GetLocaleInfoA,		17_2_0040D89F
Source: C:\Users\user\AppData\Roaming\eurbbce	Code function: GetLocaleInfoA,		26_2_0040D89F

Source: C:\Users\user\AppData\Roaming\eurbbce

Code function: 17_2_0040E600 lstrlen,GetTitleBarInfo,SetLastError,GetFileAttributesA,GetNumberOfConsoleMouseButtons,DisconnectNamedPipe,SetLocalTime,GetLastError,SetLocalTime,GetCommandLineW,TerminateProcess,LocalAlloc,GetSystemTime,DeleteVolumeMountPointA,SetThreadContext,OpenMutexW,WriteConsoleInputW,SystemTimeToTzSpecificLocalTime,GetTimeZoneInformation,MoveFileW,

17_2_0040E600

Source: C:\Users\user\AppData\Roaming\eurbbce

17_2_0040E600

Source: C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe

Code function: 0_2_6DF465A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,

0_2_6DF465A0

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.495234089.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.235077807.0000000000620000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.484031694.0000000001F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.330508330.00000000005B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.eurbbce.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.eurbbce.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.eurbbce.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.eurbbce.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.eurbbce.5b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.eurbbce.1f90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.http___citycapproperty.ru_localmod_nmode.exe.620000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.495234089.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.235077807.0000000000620000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.484031694.0000000001F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.330508330.00000000005B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.eurbbce.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.eurbbce.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.eurbbce.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.eurbbce.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.eurbbce.5b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.eurbbce.1f90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.http___citycapproperty.ru_localmod_nmode.exe.620000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution1	DLL Side-Loading1	Process Injection32	Masquerading11	Input Capture1	System Time Discovery2	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Virtualization/Sandbox Evasion1	LSASS Memory	Security Software Discovery311	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection32	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol114	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	System Information Discovery14	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing11	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	DLL Side-Loading1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	File Deletion1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http___citycapproperty.ru_localmod_nmode.exe	32%	Virustotal		Browse
http___citycapproperty.ru_localmod_nmode.exe	28%	ReversingLabs	Win32.Trojan.Pwsx
http___citycapproperty.ru_localmod_nmode.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\eurbbce	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9419.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\9419.tmp	2%	ReversingLabs
C:\Users\user\AppData\Roaming\eurbbce	28%	ReversingLabs	Win32.Trojan.Pwsx

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.http___citycapproperty.ru_localmod_nmode.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.eurbbce.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.3.eurbbce.5b0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.eurbbce.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.http___citycapproperty.ru_localmod_nmode.exe.620000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.3.eurbbce.1f90000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
alfavanilin.ru	8%	Virustotal	Browse
smbproperty.ru	11%	Virustotal	Browse
magistralpsw.ru	8%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://mpmanagertzz.ru/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://autopartswarehouses.ru/	0%	Avira URL Cloud	safe
http://magistralpsw.ru/	0%	Avira URL Cloud	safe
http://baksproperty.gov.ug/	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://alfavanilin.ru/	0%	Avira URL Cloud	safe
http://powerglasspot.ru/	0%	Avira URL Cloud	safe
http://gmbshop.ru/	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://memoloves.ru/	0%	Avira URL Cloud	safe
http://smbproperty.ru/	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
alfavanilin.ru	185.14.31.88	true	true	8%, Virustotal, Browse	unknown
smbproperty.ru	164.90.175.106	true	true	11%, Virustotal, Browse	unknown
magistralpsw.ru	185.14.31.88	true	true	8%, Virustotal, Browse	unknown
gmbshop.ru	93.170.123.43	true	true		unknown
powerglasspot.ru	185.14.31.88	true	true		unknown
memoloves.ru	185.14.31.88	true	true		unknown
autopartswarehouses.ru	185.14.31.88	true	true		unknown
baksproperty.gov.ug	unknown	unknown	true		unknown
mpmanagertzz.ru	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mpmanagertzz.ru/	true	Avira URL Cloud: safe	unknown
http://autopartswarehouses.ru/	true	Avira URL Cloud: safe	unknown
http://magistralpsw.ru/	true	Avira URL Cloud: safe	unknown
http://baksproperty.gov.ug/	true	Avira URL Cloud: safe	unknown
http://alfavanilin.ru/	true	Avira URL Cloud: safe	unknown
http://powerglasspot.ru/	true	Avira URL Cloud: safe	unknown
http://gmbshop.ru/	true	Avira URL Cloud: safe	unknown
http://memoloves.ru/	true	Avira URL Cloud: safe	unknown
http://smbproperty.ru/	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.fonts.com	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	explorer.exe, 00000003.00000000.266147257.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
164.90.175.106	smbproperty.ru	United States	14061	DIGITALOCEAN-ASNUS	true
93.170.123.43	gmbshop.ru	Czech Republic	35196	IHOR-ASRU	true
185.14.31.88	alfavanilin.ru	Ukraine	21100	ITLDC-NLUA	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	399051
Start date:	28.04.2021
Start time:	10:57:19
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	http___citycapproperty.ru_localmod_nmode.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/5@12/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 34.2% (good quality ratio 31.4%) Quality average: 60.3% Quality standard deviation: 31%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Excluded IPs from analysis (whitelisted): 52.147.198.201, 131.253.33.200, 13.107.22.200, 20.50.102.62, 168.61.161.212, 92.122.145.220, 13.88.21.125, 23.57.80.111, 20.82.210.154, 2.20.142.209, 2.20.142.210, 92.122.213.194, 92.122.213.247, 20.54.26.129, 20.82.209.183 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
10:58:50	Task Scheduler	Run new task: Firefox Default Browser Agent C4CADB8D721CD512 path: C:\Users\user\AppData\Roaming\eurbbce

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
93.170.123.43	uj8hhw1wbQ.exe	Get hash	malicious	Browse	gmbshop.ru/
	6RKvv5j6e0.exe	Get hash	malicious	Browse	gmbshop.ru/
	L7kat4oNSP.exe	Get hash	malicious	Browse	gmbshop.ru/
	ij3RRhnxwl.exe	Get hash	malicious	Browse	gmbshop.ru/
	ie6BqkZVg8.exe	Get hash	malicious	Browse	gmbshop.ru/
	meBctzDFj3.exe	Get hash	malicious	Browse	gmbshop.ru/
	pax. #U2116 0018260-KOEK.js	Get hash	malicious	Browse	gmbshop.ru/
	CY5uMiTKRW.exe	Get hash	malicious	Browse	gmbshop.ru/
	37Lr8nr9qj.exe	Get hash	malicious	Browse	gmbshop.ru/
	prNDh0NRqL.exe	Get hash	malicious	Browse	gmbshop.ru/
	0rKEnq2IqY.exe	Get hash	malicious	Browse	gmbshop.ru/
	qiDYQb15w5.exe	Get hash	malicious	Browse	gmbshop.ru/
	cLMBOaIYSO.exe	Get hash	malicious	Browse	gmbshop.ru/
	bEuBS6SwMo.exe	Get hash	malicious	Browse	gmbshop.ru/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
smbproperty.ru	uj8hhw1wbQ.exe	Get hash	malicious	Browse	34.94.43.14
	6RKvv5j6e0.exe	Get hash	malicious	Browse	34.125.27.41
	L7kat4oNSP.exe	Get hash	malicious	Browse	34.125.27.41
	ij3RRhnxwl.exe	Get hash	malicious	Browse	34.125.27.41
	ie6BqkZVg8.exe	Get hash	malicious	Browse	34.89.89.74
	meBctzDFj3.exe	Get hash	malicious	Browse	34.78.249.42
	pax. #U2116 0018260-KOEK.js	Get hash	malicious	Browse	35.189.92.89
	CY5uMiTKRW.exe	Get hash	malicious	Browse	35.189.92.89
	37Lr8nr9qj.exe	Get hash	malicious	Browse	35.189.92.89
	prNDh0NRqL.exe	Get hash	malicious	Browse	35.228.15.217
	0rKEnq2IqY.exe	Get hash	malicious	Browse	35.228.15.217
	qiDYQb15w5.exe	Get hash	malicious	Browse	35.228.15.217
	cLMBOaIYSO.exe	Get hash	malicious	Browse	35.228.43.35
	bEuBS6SwMo.exe	Get hash	malicious	Browse	35.228.108.144
	eEXZHxdxFE.exe	Get hash	malicious	Browse	35.228.108.144
	ltf94qhZ37.exe	Get hash	malicious	Browse	35.228.108.144
	.01.2021a.js	Get hash	malicious	Browse	35.228.108.144
	DiPa4roAqT.exe	Get hash	malicious	Browse	34.91.161.169
	dif019MoIw.exe	Get hash	malicious	Browse	34.91.161.169
	4SwGfJZtk7.exe	Get hash	malicious	Browse	34.91.161.169
alfavanilin.ru	uj8hhw1wbQ.exe	Get hash	malicious	Browse	185.14.31.88
	6RKvv5j6e0.exe	Get hash	malicious	Browse	185.14.31.88
	L7kat4oNSP.exe	Get hash	malicious	Browse	185.14.31.88
	ij3RRhnxwl.exe	Get hash	malicious	Browse	185.14.31.88
	ie6BqkZVg8.exe	Get hash	malicious	Browse	185.14.31.88
	meBctzDFj3.exe	Get hash	malicious	Browse	185.14.31.88
	pax. #U2116 0018260-KOEK.js	Get hash	malicious	Browse	185.14.31.88
	CY5uMiTKRW.exe	Get hash	malicious	Browse	185.14.31.88
	37Lr8nr9qj.exe	Get hash	malicious	Browse	185.14.31.88
	prNDh0NRqL.exe	Get hash	malicious	Browse	185.14.31.88
	0rKEnq2IqY.exe	Get hash	malicious	Browse	185.14.31.88
	qiDYQb15w5.exe	Get hash	malicious	Browse	185.14.31.88
	cLMBOaIYSO.exe	Get hash	malicious	Browse	185.14.31.88
	bEuBS6SwMo.exe	Get hash	malicious	Browse	185.14.31.88
	eEXZHxdxFE.exe	Get hash	malicious	Browse	185.14.31.88
	ltf94qhZ37.exe	Get hash	malicious	Browse	185.14.31.88
	.01.2021a.js	Get hash	malicious	Browse	185.14.31.88
	DiPa4roAqT.exe	Get hash	malicious	Browse	185.14.31.88
	dif019MoIw.exe	Get hash	malicious	Browse	185.14.31.88
	4SwGfJZtk7.exe	Get hash	malicious	Browse	185.14.31.88

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
IHOR-ASRU	v65rkUrgYo.exe	Get hash	malicious	Browse	185.117.155.20
	SecuriteInfo.com.Trojan.InjectNET.14.13971.exe	Get hash	malicious	Browse	185.117.155.20
	y1e1FV1UWs.exe	Get hash	malicious	Browse	185.117.155.20
	aa6281eb-a31c-4e8b-a2c6-c5c03fdcbe57.exe	Get hash	malicious	Browse	193.124.191.243
	uj8hhw1wbQ.exe	Get hash	malicious	Browse	93.170.123.43
	Overdue-486523561-04212021.xlsm	Get hash	malicious	Browse	194.67.214.216
	Overdue-894289303-04212021.xlsm	Get hash	malicious	Browse	194.67.214.216
	Overdue-486523561-04212021.xlsm	Get hash	malicious	Browse	194.67.214.216
	Overdue-894289303-04212021.xlsm	Get hash	malicious	Browse	194.67.214.216
	Overdue-486523561-04212021.xlsm	Get hash	malicious	Browse	194.67.214.216
	Overdue-894289303-04212021.xlsm	Get hash	malicious	Browse	194.67.214.216
	1nEaZvYoKF.exe	Get hash	malicious	Browse	31.148.99.134
	6RKvv5j6e0.exe	Get hash	malicious	Browse	93.170.123.43
	L7kat4oNSP.exe	Get hash	malicious	Browse	93.170.123.43
	ij3RRhnxwl.exe	Get hash	malicious	Browse	93.170.123.43
	iIEubyMSNa.exe	Get hash	malicious	Browse	185.125.218.59
	SecuriteInfo.com.Trojan.InjectNET.14.5311.exe	Get hash	malicious	Browse	185.125.218.59
	SecuriteInfo.com.W32.AIDetect.malware1.11439.exe	Get hash	malicious	Browse	185.125.218.59
	xaX6mmXI4G.exe	Get hash	malicious	Browse	185.87.48.130
	SecuriteInfo.com.Trojan.InjectNET.14.12246.exe	Get hash	malicious	Browse	185.125.218.59
DIGITALOCEAN-ASNUS	7c9a9bc5_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	7c9a9bc5_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	e6483e59_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	e6483e59_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	WA41.vbs	Get hash	malicious	Browse	167.99.192.252
	31177c56_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	31177c56_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	7d06fd8d_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	7d06fd8d_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	95869f1e_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	5a0441e3_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	95869f1e_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	5a0441e3_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	5c0f0c5c_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	5c0f0c5c_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	307fb780_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	307fb780_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	9ad2cc59_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	9ad2cc59_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122
	b2e76dd2_by_Libranalysis.dll	Get hash	malicious	Browse	159.203.93.122

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	6243cdca_by_Libranalysis.exe	Get hash	malicious	Browse	93.170.123.43
	ee49601b_by_Libranalysis.xlsm	Get hash	malicious	Browse	93.170.123.43
	0FCtQ9I6ih.exe	Get hash	malicious	Browse	93.170.123.43
	invoice_APR20210425.js	Get hash	malicious	Browse	93.170.123.43
	echo-e374e5.exe	Get hash	malicious	Browse	93.170.123.43
	NH6YRs88U4.exe	Get hash	malicious	Browse	93.170.123.43
	NH6YRs88U4.exe	Get hash	malicious	Browse	93.170.123.43
	invoice_APR20210425.js	Get hash	malicious	Browse	93.170.123.43
	Staples.com Order #631176.xlsm	Get hash	malicious	Browse	93.170.123.43
	7SlKt2Puui.exe	Get hash	malicious	Browse	93.170.123.43
	ZTuZr7UXKB.dll	Get hash	malicious	Browse	93.170.123.43
	ZA4AjogHLo.exe	Get hash	malicious	Browse	93.170.123.43
	7iqFc3DymH.dll	Get hash	malicious	Browse	93.170.123.43
	V1NzYOO8DX.exe	Get hash	malicious	Browse	93.170.123.43
	LYyR4s55ga.dll	Get hash	malicious	Browse	93.170.123.43
	Ftbf1ZqULE.dll	Get hash	malicious	Browse	93.170.123.43
	XNXkvaIarc.dll	Get hash	malicious	Browse	93.170.123.43
	oMHveSc3hh.exe	Get hash	malicious	Browse	93.170.123.43
	0KuDEDABFO.exe	Get hash	malicious	Browse	93.170.123.43
	B9ECF028C9852A52CD1006E34AF3ACB7F5A6A486796AB.dll	Get hash	malicious	Browse	93.170.123.43

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\9419.tmp	9b3d7f02.exe	Get hash	malicious	Browse
	uj8hhw1wbQ.exe	Get hash	malicious	Browse
	6RKvv5j6e0.exe	Get hash	malicious	Browse
	L7kat4oNSP.exe	Get hash	malicious	Browse
	ij3RRhnxwl.exe	Get hash	malicious	Browse
	gSyJqxW85g.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Graftor.941749.26444.exe	Get hash	malicious	Browse
	jugOYmJLWt.exe	Get hash	malicious	Browse
	091WJ1BnKf.exe	Get hash	malicious	Browse
	ie6BqkZVg8.exe	Get hash	malicious	Browse
	czV5NxK0VI.exe	Get hash	malicious	Browse
	toolspab2.exe	Get hash	malicious	Browse
	index.exe	Get hash	malicious	Browse
	meBctzDFj3.exe	Get hash	malicious	Browse
	y06NARTaJm.exe	Get hash	malicious	Browse
	z2t2UjaWQ0.exe	Get hash	malicious	Browse
	30QD3GAnw7.exe	Get hash	malicious	Browse
	4QVwajpcdz.exe	Get hash	malicious	Browse
	8uADV5QTqx.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Mal.GandCrypt-A.26403.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\9419.tmp Download File
Process:	C:\Users\user\AppData\Roaming\eurbbce
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: 9b3d7f02.exe, Detection: malicious, Browse Filename: uj8hhw1wbQ.exe, Detection: malicious, Browse Filename: 6RKvv5j6e0.exe, Detection: malicious, Browse Filename: L7kat4oNSP.exe, Detection: malicious, Browse Filename: ij3RRhnxwl.exe, Detection: malicious, Browse Filename: gSyJqxW85g.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Graftor.941749.26444.exe, Detection: malicious, Browse Filename: jugOYmJLWt.exe, Detection: malicious, Browse Filename: 091WJ1BnKf.exe, Detection: malicious, Browse Filename: ie6BqkZVg8.exe, Detection: malicious, Browse Filename: czV5NxK0VI.exe, Detection: malicious, Browse Filename: toolspab2.exe, Detection: malicious, Browse Filename: index.exe, Detection: malicious, Browse Filename: meBctzDFj3.exe, Detection: malicious, Browse Filename: y06NARTaJm.exe, Detection: malicious, Browse Filename: z2t2UjaWQ0.exe, Detection: malicious, Browse Filename: 30QD3GAnw7.exe, Detection: malicious, Browse Filename: 4QVwajpcdz.exe, Detection: malicious, Browse Filename: 8uADV5QTqx.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Mal.GandCrypt-A.26403.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\eurbbce Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217600
Entropy (8bit):	6.35100589710372
Encrypted:	false
SSDEEP:	6144:RCRMLkxD0xHueydC5Z3eFJ0T9QBXPptOHpk:hgxD0BxVuaCVPLOHp
MD5:	C178795733E8A84F750AFF12E49CA3EF
SHA1:	AF9E5DE54778EF903C892F4D0F46E39B7B07C417
SHA-256:	D73E37B3ED710E4128E3C76E2F0FD61DBB2FDCDDFD8CFA51FFE244FA19433BB2
SHA-512:	394AD2545F72DF2CEBCB707CD94FA133464DD199AAD1E5F2C105629D3F40F4F92568353F4D7DED4D745A061E82EC9D9DC2E6B9B37ACE6A5E21395EE6EA315F34
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 28%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1h..1h..1h../:t.*h../:b.Nh../:e..h......6h..1h..h../:k.0h../:s.0h../:u.0h../:p.0h..Rich1h..........................PE..L......].................8..........C-.......P....@.................................3...............................P...e...,~..P.......H...........................0R...............................................P...............................text....6.......8.................. ..`.rdata...9...P...:...<..............@..@.data....~...........v..............@....rsrc...H............Z..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\eurbbce:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.35100589710372
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	http___citycapproperty.ru_localmod_nmode.exe
File size:	217600
MD5:	c178795733e8a84f750aff12e49ca3ef
SHA1:	af9e5de54778ef903c892f4d0f46e39b7b07c417
SHA256:	d73e37b3ed710e4128e3c76e2f0fd61dbb2fdcddfd8cfa51ffe244fa19433bb2
SHA512:	394ad2545f72df2cebcb707cd94fa133464dd199aad1e5f2c105629d3f40f4f92568353f4d7ded4d745a061e82ec9d9dc2e6b9b37ace6a5e21395ee6ea315f34
SSDEEP:	6144:RCRMLkxD0xHueydC5Z3eFJ0T9QBXPptOHpk:hgxD0BxVuaCVPLOHp
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1h..1h..1h../:t.*h../:b.Nh../:e..h......6h..1h...h../:k.0h../:s.0h../:u.0h../:p.0h..Rich1h..........................PE..L..

File Icon


Icon Hash:	a262ecd4bcecfc3c

Static PE Info

General
Entrypoint:	0x402d43
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5DC0A619 [Mon Nov 4 22:28:41 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9c151c4efeae0f5a50b4e9a01fbc3c13

Entrypoint Preview

Instruction
call 00007F7598DA20B8h
jmp 00007F7598D9C5DEh
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F7598D9C786h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F7598D9C7B0h
test ecx, 00000003h
jne 00007F7598D9C751h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F7598D9C74Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F7598D9C794h
test ah, ah
je 00007F7598D9C786h
test eax, 00FF0000h
je 00007F7598D9C775h
test eax, FF000000h
je 00007F7598D9C764h
jmp 00007F7598D9C72Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 004152DCh
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F7598D9C76Eh
test byte ptr [eax], 00000008h
je 00007F7598D9C769h
mov dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[EXP] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x18950	0x65	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17e2c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x91000	0xf748	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x15230	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15000	0x1e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13686	0x13800	False	0.563213641827	data	6.65846103631	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x15000	0x39b5	0x3a00	False	0.423693426724	data	5.61206136775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x77e88	0xe400	False	0.656130071272	data	6.13898401158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x91000	0xf748	0xf800	False	0.513089087702	data	5.31626423716	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
AFX_DIALOG_LAYOUT	0xa0390	0x2	data
CUZOPECADUDONAGUJOVENEKOCUZEVO	0x9e670	0x6c5	ASCII text, with very long lines, with no line terminators
DAKALAMOXITILAWOZEXUGELE	0x9ffb8	0x3d8	ASCII text, with very long lines, with no line terminators
FUCUTI	0x9ed38	0x127b	ASCII text, with very long lines, with no line terminators
RT_ICON	0x91600	0xea8	data
RT_ICON	0x924a8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0
RT_ICON	0x92d50	0x6c8	data
RT_ICON	0x93418	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x93980	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x95f28	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x96fd0	0x988	data
RT_ICON	0x97958	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x97e38	0xea8	data
RT_ICON	0x98ce0	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 5083694, next used block 13497278
RT_ICON	0x99588	0x6c8	data
RT_ICON	0x99c50	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x9a1b8	0x25a8	data
RT_ICON	0x9c760	0x10a8	data
RT_ICON	0x9d808	0x988	data
RT_ICON	0x9e190	0x468	GLS_BINARY_LSB_FIRST
RT_STRING	0xa04e0	0x266	data
RT_GROUP_ICON	0x97dc0	0x76	data
RT_GROUP_ICON	0x9e5f8	0x76	data
RT_VERSION	0xa0398	0x144	data

Imports

DLL	Import
KERNEL32.dll	WriteConsoleInputW, lstrlenA, SetLocalTime, BuildCommDCBAndTimeoutsA, FreeLibrary, CallNamedPipeA, LoadResource, SystemTimeToTzSpecificLocalTime, DeleteVolumeMountPointA, SetWaitableTimer, LoadLibraryExW, GetNumberOfConsoleMouseButtons, ZombifyActCtx, GlobalSize, HeapFree, GetProfileSectionA, SetConsoleScreenBufferSize, SetComputerNameW, GetProcessPriorityBoost, VirtualFree, WriteFile, EnumTimeFormatsW, SetProcessPriorityBoost, TlsSetValue, GetPriorityClass, GetVolumeInformationA, LoadLibraryW, SizeofResource, SetThreadContext, LeaveCriticalSection, GetFileAttributesA, SetConsoleMode, VerifyVersionInfoA, GetBinaryTypeA, SetSystemPowerState, TerminateProcess, GetTimeZoneInformation, DisconnectNamedPipe, RaiseException, DeactivateActCtx, CreateJobObjectA, OpenMutexW, GetHandleInformation, GetLastError, GetCurrentDirectoryW, SetLastError, CreateNamedPipeA, MoveFileW, LocalAlloc, SetCommMask, GetOEMCP, DebugBreakProcess, VirtualProtect, GetSystemTime, lstrcpyA, GetVersionExW, GetCommandLineW, DeleteFileA, HeapReAlloc, HeapAlloc, GetStartupInfoW, RtlUnwind, EnterCriticalSection, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, VirtualAlloc, GetModuleHandleW, Sleep, GetProcAddress, ExitProcess, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsGetValue, TlsAlloc, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, IsValidCodePage, MultiByteToWideChar, HeapSize, LoadLibraryA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, ReadFile, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetFilePointer, SetStdHandle, CreateFileA, GetModuleHandleA
USER32.dll	GetTitleBarInfo
ADVAPI32.dll	SetThreadToken

Exports

Name	Ordinal	Address
_reaper@8	1	0x40e1e0
_zdravstvuite@4	2	0x40e1d0

Version Infos

Description	Data
ProductVersus	1.8.37.29
FileVerus	1.0.52.18
Translations	0x0386 0x0186

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/28/21-10:58:51.229761	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49719	185.14.31.88	192.168.2.5
04/28/21-10:58:57.060259	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49720	185.14.31.88	192.168.2.5
04/28/21-10:58:57.281032	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.5	8.8.8.8
04/28/21-10:58:57.753221	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49721	185.14.31.88	192.168.2.5
04/28/21-10:58:58.295278	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.5	8.8.8.8
04/28/21-10:58:58.314036	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49723	185.14.31.88	192.168.2.5
04/28/21-10:58:58.937363	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49724	185.14.31.88	192.168.2.5
04/28/21-10:59:00.335191	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.5	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2021 10:58:49.684699059 CEST	49716	80	192.168.2.5	164.90.175.106
Apr 28, 2021 10:58:49.739275932 CEST	80	49716	164.90.175.106	192.168.2.5
Apr 28, 2021 10:58:49.739409924 CEST	49716	80	192.168.2.5	164.90.175.106
Apr 28, 2021 10:58:49.740444899 CEST	49716	80	192.168.2.5	164.90.175.106
Apr 28, 2021 10:58:49.740461111 CEST	49716	80	192.168.2.5	164.90.175.106
Apr 28, 2021 10:58:49.794311047 CEST	80	49716	164.90.175.106	192.168.2.5
Apr 28, 2021 10:58:49.888693094 CEST	80	49716	164.90.175.106	192.168.2.5
Apr 28, 2021 10:58:49.889360905 CEST	49716	80	192.168.2.5	164.90.175.106
Apr 28, 2021 10:58:49.889419079 CEST	49716	80	192.168.2.5	164.90.175.106
Apr 28, 2021 10:58:49.944915056 CEST	80	49716	164.90.175.106	192.168.2.5
Apr 28, 2021 10:58:50.053894997 CEST	49717	80	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.133770943 CEST	80	49717	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.133932114 CEST	49717	80	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.134016991 CEST	49717	80	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.134042025 CEST	49717	80	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.212529898 CEST	80	49717	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.212591887 CEST	80	49717	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.213646889 CEST	80	49717	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.216811895 CEST	49718	443	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.297090054 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.297210932 CEST	49718	443	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.298250914 CEST	49718	443	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.352952957 CEST	49717	80	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.377149105 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.377356052 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.377470016 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.377552986 CEST	49718	443	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.377620935 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.377677917 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.377756119 CEST	49718	443	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.379254103 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.409781933 CEST	49718	443	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.489378929 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.495793104 CEST	49718	443	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.574630976 CEST	443	49718	93.170.123.43	192.168.2.5
Apr 28, 2021 10:58:50.575654030 CEST	49718	443	192.168.2.5	93.170.123.43
Apr 28, 2021 10:58:50.742995024 CEST	49719	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:50.791959047 CEST	80	49719	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:50.792073011 CEST	49719	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:50.792165041 CEST	49719	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:50.792176962 CEST	49719	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:50.841135025 CEST	80	49719	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:50.841197014 CEST	80	49719	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:51.229760885 CEST	80	49719	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:51.229825020 CEST	80	49719	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:51.229948997 CEST	49719	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:51.229985952 CEST	49719	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:51.280057907 CEST	80	49719	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:56.513863087 CEST	49720	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:56.565582037 CEST	80	49720	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:56.565793037 CEST	49720	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:56.569153070 CEST	49720	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:56.569188118 CEST	49720	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:56.618141890 CEST	80	49720	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:56.618169069 CEST	80	49720	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.060259104 CEST	80	49720	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.060290098 CEST	80	49720	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.060420036 CEST	49720	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:57.060460091 CEST	49720	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:57.109337091 CEST	80	49720	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.192693949 CEST	49721	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:57.242892027 CEST	80	49721	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.243366003 CEST	49721	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:57.243453979 CEST	49721	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:57.243463993 CEST	49721	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:57.292243958 CEST	80	49721	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.292294979 CEST	80	49721	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.753221035 CEST	80	49721	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.753242970 CEST	80	49721	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.753362894 CEST	49721	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:57.753380060 CEST	49721	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:57.806677103 CEST	80	49721	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:57.955590010 CEST	49723	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.006033897 CEST	80	49723	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.006139040 CEST	49723	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.006251097 CEST	49723	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.006273031 CEST	49723	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.056824923 CEST	80	49723	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.056839943 CEST	80	49723	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.314035892 CEST	80	49723	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.314074993 CEST	80	49723	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.314188957 CEST	49723	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.314220905 CEST	49723	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.364653111 CEST	80	49723	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.474932909 CEST	49724	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.523879051 CEST	80	49724	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.524044037 CEST	49724	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.524086952 CEST	49724	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.527605057 CEST	49724	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.572886944 CEST	80	49724	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.576411009 CEST	80	49724	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.937362909 CEST	80	49724	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.937407017 CEST	80	49724	185.14.31.88	192.168.2.5
Apr 28, 2021 10:58:58.937494040 CEST	49724	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.937566042 CEST	49724	80	192.168.2.5	185.14.31.88
Apr 28, 2021 10:58:58.986355066 CEST	80	49724	185.14.31.88	192.168.2.5
Apr 28, 2021 10:59:50.182605028 CEST	80	49717	93.170.123.43	192.168.2.5
Apr 28, 2021 10:59:50.182904959 CEST	49717	80	192.168.2.5	93.170.123.43
Apr 28, 2021 10:59:50.182976961 CEST	49717	80	192.168.2.5	93.170.123.43
Apr 28, 2021 10:59:50.263008118 CEST	80	49717	93.170.123.43	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2021 10:58:02.495697021 CEST	65307	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:02.498023033 CEST	64344	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:02.546861887 CEST	53	64344	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:02.551415920 CEST	62060	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:02.552762985 CEST	53	65307	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:02.600065947 CEST	53	62060	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:03.304332018 CEST	61805	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:03.355885029 CEST	53	61805	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:04.103370905 CEST	54795	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:04.152193069 CEST	53	54795	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:04.897753000 CEST	49557	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:04.946423054 CEST	53	49557	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:05.678742886 CEST	61733	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:05.730372906 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:05.779541016 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:05.842763901 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:06.944997072 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:06.998600006 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:10.435481071 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:10.489109039 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:12.704998970 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:12.753822088 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:13.618185997 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:13.675198078 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:14.482952118 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:14.533149958 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:15.845990896 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:15.894649982 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:27.933722973 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:27.995882988 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:43.461569071 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:43.511900902 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:49.349518061 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:49.679915905 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:49.898272991 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:50.053113937 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:50.504014015 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:50.568041086 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:50.644890070 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:50.739583015 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:51.238593102 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:52.228193045 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:53.243866920 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:55.285300016 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:56.288965940 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:56.416729927 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:56.513053894 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:57.083112001 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:57.192102909 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:57.278234959 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:57.713417053 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:57.777930975 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:57.804225922 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:57.953320980 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:58.295144081 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:58.324678898 CEST	58530	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:58.474327087 CEST	53	58530	8.8.8.8	192.168.2.5
Apr 28, 2021 10:58:59.388731956 CEST	53813	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:58:59.445979118 CEST	53	53813	8.8.8.8	192.168.2.5
Apr 28, 2021 10:59:00.335083008 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 28, 2021 10:59:02.907799006 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:59:02.967302084 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 28, 2021 10:59:15.672127008 CEST	57344	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:59:15.741703987 CEST	53	57344	8.8.8.8	192.168.2.5
Apr 28, 2021 10:59:22.889039040 CEST	54450	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:59:22.947627068 CEST	53	54450	8.8.8.8	192.168.2.5
Apr 28, 2021 10:59:54.288360119 CEST	59261	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:59:54.341500998 CEST	53	59261	8.8.8.8	192.168.2.5
Apr 28, 2021 10:59:57.172517061 CEST	57151	53	192.168.2.5	8.8.8.8
Apr 28, 2021 10:59:57.244745970 CEST	53	57151	8.8.8.8	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 28, 2021 10:58:57.281032085 CEST	192.168.2.5	8.8.8.8	cff4	(Port unreachable)	Destination Unreachable
Apr 28, 2021 10:58:58.295278072 CEST	192.168.2.5	8.8.8.8	cff4	(Port unreachable)	Destination Unreachable
Apr 28, 2021 10:59:00.335191011 CEST	192.168.2.5	8.8.8.8	cff4	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 28, 2021 10:58:49.349518061 CEST	192.168.2.5	8.8.8.8	0x9ffb	Standard query (0)	smbproperty.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:49.898272991 CEST	192.168.2.5	8.8.8.8	0xdd03	Standard query (0)	gmbshop.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:50.504014015 CEST	192.168.2.5	8.8.8.8	0xb028	Standard query (0)	baksproperty.gov.ug	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:50.644890070 CEST	192.168.2.5	8.8.8.8	0x7700	Standard query (0)	magistralpsw.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:51.238593102 CEST	192.168.2.5	8.8.8.8	0x15d7	Standard query (0)	mpmanagertzz.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:52.228193045 CEST	192.168.2.5	8.8.8.8	0x15d7	Standard query (0)	mpmanagertzz.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:53.243866920 CEST	192.168.2.5	8.8.8.8	0x15d7	Standard query (0)	mpmanagertzz.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:55.285300016 CEST	192.168.2.5	8.8.8.8	0x15d7	Standard query (0)	mpmanagertzz.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:56.416729927 CEST	192.168.2.5	8.8.8.8	0x788b	Standard query (0)	powerglasspot.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:57.083112001 CEST	192.168.2.5	8.8.8.8	0x4785	Standard query (0)	autopartswarehouses.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:57.804225922 CEST	192.168.2.5	8.8.8.8	0x5a8a	Standard query (0)	memoloves.ru	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:58.324678898 CEST	192.168.2.5	8.8.8.8	0x922f	Standard query (0)	alfavanilin.ru	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 28, 2021 10:58:49.679915905 CEST	8.8.8.8	192.168.2.5	0x9ffb	No error (0)	smbproperty.ru		164.90.175.106	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:50.053113937 CEST	8.8.8.8	192.168.2.5	0xdd03	No error (0)	gmbshop.ru		93.170.123.43	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:50.568041086 CEST	8.8.8.8	192.168.2.5	0xb028	Name error (3)	baksproperty.gov.ug	none	none	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:50.739583015 CEST	8.8.8.8	192.168.2.5	0x7700	No error (0)	magistralpsw.ru		185.14.31.88	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:56.288965940 CEST	8.8.8.8	192.168.2.5	0x15d7	Server failure (2)	mpmanagertzz.ru	none	none	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:56.513053894 CEST	8.8.8.8	192.168.2.5	0x788b	No error (0)	powerglasspot.ru		185.14.31.88	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:57.192102909 CEST	8.8.8.8	192.168.2.5	0x4785	No error (0)	autopartswarehouses.ru		185.14.31.88	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:57.278234959 CEST	8.8.8.8	192.168.2.5	0x15d7	Server failure (2)	mpmanagertzz.ru	none	none	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:57.953320980 CEST	8.8.8.8	192.168.2.5	0x5a8a	No error (0)	memoloves.ru		185.14.31.88	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:58.295144081 CEST	8.8.8.8	192.168.2.5	0x15d7	Server failure (2)	mpmanagertzz.ru	none	none	A (IP address)	IN (0x0001)
Apr 28, 2021 10:58:58.474327087 CEST	8.8.8.8	192.168.2.5	0x922f	No error (0)	alfavanilin.ru		185.14.31.88	A (IP address)	IN (0x0001)
Apr 28, 2021 10:59:00.335083008 CEST	8.8.8.8	192.168.2.5	0x15d7	Server failure (2)	mpmanagertzz.ru	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

smbproperty.ru

gmbshop.ru

magistralpsw.ru

powerglasspot.ru

autopartswarehouses.ru

memoloves.ru

alfavanilin.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49716	164.90.175.106	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 10:58:49.740444899 CEST	1426	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://smbproperty.ru/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: smbproperty.ru
Apr 28, 2021 10:58:49.740461111 CEST	1426	OUT	Data Raw: 9c 3f 77 c8 fd f8 82 69 52 2e 6b 11 23 d6 c7 94 b3 24 28 ad 6d f9 31 a3 ab d7 2e b2 25 48 d8 82 26 1a ac c1 b5 81 b1 6b 02 32 69 43 36 49 e6 67 2a 00 78 45 f1 47 e5 32 fa dc 6e 13 7b b5 85 a3 6a 7f 27 cf 21 00 c1 af 29 c2 75 9b fb 8b bf cd 7b 69 Data Ascii: ?wiR.k#$(m1.%H&k2iC6Ig*xEG2n{j'!)u{i}~)7C&%kZ=Ti
Apr 28, 2021 10:58:49.888693094 CEST	1427	IN	HTTP/1.1 404 Not Found Date: Wed, 28 Apr 2021 08:58:49 GMT Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 327 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49717	93.170.123.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 10:58:50.134016991 CEST	1428	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gmbshop.ru/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 165 Host: gmbshop.ru
Apr 28, 2021 10:58:50.134042025 CEST	1428	OUT	Data Raw: 9c 3f 77 c8 fd f8 82 69 52 2e 6b 11 23 d6 c7 94 b3 24 28 ad 6d f9 31 a3 ab d7 2e b2 25 48 d8 82 26 1a ac c1 b5 81 b1 6b 02 32 69 43 36 49 e6 67 2a 00 78 45 f1 47 e5 32 fa dc 6e 13 7b b5 85 a3 6a 7f 27 cf 21 00 c1 af 29 c2 75 9b fb 8b df db 45 13 Data Ascii: ?wiR.k#$(m1.%H&k2iC6Ig*xEG2n{j'!)uEgB[)'XN[g6H+;J(M}9S#K)eG
Apr 28, 2021 10:58:50.213646889 CEST	1429	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 28 Apr 2021 08:58:50 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 227 Connection: keep-alive Keep-Alive: timeout=60 Location: https://gmbshop.ru/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 62 73 68 6f 70 2e 72 75 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://gmbshop.ru/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49719	185.14.31.88	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 10:58:50.792165041 CEST	1436	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://magistralpsw.ru/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 175 Host: magistralpsw.ru
Apr 28, 2021 10:58:50.792176962 CEST	1436	OUT	Data Raw: 9c 3f 77 c8 fd f8 82 69 52 2e 6b 11 23 d6 c7 94 b3 24 28 ad 6d f9 31 a3 ab d7 2e b2 25 48 d8 82 26 1a ac c1 b5 81 b1 6b 02 32 69 43 36 49 e6 67 2a 00 78 45 f1 47 e5 32 fa dc 6e 13 7b b5 85 a3 6a 7f 27 cf 21 00 c1 af 29 c2 75 9b fb 8b ad c9 6c 4a Data Ascii: ?wiR.k#$(m1.%H&k2iC6Ig*xEG2n{j'!)ulJ%tOHu+paW-LhqOLw0n=Bhb71IDT]$Ixhr)
Apr 28, 2021 10:58:51.229760885 CEST	1436	IN	HTTP/1.0 404 Not Found Date: Wed, 28 Apr 2021 08:58:50 GMT Server: Apache/2.4.18 (Ubuntu) X-Sinkhole: Malware sinkhole Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49720	185.14.31.88	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 10:58:56.569153070 CEST	1438	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://powerglasspot.ru/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: powerglasspot.ru
Apr 28, 2021 10:58:56.569188118 CEST	1438	OUT	Data Raw: 9c 3f 77 c8 fd f8 82 69 52 2e 6b 11 23 d6 c7 94 b3 24 28 ad 6d f9 31 a3 ab d7 2e b2 25 48 d8 82 26 1a ac c1 b5 81 b1 6b 02 32 69 43 36 49 e6 67 2a 00 78 45 f1 47 e5 32 fa dc 6e 13 7b b5 85 a3 6a 7f 27 cf 21 00 c1 af 29 c2 75 9b fb 8b bc d6 0d 51 Data Ascii: ?wiR.k#$(m1.%H&k2iC6IgxEG2n{j'!)uQ z^*;EKN'U\|nb>Q@4x\|,._'ml0l<.p7
Apr 28, 2021 10:58:57.060259104 CEST	1438	IN	HTTP/1.0 404 Not Found Date: Wed, 28 Apr 2021 08:58:56 GMT Server: Apache/2.4.18 (Ubuntu) X-Sinkhole: Malware sinkhole Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49721	185.14.31.88	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 10:58:57.243453979 CEST	1439	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://autopartswarehouses.ru/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 346 Host: autopartswarehouses.ru
Apr 28, 2021 10:58:57.243463993 CEST	1440	OUT	Data Raw: 9c 3f 77 c8 fd f8 82 69 52 2e 6b 11 23 d6 c7 94 b3 24 28 ad 6d f9 31 a3 ab d7 2e b2 25 48 d8 82 26 1a ac c1 b5 81 b1 6b 02 32 69 43 36 49 e6 67 2a 00 78 45 f1 47 e5 32 fa dc 6e 13 7b b5 85 a3 6a 7f 27 cf 21 00 c1 af 29 c2 75 9b fb 8b be 8b 76 5a Data Ascii: ?wiR.k#$(m1.%H&k2iC6IgxEG2n{j'!)uvZ(/]3>',vu.#yMpdp{CU(T7W2BJqxcT!ybv1d1HHg%<b6\EJwJUg~@F
Apr 28, 2021 10:58:57.753221035 CEST	1441	IN	HTTP/1.0 404 Not Found Date: Wed, 28 Apr 2021 08:58:57 GMT Server: Apache/2.4.18 (Ubuntu) X-Sinkhole: Malware sinkhole Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49723	185.14.31.88	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 10:58:58.006251097 CEST	1443	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://memoloves.ru/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: memoloves.ru
Apr 28, 2021 10:58:58.006273031 CEST	1443	OUT	Data Raw: 9c 3f 77 c8 fd f8 82 69 52 2e 6b 11 23 d6 c7 94 b3 24 28 ad 6d f9 31 a3 ab d7 2e b2 25 48 d8 82 26 1a ac c1 b5 81 b1 6b 02 32 69 43 36 49 e6 67 2a 00 78 45 f1 47 e5 32 fa dc 6e 13 7b b5 85 a3 6a 7f 27 cf 21 00 c1 af 29 c2 75 9b fb 8b 89 99 66 59 Data Ascii: ?wiR.k#$(m1.%H&k2iC6Ig*xEG2n{j'!)ufYhu7"BP.[VBQrz;l;S'+K~VX8x8(Ik%fLbDg<$4r4-#ti'ES5NtjTrNF
Apr 28, 2021 10:58:58.314035892 CEST	1444	IN	HTTP/1.0 404 Not Found Date: Wed, 28 Apr 2021 08:58:58 GMT Server: Apache/2.4.18 (Ubuntu) X-Sinkhole: Malware sinkhole Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49724	185.14.31.88	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 10:58:58.524086952 CEST	1445	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://alfavanilin.ru/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 155 Host: alfavanilin.ru
Apr 28, 2021 10:58:58.527605057 CEST	1445	OUT	Data Raw: 9c 3f 77 c8 fd f8 82 69 52 2e 6b 11 23 d6 c7 94 b3 24 28 ad 6d f9 31 a3 ab d7 2e b2 25 48 d8 82 26 1a ac c1 b5 81 b1 6b 02 32 69 43 36 49 e6 67 2a 00 78 45 f1 47 e5 32 fa dc 6e 13 7b b5 85 a3 6a 7f 27 cf 21 00 c1 af 29 c2 75 9b fb 8b ad cd 54 09 Data Ascii: ?wiR.k#$(m1.%H&k2iC6IgxEG2n{j'!)uTqG0'p7Oj_iS4`e8htdv@!jv
Apr 28, 2021 10:58:58.937362909 CEST	1445	IN	HTTP/1.0 404 Not Found Date: Wed, 28 Apr 2021 08:58:58 GMT Server: Apache/2.4.18 (Ubuntu) X-Sinkhole: Malware sinkhole Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 28, 2021 10:58:50.379254103 CEST	93.170.123.43	443	192.168.2.5	49718	CN=ecoelectrica.ru CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon Feb 08 01:00:00 CET 2021 Thu Sep 06 02:00:00 CEST 2018 Tue Mar 12 01:00:00 CET 2019	Mon May 10 01:59:59 CEST 2021 Wed Sep 06 01:59:59 CEST 2028 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
					CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Thu Sep 06 02:00:00 CEST 2018	Wed Sep 06 01:59:59 CEST 2028
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: http___citycapproperty.ru_localmod_nmode.exe PID: 4192 Parent PID: 5632

General

Start time:	10:58:09
Start date:	28/04/2021
Path:	C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\http___citycapproperty.ru_localmod_nmode.exe'
Imagebase:	0x400000
File size:	217600 bytes
MD5 hash:	C178795733E8A84F750AFF12E49CA3EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000000.00000003.235077807.0000000000620000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 4192

General

Start time:	10:58:19
Start date:	28/04/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: eurbbce PID: 6392 Parent PID: 904

General

Start time:	10:58:50
Start date:	28/04/2021
Path:	C:\Users\user\AppData\Roaming\eurbbce
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\eurbbce
Imagebase:	0x400000
File size:	217600 bytes
MD5 hash:	C178795733E8A84F750AFF12E49CA3EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000011.00000003.330508330.00000000005B0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 28%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: eurbbce PID: 6364 Parent PID: 904

General

Start time:	11:00:01
Start date:	28/04/2021
Path:	C:\Users\user\AppData\Roaming\eurbbce
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\eurbbce
Imagebase:	0x400000
File size:	217600 bytes
MD5 hash:	C178795733E8A84F750AFF12E49CA3EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.495234089.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000001A.00000003.484031694.0000000001F90000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: http___citycapproperty.ru_localmod_nmode.exe PID: 4192 Parent PID: 5632 http___citycapproperty.ru_localmod_nmode.exeCOMMON

Executed Functions

Function 004016B6, Relevance: 3.0, APIs: 2, Instructions: 48sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401756
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040177E

Memory Dump Source

Source File: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: cdc5c6d1207e72b774336099cfd4d7a0f50d8a067ed502ab486bb145d8488358
Instruction ID: 9817d08ee7cb01b68207c7a3fae4a1d30fdf779655ca1dda478e712fdb591fba
Opcode Fuzzy Hash: cdc5c6d1207e72b774336099cfd4d7a0f50d8a067ed502ab486bb145d8488358
Instruction Fuzzy Hash: 3601D835208241A7DB009FA4CD45ABD7B249F45325F6444BBBB437B1F2CA3C9517AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401718, Relevance: 3.0, APIs: 2, Instructions: 48sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401756
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040177E

Memory Dump Source

Source File: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 5b65caea2b662a27809642b241393292fac4c4074eef7ec28df2f23109d55589
Instruction ID: 243def003460411f04d2403cbbbe299c52fffa44889989118422b7cf4232d45c
Opcode Fuzzy Hash: 5b65caea2b662a27809642b241393292fac4c4074eef7ec28df2f23109d55589
Instruction Fuzzy Hash: F601A439208105F7EB006AA48D41EBA3628AB44365F304137BB037B0F2DA3C8917676B

Uniqueness

Uniqueness Score: -1.00%

Function 0040172E, Relevance: 3.0, APIs: 2, Instructions: 43sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401756
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040177E

Memory Dump Source

Source File: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 072872cd30e6d723020d54ecfb89e03fff5b1653ccea87c2db6cd78b2849899c
Instruction ID: a05afc57eb46c70f1857230eee8d3c3d1e536e5b652ebbc10141345a9555c0e6
Opcode Fuzzy Hash: 072872cd30e6d723020d54ecfb89e03fff5b1653ccea87c2db6cd78b2849899c
Instruction Fuzzy Hash: 4EF0F936204105EBDF019FA58D41AE937289F04315F144477BA02BB0F2CA3C84179B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00401723, Relevance: 3.0, APIs: 2, Instructions: 42sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401756
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040177E

Memory Dump Source

Source File: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 04389c4ee57fed76261b78415012b1d2c75a6e09e15c73b726d6d84759801c5e
Instruction ID: f958e37b69b25004bddca34a7ba9431922d6f5e10619a22f28f1878958057736
Opcode Fuzzy Hash: 04389c4ee57fed76261b78415012b1d2c75a6e09e15c73b726d6d84759801c5e
Instruction Fuzzy Hash: D5F06239308105EBEB005AA18D40EFE3624AB44315F244577BB13BB0F2DA3C8517A72B

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6DFD1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6DF8978A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e22d4b8eab8f7f9eff81e0848d8dc1cc4e790fab66bc316955ee1cb8f80de62f
Instruction ID: c2fd876409d6f06b8c914c734476c3a6640f1cdcd02b390177158ef251784285
Opcode Fuzzy Hash: e22d4b8eab8f7f9eff81e0848d8dc1cc4e790fab66bc316955ee1cb8f80de62f
Instruction Fuzzy Hash: 409002A961300002E181715D590860A040557D1242FA1D425A0006D18CC9658C6A6372

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6DFD18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6E020810,0000001C,6DFD1616), ref: 6DF8966A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5adae30507aafade41fcea2a1aab30f48fb133aea8e18e75f4fe72c3930d9566
Instruction ID: 2c2b39a396b2af946e629d4bfbe4f6862cc5f6488bbdc1549b4199f125223256
Opcode Fuzzy Hash: 5adae30507aafade41fcea2a1aab30f48fb133aea8e18e75f4fe72c3930d9566
Instruction Fuzzy Hash: 769002B160100802E181715D490464A040557D1341FA1C025A0016E14DCA658E5A77F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 18005166c16f280115390562be789ad3ac1c5bcb6698230b1142be700185a5f4
Instruction ID: ec6c0d7835cf69992087634bbee11b1439321ecf5c6cba23b735972e16552417
Opcode Fuzzy Hash: 18005166c16f280115390562be789ad3ac1c5bcb6698230b1142be700185a5f4
Instruction Fuzzy Hash: 719002B160100442E101625D4904B4A450567E0341F61C025A0405E14D85A58C627272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF899A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6DFD1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6DF899AA

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b839a1726564cc9d8a1329c6c5801b7692d202f14d2754edd3c622942cb89e38
Instruction ID: 9e098ef46621575dbbf098d85fbf0faae5a88cb0e7fe1b77eed9ecae9787ab08
Opcode Fuzzy Hash: b839a1726564cc9d8a1329c6c5801b7692d202f14d2754edd3c622942cb89e38
Instruction Fuzzy Hash: 489002E174100442E101615D4914B06040597E1341F61C025E1055D14D8669CC537277

Uniqueness

Uniqueness Score: -1.00%

Function 6DF898C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6DFD108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000), ref: 6DF898CA

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f72197e8cc2130fd65ae9fe784860d543a2bbbee91c1ee7bcc58b0f6ca6c9059
Instruction ID: 065475442bf2eb4420c34c5d107f0fb65e4cbd66f3a5eef9b2e3d29439237299
Opcode Fuzzy Hash: f72197e8cc2130fd65ae9fe784860d543a2bbbee91c1ee7bcc58b0f6ca6c9059
Instruction Fuzzy Hash: BE9002A160100482F102615D4904F06140957E0281FA1C026A101AD24D8665CD53B376

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6DFD15BB,00000073,?,00000008,00000000,?,00000568), ref: 6DF8986A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9d5f9e5ee03c57f7ef4f478d3fa728948ed25a65f1ba6d5a07b8a2df6f1a9023
Instruction ID: a7ce018926714da449b6feb065ed28334f21962f2a3de75ab9c0207d579dddbb
Opcode Fuzzy Hash: 9d5f9e5ee03c57f7ef4f478d3fa728948ed25a65f1ba6d5a07b8a2df6f1a9023
Instruction Fuzzy Hash: 049002B160100413E112615D4A04707040957D0281FA1C422A0415D18D96A68D53B272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6DFA2EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6DF8982A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 40f30a259273f8bbfd63169865f948a83133bcdbe4bc66b3b778c7366aa516ff
Instruction ID: 6f701d0fb220eda831788e8f766828b957288cc6e4e2dd4aee03762082d153ff
Opcode Fuzzy Hash: 40f30a259273f8bbfd63169865f948a83133bcdbe4bc66b3b778c7366aa516ff
Instruction Fuzzy Hash: CA9002B164100402E142715D4904606040967D0281FA1C022A0415D14E86A58E57BBB2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DFFB260, Relevance: 91.3, APIs: 22, Strings: 30, Instructions: 262COMMON

Download Yara Rule

APIs

DbgPrintEx.9419(00000065,00000000, *** Unhandled exception 0x%08lx, hit in %ws:%s,?,<unknown>,?,6E020DD8,00000018,6DFFB5A3,?,6DF248A4,?,?,6DF8B74A,6DF21650,6DF8B627), ref: 6DFFB2E6
DbgPrintEx.9419(00000065,00000000, *** A stack buffer overrun occurred in %ws:%s,<unknown>,?,6E020DD8,00000018,6DFFB5A3,?,6DF248A4,?,?,6DF8B74A,6DF21650,6DF8B627,6DF8B627), ref: 6DFFB2FD
DbgPrintEx.9419(00000065,00000000,This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.), ref: 6DFFB30C
DbgPrintEx.9419(00000065,00000000,If this bug ends up in the shipping product, it could be a severe security hole.), ref: 6DFFB31B
DbgPrintEx.9419(00000065,00000000,a NULL pointer), ref: 6DFFB4E7
DbgPrintEx.9419(00000065,00000000, *** enter .exr %p for the exception record,?), ref: 6DFFB4F8
DbgPrintEx.9419(00000065,00000000, *** enter .cxr %p for the context,?), ref: 6DFFB514
DbgPrintEx.9419(00000065,00000000, *** then kb to get the faulting stack), ref: 6DFFB523
DbgPrintEx.9419(00000065,00000000, *** Restarting wait on critsec or resource at %p (in %ws:%s),?,?,?), ref: 6DFFB546
RtlReportException.9419(00000000,?,00000000), ref: 6DFFB566

Strings

an invalid address, %p, xrefs: 6DFFB4CF
*** A stack buffer overrun occurred in %ws:%s, xrefs: 6DFFB2F3
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 6DFFB53F
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 6DFFB323
read from, xrefs: 6DFFB4AD, 6DFFB4B2
This failed because of error %Ix., xrefs: 6DFFB446
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 6DFFB484
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 6DFFB2DC
The resource is owned shared by %d threads, xrefs: 6DFFB37E
*** Inpage error in %ws:%s, xrefs: 6DFFB418
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 6DFFB39B
*** enter .exr %p for the exception record, xrefs: 6DFFB4F1
The resource is owned exclusively by thread %p, xrefs: 6DFFB374
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 6DFFB47D
*** Resource timeout (%p) in %ws:%s, xrefs: 6DFFB352
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6DFFB38F
*** An Access Violation occurred in %ws:%s, xrefs: 6DFFB48F
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 6DFFB314
Go determine why that thread has not released the critical section., xrefs: 6DFFB3C5
The critical section is owned by thread %p., xrefs: 6DFFB3B9
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 6DFFB305
<unknown>, xrefs: 6DFFB27E, 6DFFB2D1, 6DFFB350, 6DFFB399, 6DFFB417, 6DFFB48E
The instruction at %p referenced memory at %p., xrefs: 6DFFB432
*** then kb to get the faulting stack, xrefs: 6DFFB51C
*** enter .cxr %p for the context, xrefs: 6DFFB50D
The instruction at %p tried to %s , xrefs: 6DFFB4B6
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6DFFB3D6
a NULL pointer, xrefs: 6DFFB4E0
write to, xrefs: 6DFFB4A6
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 6DFFB476

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$ExceptionReport
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 374826753-108210295
Opcode ID: 6ce0524107a6aef429416af9959c0b2ef248d2e93d6020ea1380319c8d0a5a44
Instruction ID: 9603b06617924abda68fba261930514549b161ccd2749ed98bf9e95533a2fbc8
Opcode Fuzzy Hash: 6ce0524107a6aef429416af9959c0b2ef248d2e93d6020ea1380319c8d0a5a44
Instruction Fuzzy Hash: 2981BE76908124FFDB129F1D9C84E7A3B26EF8775AB474444F5046B222E3268952CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 6E001C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6E001C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6df248a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6DF4B150();
				} else {
					E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6e03589c);
				E6DF4B150("Heap error detected at %p (heap handle %p)\n",  *0x6e0358a0);
				_t27 =  *0x6e035898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6E001E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6DF4B150();
				} else {
					E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6DF4B150("Error code: %d - %s\n",  *0x6e035898);
				_t113 =  *0x6e0358a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6DF4B150("Parameter1: %p\n",  *0x6e0358a4);
				}
				_t115 =  *0x6e0358a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6DF4B150("Parameter2: %p\n",  *0x6e0358a8);
				}
				_t117 =  *0x6e0358ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6DF4B150("Parameter3: %p\n",  *0x6e0358ac);
				}
				_t119 =  *0x6e0358b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6e0358b4);
					E6DF4B150("Last known valid blocks: before - %p, after - %p\n",  *0x6e0358b0);
				} else {
					_t120 =  *0x6e0358b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6DF4B150();
				} else {
					E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6DF4B150("Stack trace available at %p\n", 0x6e0358c0);
			}

0x6e001c10
0x6e001c16
0x6e001c1e
0x6e001c3d
0x6e001c3e
0x6e001c20
0x6e001c35
0x6e001c3a
0x6e001c44
0x6e001c55
0x6e001c5a
0x6e001c65
0x6e001c67
0x00000000
0x6e001c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e001c67
0x6e001cdc
0x6e001ce5
0x6e001d04
0x6e001d05
0x6e001ce7
0x6e001cfc
0x6e001d01
0x6e001d0b
0x6e001d17
0x6e001d1f
0x6e001d25
0x6e001d30
0x6e001d4f
0x6e001d50
0x6e001d32
0x6e001d47
0x6e001d4c
0x6e001d61
0x6e001d67
0x6e001d68
0x6e001d6e
0x6e001d79
0x6e001d98
0x6e001d99
0x6e001d7b
0x6e001d90
0x6e001d95
0x6e001daa
0x6e001db0
0x6e001db1
0x6e001db7
0x6e001dc2
0x6e001de1
0x6e001de2
0x6e001dc4
0x6e001dd9
0x6e001dde
0x6e001df3
0x6e001df9
0x6e001dfa
0x6e001e00
0x6e001e0a
0x6e001e13
0x6e001e32
0x6e001e33
0x6e001e15
0x6e001e2a
0x6e001e2f
0x6e001e39
0x6e001e4a
0x6e001e02
0x6e001e02
0x6e001e08
0x00000000
0x00000000
0x6e001e08
0x6e001e5b
0x6e001e7a
0x6e001e7b
0x6e001e5d
0x6e001e72
0x6e001e77
0x6e001e95

APIs

DbgPrint.9419(HEAP[%wZ]: ,?,?,00000002,6E0358C0,6E0020B1,?,6DFFFFAF,00000001,00000020,6E0358C0,00000000), ref: 6E001C35
DbgPrint.9419(HEAP: ,?,00000002,6E0358C0,6E0020B1,?,6DFFFFAF,00000001,00000020,6E0358C0,00000000), ref: 6E001C3E
DbgPrint.9419(Heap error detected at %p (heap handle %p),?,00000002,6E0358C0,6E0020B1,?,6DFFFFAF,00000001,00000020,6E0358C0,00000000), ref: 6E001C55
DbgPrint.9419(HEAP[%wZ]: ,?,00000020,6E0358C0,00000000), ref: 6E001CFC
DbgPrint.9419(HEAP: ,00000020,6E0358C0,00000000), ref: 6E001D05
DbgPrint.9419(Error code: %d - %s,6DF248A4,00000020,6E0358C0,00000000), ref: 6E001D17
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,6E0358C0,00000000), ref: 6E001D47
DbgPrint.9419(HEAP: ,?,?,?,?,6E0358C0,00000000), ref: 6E001D50
DbgPrint.9419(Parameter1: %p,?,?,?,?,6E0358C0,00000000), ref: 6E001D61
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,6E0358C0,00000000), ref: 6E001D90
DbgPrint.9419(HEAP: ,?,?,?,?,6E0358C0,00000000), ref: 6E001D99
DbgPrint.9419(Parameter2: %p,?,?,?,?,6E0358C0,00000000), ref: 6E001DAA
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,6E0358C0,00000000), ref: 6E001DD9
DbgPrint.9419(HEAP: ,?,?,?,?,6E0358C0,00000000), ref: 6E001DE2
DbgPrint.9419(Parameter3: %p,?,?,?,?,6E0358C0,00000000), ref: 6E001DF3
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,6E0358C0,00000000), ref: 6E001E2A
DbgPrint.9419(HEAP: ,?,?,?,?,6E0358C0,00000000), ref: 6E001E33
DbgPrint.9419(Last known valid blocks: before - %p, after - %p,?,?,?,?,6E0358C0,00000000), ref: 6E001E4A
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6E0358C0,00000000), ref: 6E001E72
DbgPrint.9419(Stack trace available at %p,6E0358C0,?,?,?,?,?,?,?,6E0358C0,00000000), ref: 6E001E8B

Strings

heap_failure_unknown, xrefs: 6E001C75
heap_failure_multiple_entries_corruption, xrefs: 6E001C8A
HEAP[%wZ]: , xrefs: 6E001C30, 6E001CF7, 6E001D42, 6E001D8B, 6E001DD4, 6E001E25, 6E001E6D
heap_failure_entry_corruption, xrefs: 6E001C83
Last known valid blocks: before - %p, after - %p, xrefs: 6E001E45
Parameter1: %p, xrefs: 6E001D5C
heap_failure_internal, xrefs: 6E001C6E
heap_failure_listentry_corruption, xrefs: 6E001CD0
Parameter3: %p, xrefs: 6E001DEE
heap_failure_generic, xrefs: 6E001C7C
heap_failure_usage_after_free, xrefs: 6E001CBB
heap_failure_invalid_allocation_type, xrefs: 6E001CB4
Heap error detected at %p (heap handle %p), xrefs: 6E001C50
heap_failure_freelists_corruption, xrefs: 6E001CC9
heap_failure_block_not_busy, xrefs: 6E001CA6
heap_failure_buffer_underrun, xrefs: 6E001C9F
Stack trace available at %p, xrefs: 6E001E86
heap_failure_lfh_bitmap_mismatch, xrefs: 6E001CD7
heap_failure_virtual_block_corruption, xrefs: 6E001C91
heap_failure_buffer_overrun, xrefs: 6E001C98
heap_failure_invalid_argument, xrefs: 6E001CAD
Parameter2: %p, xrefs: 6E001DA5
HEAP: , xrefs: 6E001C16, 6E001C3D, 6E001D04, 6E001D4F, 6E001D98, 6E001DE1, 6E001E32, 6E001E7A
heap_failure_cross_heap_operation, xrefs: 6E001CC2
Error code: %d - %s, xrefs: 6E001D12

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: 8f9192c64bc17379e0e18fddfa3e95099b1238ccee7790ae215df5676366c021
Instruction ID: 50292ef67d412c13133901a2e693e8bedc098c3d1afb421d886a63c5eab9f4b8
Opcode Fuzzy Hash: 8f9192c64bc17379e0e18fddfa3e95099b1238ccee7790ae215df5676366c021
Instruction Fuzzy Hash: 7561E2360285A5EFF7518FDDE584F2877E4EB05628B4B843AF508AB723C7319C44CA4A

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7C9BF, Relevance: 51.2, APIs: 18, Strings: 11, Instructions: 412
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DF7C9BF(void* __ecx, signed int __edx, signed int _a4, intOrPtr _a12) {
				signed int _v12;
				char _v552;
				char _v1072;
				char _v1073;
				signed int _v1080;
				signed int _v1084;
				signed short _v1088;
				void* _v1092;
				signed short _v1094;
				char _v1096;
				char _v1100;
				intOrPtr _v1104;
				void* _v1108;
				char _v1112;
				char _v1116;
				signed short _v1120;
				char _v1124;
				char* _v1128;
				char _v1132;
				char _v1135;
				char _v1136;
				void* _v1140;
				char _v1144;
				intOrPtr _v1148;
				short _v1150;
				char _v1152;
				void* _v1156;
				char* _v1160;
				char _v1164;
				void* _v1168;
				void* _v1172;
				intOrPtr _v1176;
				void* _v1180;
				char _v1184;
				signed int _v1188;
				signed int _v1192;
				intOrPtr _v1196;
				char* _v1200;
				intOrPtr _v1204;
				char _v1208;
				char _v1216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t166;
				void* _t170;
				wchar_t* _t184;
				signed short _t188;
				char _t199;
				intOrPtr _t200;
				signed int _t205;
				signed int _t207;
				intOrPtr _t218;
				short _t219;
				char _t236;
				char _t242;
				signed int _t253;
				intOrPtr _t258;
				void* _t260;
				signed int _t264;
				void* _t272;
				void* _t276;
				unsigned int _t277;
				signed short _t279;
				signed int _t280;
				void* _t281;
				void* _t305;

				_t271 = __edx;
				_v12 =  *0x6e03d360 ^ _t280;
				_t253 = _a4;
				_v1104 = _a12;
				_t272 = __ecx;
				_v1160 =  &_v1072;
				_v1168 = __ecx;
				_t166 = 0;
				_v1073 = 0;
				_v1084 = 0;
				_t274 = 0;
				_v1156 = 0;
				_v1164 = 0x2080000;
				_v1096 = 0;
				_v1092 = 0;
				_v1112 = 0;
				_v1108 = 0;
				_v1100 = 0;
				if(__ecx == 0) {
					L67:
					_push(_t166);
					_push(_t253);
					_push(_t271);
					_push(_t272);
					E6DFD5720(0x33, 0, "SXS: %s() bad parameters\nSXS:   Map                : %p\nSXS:   Data               : %p\nSXS:   AssemblyRosterIndex: 0x%lx\nSXS:   Map->AssemblyCount : 0x%lx\n", "RtlpResolveAssemblyStorageMapEntry");
					_t274 = 0xc000000d;
					L21:
					if(_v1073 == 0) {
						L23:
						if(_v1092 != 0) {
							E6DF4AD30(_v1092);
						}
						L24:
						if(_v1084 != 0) {
							_push(_v1084);
							E6DF895D0();
						}
						_t170 = _v1156;
						if(_t170 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t170);
						}
						L26:
						return E6DF8B640(_t274, _t253, _v12 ^ _t280, _t271, _t272, _t274);
					}
					L22:
					_v1144 = _v1100;
					E6DF7CCC0(4,  &_v1144, _v1104);
					goto L23;
				}
				if(__edx == 0 || _t253 < 1 || _t253 >  *((intOrPtr*)(__ecx + 4))) {
					_t166 =  *((intOrPtr*)(_t272 + 4));
					goto L67;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 8)) + _t253 * 4)) != 0) {
						goto L26;
					}
					asm("lfence");
					_t258 =  *((intOrPtr*)(__edx + 0x18));
					_t260 =  *((intOrPtr*)(_t258 + __edx + 0x10)) + __edx;
					_t276 =  *((intOrPtr*)(_t253 * 0x18 +  *((intOrPtr*)(_t258 + __edx + 0xc)) + __edx + 0x10)) + __edx;
					_t181 =  *((intOrPtr*)(_t276 + 0x50));
					if( *((intOrPtr*)(_t276 + 0x50)) > 0xfffe) {
						_push(__edx);
						E6DFD5720(0x33, 0, "SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p\n", _t181);
						_t274 = 0xc0000106;
						goto L23;
					}
					if(( *(_t276 + 4) & 0x00000010) != 0) {
						_v1080 =  &_v1164;
						_t272 =  *((intOrPtr*)(_t276 + 0x18)) + _t260;
						if(_t272 != 0) {
							_t184 = wcsrchr(_t272, 0x5c);
							if(_t184 != 0) {
								_t188 = 0x00000004 + (_t184 - _t272 >> 0x00000001) * 0x00000002 & 0x0000ffff;
								_v1088 = _t188;
								_t277 = _t188 & 0x0000ffff;
								if(_t188 <= 0x208) {
									_t264 = _v1080;
									L39:
									memcpy( *(_t264 + 4), _t272, _t277 - 2);
									_t281 = _t281 + 0xc;
									 *((short*)( *((intOrPtr*)(_v1080 + 4)) + (_t277 >> 1) * 2 - 2)) = 0;
									 *_v1080 = _v1088 + 0xfffffffe;
									L18:
									if(_v1084 == 0) {
										if(E6DF56A00( *((intOrPtr*)(_v1080 + 4)),  &_v1112, 0,  &_v1184) != 0) {
											_v1156 = _v1108;
											_t199 = _v1184;
											if(_t199 == 0) {
												_t200 = 0;
											} else {
												_v1112 = _t199;
												_v1108 = _v1180;
												_t200 = _v1176;
											}
											_v1192 = _v1192 & 0x00000000;
											_v1188 = _v1188 & 0x00000000;
											_v1204 = _t200;
											_push(0x21);
											_v1200 =  &_v1112;
											_push(3);
											_push( &_v1216);
											_v1208 = 0x18;
											_push( &_v1208);
											_push(0x100020);
											_v1196 = 0x40;
											_push( &_v1084);
											_t205 = E6DF89830();
											_t272 = _v1172;
											_t274 = _t205;
											if(_t272 != 0) {
												asm("lock xadd [edi], eax");
												if((_t205 | 0xffffffff) == 0) {
													_push( *((intOrPtr*)(_t272 + 4)));
													E6DF895D0();
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t272);
												}
											}
											if(_t274 >= 0) {
												goto L19;
											} else {
												_push(_t274);
												E6DFD5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n",  *((intOrPtr*)(_v1080 + 4)));
												goto L21;
											}
										}
										E6DFD5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n",  *((intOrPtr*)(_v1080 + 4)));
										_t274 = 0xc000003a;
										goto L21;
									}
									L19:
									_t271 = _t253;
									_t207 = E6DF7CE6C(_v1168, _t253, _v1080,  &_v1084);
									_t274 = _t207;
									if(_t207 < 0) {
										E6DFD5720(0x33, 0, "SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx\n", _t274);
									} else {
										_t274 = 0;
									}
									goto L21;
								}
								_v1094 = _t188;
								_t218 = E6DF63A1C(_t277);
								_v1092 = _t218;
								if(_t218 != 0) {
									_t264 =  &_v1096;
									_v1080 = _t264;
									goto L39;
								}
								_t274 = 0xc0000017;
								goto L24;
							}
							_t274 = 0xc00000e5;
							goto L23;
						}
						_t274 = 0xc00000e5;
						goto L26;
					}
					_v1080 = _v1080 & 0x00000000;
					_t219 =  *((intOrPtr*)(_t276 + 0x50));
					_v1152 = _t219;
					_v1150 = _t219;
					_v1144 = __edx;
					_v1148 =  *((intOrPtr*)(_t276 + 0x54)) + _t260;
					_v1140 = _t253;
					_v1128 =  &_v552;
					_v1136 = 0;
					_v1132 = 0x2160000;
					_v1124 = 0;
					_v1116 = 0;
					_v1120 = 0;
					E6DF7CCC0(1,  &_v1144, _v1104);
					if(_v1116 != 0) {
						_t274 = 0xc0000120;
						goto L23;
					}
					if(_v1124 != 0) {
						_t271 =  &_v1132;
						_t274 = E6DF7CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 >= 0) {
							_t271 = _t253;
							_t274 = E6DF7CE6C(_t272, _t253,  &_v1132,  &_v1084);
							if(_t274 < 0) {
								_push(_t274);
								_push(_t253);
								_push("SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx\n");
								L44:
								_push(0);
								_push(0x33);
								E6DFD5720();
								goto L23;
							}
							_t274 = 0;
							goto L23;
						}
						_push(_t274);
						_push( &_v1132);
						_push("SXS: Attempt to probe known root of assembly storage (\"%wZ\") failed; Status = 0x%08lx\n");
						goto L44;
					}
					_t279 = _v1120;
					_t272 = 0;
					_t236 = _v1136;
					_v1100 = _t236;
					_v1088 = _t279;
					_v1073 = 1;
					if(_t279 == 0) {
						L16:
						_t305 = _t272 - _t279;
						L17:
						if(_t305 == 0) {
							L54:
							_push(_t272);
							E6DFD5720(0x33, 0, "SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries\n",  &_v1152);
							_t274 = 0xc0150004;
							goto L22;
						}
						goto L18;
					} else {
						goto L10;
					}
					while(1) {
						L10:
						_v1144 = _t236;
						_v1128 =  &_v552;
						_v1140 = _t272;
						_v1132 = 0x2160000;
						_v1136 = 0;
						E6DF7CCC0(2,  &_v1144, _v1104);
						if(_v1136 != 0) {
							break;
						}
						_t242 = _v1132;
						if(_v1135 != 0) {
							if(_t242 == 0) {
								goto L54;
							}
							_t119 = _t272 + 1; // 0x1
							_t279 = _t119;
							_v1088 = _t279;
						}
						if(_t242 == 0) {
							L27:
							_t272 = _t272 + 1;
							if(_t272 >= _t279) {
								goto L17;
							} else {
								_t236 = _v1100;
								continue;
							}
						}
						if(_v1084 != 0) {
							_push(_v1084);
							E6DF895D0();
							_v1084 = _v1084 & 0x00000000;
						}
						_t271 =  &_v1132;
						_t274 = E6DF7CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 < 0) {
							if(_t274 != 0xc0150004) {
								_push(_t274);
								_push( &_v1152);
								E6DFD5720(0x33, 0, "SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx\n",  &_v1132);
								goto L22;
							}
							_t279 = _v1088;
							goto L27;
						} else {
							_t279 = _v1088;
							goto L16;
						}
					}
					_t274 = 0xc0000120;
					goto L22;
				}
			}

0x6df7c9bf
0x6df7c9d1
0x6df7c9d8
0x6df7c9dc
0x6df7c9e9
0x6df7c9eb
0x6df7c9f3
0x6df7c9f9
0x6df7c9fb
0x6df7ca01
0x6df7ca07
0x6df7ca09
0x6df7ca0f
0x6df7ca19
0x6df7ca1f
0x6df7ca25
0x6df7ca2b
0x6df7ca31
0x6df7ca39
0x6dfbac23
0x6dfbac23
0x6dfbac24
0x6dfbac25
0x6dfbac26
0x6dfbac34
0x6dfbac3c
0x6df7cc3c
0x6df7cc43
0x6df7cc65
0x6df7cc6c
0x6dfbac4c
0x6dfbac4c
0x6df7cc72
0x6df7cc79
0x6dfbac56
0x6dfbac5c
0x6dfbac5c
0x6df7cc7f
0x6df7cc87
0x6dfbac72
0x6dfbac72
0x6df7cc8d
0x6df7cc9f
0x6df7cc9f
0x6df7cc45
0x6df7cc51
0x6df7cc60
0x00000000
0x6df7cc60
0x6df7ca41
0x6dfbac20
0x00000000
0x6df7ca59
0x6df7ca5f
0x00000000
0x00000000
0x6df7ca65
0x6df7ca68
0x6df7ca76
0x6df7ca7c
0x6df7ca7e
0x6df7ca86
0x6dfba8ea
0x6dfba8f5
0x6dfba8fd
0x00000000
0x6dfba8fd
0x6df7ca90
0x6dfba90d
0x6dfba916
0x6dfba918
0x6dfba927
0x6dfba930
0x6dfba94c
0x6dfba94f
0x6dfba955
0x6dfba95b
0x6dfba98c
0x6dfba992
0x6dfba99a
0x6dfba9a9
0x6dfba9af
0x6dfba9c3
0x6df7cc09
0x6df7cc10
0x6dfbab03
0x6dfbab2f
0x6dfbab35
0x6dfbab3e
0x6dfbab5a
0x6dfbab40
0x6dfbab40
0x6dfbab4c
0x6dfbab52
0x6dfbab52
0x6dfbab5c
0x6dfbab63
0x6dfbab6a
0x6dfbab76
0x6dfbab78
0x6dfbab84
0x6dfbab86
0x6dfbab8d
0x6dfbab97
0x6dfbab98
0x6dfbaba3
0x6dfbabad
0x6dfbabae
0x6dfbabb3
0x6dfbabb9
0x6dfbabbd
0x6dfbabc2
0x6dfbabc6
0x6dfbabc8
0x6dfbabcb
0x6dfbabdc
0x6dfbabdc
0x6dfbabc6
0x6dfbabe3
0x00000000
0x6dfbabe9
0x6dfbabef
0x6dfbabfc
0x00000000
0x6dfbac01
0x6dfbabe3
0x6dfbab17
0x6dfbab1f
0x00000000
0x6dfbab1f
0x6df7cc16
0x6df7cc29
0x6df7cc2b
0x6df7cc30
0x6df7cc34
0x6dfbac13
0x6df7cc3a
0x6df7cc3a
0x6df7cc3a
0x00000000
0x6df7cc34
0x6dfba95e
0x6dfba965
0x6dfba96a
0x6dfba972
0x6dfba97e
0x6dfba984
0x00000000
0x6dfba984
0x6dfba974
0x00000000
0x6dfba974
0x6dfba932
0x00000000
0x6dfba932
0x6dfba91a
0x00000000
0x6dfba91a
0x6df7ca96
0x6df7ca9d
0x6df7caa7
0x6df7caae
0x6df7caba
0x6df7cac0
0x6df7cace
0x6df7cad4
0x6df7cae3
0x6df7cae9
0x6df7caf3
0x6df7caf9
0x6df7caff
0x6df7cb05
0x6df7cb11
0x6dfba9cb
0x00000000
0x6dfba9cb
0x6df7cb1e
0x6dfba9f8
0x6dfbaa03
0x6dfbaa07
0x6dfbaa36
0x6dfbaa47
0x6dfbaa4b
0x6dfbaa18
0x6dfbaa19
0x6dfbaa1a
0x6dfbaa1f
0x6dfbaa1f
0x6dfbaa21
0x6dfbaa23
0x00000000
0x6dfbaa28
0x6dfbaa4d
0x00000000
0x6dfbaa4d
0x6dfbaa09
0x6dfbaa10
0x6dfbaa11
0x00000000
0x6dfbaa11
0x6df7cb24
0x6df7cb2a
0x6df7cb2c
0x6df7cb32
0x6df7cb38
0x6df7cb3e
0x6df7cb47
0x6df7cc01
0x6df7cc01
0x6df7cc03
0x6df7cc03
0x6dfbaac0
0x6dfbaac0
0x6dfbaad1
0x6dfbaad9
0x00000000
0x6dfbaad9
0x00000000
0x00000000
0x00000000
0x00000000
0x6df7cb4d
0x6df7cb4d
0x6df7cb53
0x6df7cb5f
0x6df7cb6e
0x6df7cb74
0x6df7cb7e
0x6df7cb87
0x6df7cb93
0x00000000
0x00000000
0x6df7cba0
0x6df7cba7
0x6dfbaa57
0x00000000
0x00000000
0x6dfbaa59
0x6dfbaa59
0x6dfbaa5c
0x6dfbaa5c
0x6df7cbb0
0x6df7cca2
0x6df7cca2
0x6df7cca5
0x00000000
0x6df7ccab
0x6df7ccab
0x00000000
0x6df7ccab
0x6df7cca5
0x6df7cbbd
0x6dfbaa67
0x6dfbaa6d
0x6dfbaa72
0x6dfbaa72
0x6df7cbe6
0x6df7cbf1
0x6df7cbf5
0x6dfbaa84
0x6dfbaa91
0x6dfbaa98
0x6dfbaaa9
0x00000000
0x6dfbaaae
0x6dfbaa86
0x00000000
0x6df7cbfb
0x6df7cbfb
0x00000000
0x6df7cbfb
0x6df7cbf5
0x6dfbaab6
0x00000000
0x6dfbaab6

APIs

DbgPrintEx.9419(00000033,00000000,SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p,?,?,?,00000000,00000002), ref: 6DFBA8F5

Part of subcall function 6DF7CCC0: memcpy.9419(6DF24F84,?,6DF56167,00000040,?,?), ref: 6DF7CD56

DbgPrintEx.9419(00000033,00000000,SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx,?,00000000,02160000,?,?,02080000,?,00000000,?,00000001,?,?,?), ref: 6DFBAA23
DbgPrintEx.9419(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx,RtlpResolveAssemblyStorageMapEntry,00000040,?,00000000,00000000,?,00000000,00000002), ref: 6DFBAC34
RtlDeleteBoundaryDescriptor.9419(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6DFBAC4C
ZwClose.9419(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6DFBAC5C
RtlFreeHeap.9419(?,00000000,?,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001), ref: 6DFBAC72

Strings

@, xrefs: 6DFBABA3
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 6DFBAAA0
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 6DFBAC0A
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 6DFBAAC8
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 6DFBAA11
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 6DFBAC2C
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6DFBAB0E
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 6DFBAA1A
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 6DFBA8EC
RtlpResolveAssemblyStorageMapEntry, xrefs: 6DFBAC27
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6DFBABF3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$BoundaryCloseDeleteDescriptorFreeHeapmemcpy
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 565419495-4009184096
Opcode ID: d18d3441e17b3c7baa0e821141e0f5b9753bec8c3626abffc2c03391d941b437
Instruction ID: eacce36782634a13a28ab089e1b56dcca00c673d5f2b250ad484a2cb1fa8413d
Opcode Fuzzy Hash: d18d3441e17b3c7baa0e821141e0f5b9753bec8c3626abffc2c03391d941b437
Instruction Fuzzy Hash: BA028FF2D046699BDB31CB18DD80BEAB7B8AB45304F4141DAE608A7241DB719E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6A309, Relevance: 49.7, APIs: 22, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E6DF6A309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x6e038a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E6DF6A830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = E6DF6DF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E6DF49373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E6DF4A9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0x6e038748 - 1;
						if( *0x6e038748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E6DF4B150();
								} else {
									E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E6DF4B150();
								__eflags =  *0x6e037bc8;
								if( *0x6e037bc8 == 0) {
									__eflags = 1;
									E6E002073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0x6e038748 - 1;
							if( *0x6e038748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = E6DF7174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E6DF67D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E6E0014FB(_t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E6DF49373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E6DF49819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0x6e038748 - 1;
									if( *0x6e038748 >= 1) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E6DF4B150();
											} else {
												E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E6DF4B150();
											_pop(_t491);
											__eflags =  *0x6e037bc8 - _t449;
											if( *0x6e037bc8 == _t449) {
												__eflags = 0;
												_t491 = 1;
												E6E002073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E6E00A80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E6DF6A830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E6DF67D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E6DF67D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E6E001411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E6DF67D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E6DF67D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0x6e038748 - 1;
							if( *0x6e038748 < 1) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E6DF4B150();
							} else {
								E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E6DF4B150();
							__eflags =  *0x6e037bc8;
							if( *0x6e037bc8 == 0) {
								__eflags = 0;
								E6E002073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0x6e038748 - 1;
										if( *0x6e038748 >= 1) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E6DF4B150();
												} else {
													E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E6DF4B150();
												__eflags =  *0x6e037bc8 - _t446;
												if( *0x6e037bc8 == _t446) {
													__eflags = 1;
													E6E002073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E6E00A80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E6DF6A830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								E6DF6B73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E6DF6A830(_t553, _v64, _v24);
								_t286 = E6DF67D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E6DF67D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E6E001411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E6DF67D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E6DF67D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E6E001411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = E6DF7174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								E6DF6B73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E6DF67D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E6E0014FB(_t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E6DF699BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E6DF6A830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E6DF7ABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x6df6a309
0x6df6a316
0x6df6a319
0x6df6a31d
0x6df6a32d
0x6df6a331
0x6dfb1e0d
0x6dfb1e10
0x6df6a3cb
0x6df6a3cb
0x6df6a3bd
0x6df6a3c3
0x6df6a3c3
0x6df6a33a
0x6dfb1e17
0x6dfb1e1b
0x6dfb1e1d
0x6dfb1e2f
0x6dfb1e34
0x6dfb1e36
0x6dfb1e3c
0x6dfb1e3c
0x6dfb1e3c
0x6dfb1e3c
0x6dfb1e36
0x6dfb1e42
0x6dfb1e45
0x6dfb1e47
0x6df6a3f8
0x6df6a3f8
0x6df6a3fb
0x6df6a3fd
0x6dfb1e50
0x6df6a403
0x6df6a411
0x6df6a411
0x6df6a411
0x6df6a41e
0x6df6a420
0x6df6a424
0x6df6a427
0x6df6a7c9
0x6df6a7cd
0x6df6a7d2
0x6df6a7d9
0x6df6a7e0
0x6df6a7e3
0x6df6a7ed
0x6df6a7f3
0x6df6a7f9
0x6df6a7ff
0x6df6a802
0x6df6a807
0x6df6a809
0x6df6a809
0x6df6a809
0x6df6a80f
0x6df6a80f
0x6df6a812
0x6df6a81c
0x6df6a821
0x6df6a824
0x6df6a42d
0x6df6a42d
0x6df6a42d
0x6df6a42d
0x6df6a42d
0x6df6a436
0x6df6a43a
0x6df6a609
0x6df6a60d
0x6df6a612
0x6df6a616
0x6df6a61a
0x6dfb1e57
0x6dfb1e59
0x00000000
0x00000000
0x6dfb1e5f
0x6df6a620
0x6df6a627
0x6dfb1e64
0x6dfb1e66
0x6dfb1e6c
0x6dfb1e72
0x6dfb1e76
0x6dfb1e95
0x6dfb1e9a
0x6dfb1e78
0x6dfb1e8d
0x6dfb1e92
0x6dfb1ea0
0x6dfb1ea5
0x6dfb1eaa
0x6dfb1eb2
0x6dfb1eb6
0x6dfb1eb9
0x6dfb1eb9
0x6dfb1ebe
0x6dfb1ec2
0x6dfb1ec2
0x6dfb1e66
0x6df6a62d
0x6df6a633
0x6df6a636
0x6df6a63a
0x6df6a63c
0x6df6a640
0x6df6a642
0x6df6a644
0x6df6a644
0x6df6a644
0x6df6a64d
0x6df6a64d
0x6df6a651
0x6df6a655
0x6dfb1eca
0x6dfb1ed1
0x00000000
0x00000000
0x6dfb1ed7
0x00000000
0x6df6a65b
0x6df6a669
0x6df6a66e
0x6df6a670
0x00000000
0x00000000
0x6df6a676
0x6df6a67b
0x6df6a680
0x6df6a682
0x6dfb1f1a
0x6df6a688
0x6df6a688
0x6df6a688
0x6df6a68a
0x6df6a68d
0x6dfb1f24
0x6dfb1f2a
0x6dfb1f31
0x6dfb1f43
0x6dfb1f43
0x6dfb1f31
0x6df6a693
0x6df6a697
0x6df6a69d
0x6df6a6a0
0x6df6a6a6
0x6df6a6a8
0x6df6a6a8
0x6df6a6a8
0x6df6a6a8
0x6df6a6b2
0x6df6a6b7
0x6df6a6c1
0x6df6a6c6
0x6df6a6d2
0x6df6a6d9
0x6df6a6e3
0x6df6a6e6
0x6df6a6eb
0x6df6a6ed
0x6df6a6ed
0x6df6a6ed
0x6df6a6ed
0x6df6a6f3
0x6df6a6f8
0x6df6a702
0x6df6a70a
0x6df6a70e
0x6df6a71a
0x6df6a71e
0x6dfb1fcb
0x6dfb1fcf
0x6dfb1fdd
0x6dfb1fe3
0x6dfb1fe3
0x6df6a724
0x6df6a728
0x6df6a72a
0x6df6a72d
0x6df6a737
0x6df6a73a
0x6df6a73c
0x6df6a742
0x6df6a748
0x6dfb1f4d
0x6dfb1f50
0x6dfb1f56
0x6dfb1f5c
0x6dfb1f5f
0x6dfb1f7e
0x6dfb1f83
0x6dfb1f61
0x6dfb1f76
0x6dfb1f7b
0x6dfb1f89
0x6dfb1f8e
0x6dfb1f93
0x6dfb1f94
0x6dfb1f9a
0x6dfb1f9c
0x6dfb1f9e
0x6dfb1fa1
0x6dfb1fa1
0x6dfb1fa6
0x6dfb1fa6
0x6dfb1f50
0x6df6a74e
0x6df6a751
0x6df6a754
0x6df6a75d
0x6df6a75e
0x6df6a762
0x6df6a767
0x6dfb1faf
0x6dfb1fb0
0x6dfb1fb9
0x6dfb1fbe
0x6dfb1fc2
0x6dfb1fc2
0x6df6a76d
0x6df6a76d
0x6df6a775
0x6df6a778
0x6df6a77d
0x6df6a77d
0x6df6a71e
0x6df6a782
0x6df6a787
0x6df6a789
0x6dfb1ff3
0x6df6a78f
0x6df6a78f
0x6df6a78f
0x6df6a791
0x6df6a794
0x6dfb1ffd
0x6dfb2006
0x6dfb200c
0x6dfb2017
0x6dfb2019
0x6dfb2024
0x6dfb2024
0x6dfb2024
0x6dfb2047
0x6dfb2047
0x6dfb200c
0x6df6a79a
0x6df6a79f
0x6df6a7a4
0x6df6a7a9
0x6df6a7ab
0x6dfb205a
0x6df6a7b1
0x6df6a7b1
0x6df6a7b1
0x6df6a7b3
0x6df6a7b6
0x00000000
0x6df6a7bc
0x6dfb2066
0x6dfb2068
0x6dfb2073
0x6dfb2073
0x6dfb2073
0x6dfb2078
0x6dfb2079
0x6dfb207d
0x00000000
0x6dfb207d
0x6df6a7b6
0x6df6a440
0x6df6a440
0x6df6a440
0x6df6a446
0x6df6a44c
0x6df6a44f
0x6df6a453
0x6df6a455
0x6dfb20b3
0x6dfb20b9
0x6dfb20b9
0x6df6a45d
0x6df6a460
0x6df6a464
0x6df6a466
0x6df6a46b
0x6df6a46f
0x6df6a471
0x6df6a471
0x6df6a471
0x6df6a474
0x6df6a479
0x6df6a47d
0x6df6a47f
0x6dfb2229
0x6dfb222f
0x6df6a3c8
0x6df6a3c8
0x6df6a3ca
0x6df6a3ca
0x00000000
0x6df6a3ca
0x6dfb2235
0x6dfb223a
0x6dfb223a
0x00000000
0x00000000
0x6dfb2240
0x6dfb2246
0x6dfb224a
0x6dfb2269
0x6dfb226e
0x6dfb224c
0x6dfb2261
0x6dfb2266
0x6dfb2274
0x6dfb2279
0x6dfb227e
0x6dfb2286
0x6dfb2288
0x6dfb228d
0x6dfb228d
0x6dfb2292
0x6dfb2292
0x6dfb2295
0x6dfb2295
0x00000000
0x6dfb2295
0x6df6a485
0x6df6a489
0x6df6a48b
0x6df6a48f
0x6df6a493
0x6df6a497
0x6df6a49b
0x6df6a4bb
0x6df6a4bb
0x6df6a4bd
0x6df6a4ff
0x6df6a4ff
0x6df6a501
0x6df6a505
0x6df6a50f
0x6df6a517
0x6df6a51b
0x6df6a527
0x6df6a52b
0x6dfb2182
0x6dfb2185
0x6dfb2193
0x6dfb2199
0x6dfb2199
0x6df6a531
0x6df6a535
0x6df6a538
0x6df6a548
0x6df6a54b
0x6df6a54d
0x6df6a553
0x6df6a559
0x6dfb2100
0x6dfb2103
0x6dfb2109
0x6dfb210f
0x6dfb2112
0x6dfb2131
0x6dfb2136
0x6dfb2114
0x6dfb2129
0x6dfb212e
0x6dfb213c
0x6dfb2141
0x6dfb2147
0x6dfb214d
0x6dfb2151
0x6dfb2154
0x6dfb2154
0x6dfb2159
0x6dfb2159
0x6dfb2103
0x6df6a55f
0x6df6a562
0x6df6a565
0x6df6a567
0x6dfb2162
0x6df6a56d
0x6df6a574
0x6df6a575
0x6df6a579
0x6df6a57e
0x6dfb2169
0x6dfb216a
0x6dfb2170
0x6dfb2175
0x6dfb2179
0x6dfb2179
0x6df6a57e
0x6df6a584
0x6df6a58f
0x6df6a58f
0x6df6a52b
0x6df6a5ad
0x6df6a5bc
0x6df6a5c1
0x6df6a5c6
0x6df6a5cb
0x6df6a5cd
0x6dfb21a9
0x6df6a5d3
0x6df6a5d3
0x6df6a5d3
0x6df6a5d5
0x6df6a5d8
0x6dfb21b3
0x6dfb21bc
0x6dfb21c2
0x6dfb21cd
0x6dfb21cf
0x6dfb21da
0x6dfb21da
0x6dfb21da
0x6dfb21f7
0x6dfb21f7
0x6dfb21c2
0x6df6a5de
0x6df6a5e3
0x6df6a5e8
0x6df6a5ea
0x6dfb220a
0x6df6a5f0
0x6df6a5f0
0x6df6a5f0
0x6df6a5f2
0x6df6a5f5
0x6dfb2219
0x6dfb221b
0x6dfb208c
0x6dfb208c
0x6dfb208c
0x6dfb2095
0x6dfb2096
0x6dfb2097
0x6dfb2098
0x6dfb20a4
0x6dfb20a5
0x6dfb20a9
0x6dfb20a9
0x00000000
0x6df6a5f5
0x6df6a4bf
0x6df6a4d3
0x6df6a4d8
0x6df6a4da
0x6dfb1ede
0x6dfb1ede
0x6dfb1ee4
0x6dfb1ee9
0x00000000
0x00000000
0x6dfb1f07
0x00000000
0x6dfb1f07
0x6df6a4e0
0x6df6a4e5
0x6df6a4e7
0x6dfb20cb
0x6df6a4ed
0x6df6a4ed
0x6df6a4ed
0x6df6a4f2
0x6df6a4f5
0x6dfb20d5
0x6dfb20de
0x6dfb20e4
0x6dfb20f6
0x6dfb20f6
0x6dfb20e4
0x6df6a4fb
0x00000000
0x6df6a4fb
0x6df6a4a1
0x6df6a4a4
0x6df6a4a8
0x00000000
0x00000000
0x6df6a4aa
0x6df6a4ac
0x00000000
0x00000000
0x6df6a4b2
0x6df6a4b5
0x00000000
0x00000000
0x00000000
0x6df6a4b5
0x6df6a43a
0x6df6a340
0x6df6a346
0x6df6a600
0x00000000
0x6df6a600
0x6df6a34f
0x6df6a351
0x6df6a358
0x6df6a3c6
0x00000000
0x6df6a371
0x6df6a37a
0x6df6a37f
0x6df6a382
0x6df6a384
0x6df6a394
0x00000000
0x6df6a396
0x6df6a399
0x6df6a3a7
0x6df6a3b0
0x6df6a3b4
0x6df6a3bb
0x6df6a3d2
0x6df6a3da
0x6df6a3df
0x6df6a3e1
0x6df6a3e5
0x6df6a3ea
0x6df6a3f0
0x6df6a3f0
0x6df6a3e1
0x00000000
0x6df6a3bb
0x6df6a394

APIs

RtlGetCurrentServiceSessionId.9419(00000000,00004000), ref: 6DF6A4E0
RtlGetCurrentServiceSessionId.9419(?,-000000E8,?,?,?), ref: 6DF6A5C1
RtlGetCurrentServiceSessionId.9419(?,-000000E8,?,?,?), ref: 6DF6A5DE
RtlGetCurrentServiceSessionId.9419(?,00004000), ref: 6DF6A676
RtlGetCurrentServiceSessionId.9419 ref: 6DF6A782
RtlGetCurrentServiceSessionId.9419 ref: 6DF6A79A
RtlGetCurrentServiceSessionId.9419 ref: 6DFB2012
RtlGetCurrentServiceSessionId.9419 ref: 6DFB2061
RtlGetCurrentServiceSessionId.9419(?,-000000E8,?,?,?), ref: 6DFB2214

Strings

(!TrailingUCR), xrefs: 6DFB2274
(LONG)FreeEntry->Size > 1, xrefs: 6DFB213C
(UCRBlock != NULL), xrefs: 6DFB1EA0
HEAP: , xrefs: 6DFB1E95, 6DFB1F7E, 6DFB2131, 6DFB2269
HEAP[%wZ]: , xrefs: 6DFB1E88, 6DFB1F71, 6DFB2124, 6DFB225C
((LONG)FreeEntry->Size > 1), xrefs: 6DFB1F89

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1007659313-523794902
Opcode ID: 6a5bc75ae4875c7e5ddffd0717a5fe9d01dc6f555ab837146eaae9a04590f9ac
Instruction ID: 608d9a29d5e5bd777cdc2caf6225ffa337d1b49bf740eb6d18b953babffdf84d
Opcode Fuzzy Hash: 6a5bc75ae4875c7e5ddffd0717a5fe9d01dc6f555ab837146eaae9a04590f9ac
Instruction Fuzzy Hash: 6C42EB316187829FD311CF3DC884B2ABBE5FF89308F048969E8958B752D735D985CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6E004AEF, Relevance: 47.8, APIs: 18, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6E004AEF(signed int __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				signed int _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E6DF4B150();
						} else {
							E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E6DF4B150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E6DFFFA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E6DF4B150();
						} else {
							E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E6DF4B150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E6DF4B150();
								} else {
									E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E6DF4B150();
									} else {
										E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E6DF4B150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E6DFFFA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E6DF4B150();
										} else {
											E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E6DF9D540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E6DF4B150();
								} else {
									E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E6E00A80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E6DF6E12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E6E00A80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E6DF6E4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E6DF6A229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E6DF6A309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E6DF6BC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E6DFF23E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = E6DF41F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x6e004af7
0x6e004afb
0x6e004afd
0x6e004b01
0x6e004b03
0x6e004b08
0x6e004b0a
0x6e004b0f
0x6e004eb5
0x6e004eb5
0x6e004ebb
0x6e0050d5
0x6e0050d8
0x6e004ff6
0x00000000
0x6e004ff6
0x6e0050de
0x6e0050e4
0x6e0050e8
0x6e005107
0x6e00510c
0x6e0050ea
0x6e0050ff
0x6e005104
0x6e005112
0x6e005115
0x6e005118
0x6e005119
0x6e0050cb
0x6e0050cb
0x6e0050af
0x00000000
0x6e0050af
0x6e004ecb
0x6e0050b6
0x6e0050bb
0x6e004ed1
0x6e004ee6
0x6e004eeb
0x6e0050c1
0x6e0050c2
0x6e0050c5
0x6e0050c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6e004b15
0x6e004b15
0x6e004b1c
0x6e004b1e
0x6e004b23
0x6e004b27
0x6e004b33
0x6e004b38
0x6e004b3a
0x6e004b3c
0x6e004b41
0x6e004b41
0x6e004b3a
0x6e004b52
0x6e005045
0x6e00504b
0x6e00504f
0x6e00506e
0x6e005073
0x6e005051
0x6e005066
0x6e00506b
0x6e005083
0x6e005088
0x6e005088
0x6e00508a
0x6e005091
0x6e005099
0x6e005099
0x6e00509d
0x6e0050a7
0x6e0050ad
0x6e0050ad
0x6e0050ad
0x00000000
0x6e00509d
0x6e004b58
0x6e004b5b
0x6e004b5e
0x6e004b63
0x6e004b66
0x6e004b69
0x6e004b6f
0x6e004be4
0x6e004bf0
0x6e004bf2
0x6e004bf5
0x6e004dc3
0x6e004dc6
0x6e004dc9
0x6e004dce
0x6e004dce
0x6e004dd0
0x6e004dd0
0x6e004dd5
0x6e004def
0x6e004dd7
0x6e004de7
0x6e004de7
0x6e004df3
0x6e005001
0x6e005007
0x6e00500b
0x6e00502a
0x6e00502f
0x6e00500d
0x6e005022
0x6e005027
0x6e005039
0x6e00503a
0x6e00503b
0x00000000
0x6e004df9
0x6e004dfd
0x6e004e90
0x6e004e94
0x6e004e9e
0x6e004ea4
0x6e004ea4
0x6e004ea4
0x6e004ea6
0x6e004ea6
0x00000000
0x6e004ea6
0x6e004e03
0x6e004e08
0x6e004f88
0x6e004f92
0x6e004f99
0x6e004f9c
0x6e004fe0
0x6e004fe4
0x6e004fee
0x6e004ff4
0x6e004ff4
0x6e004ff4
0x00000000
0x6e004fe4
0x6e004f9e
0x6e004fa4
0x6e004fa8
0x6e004fc7
0x6e004fcc
0x6e004faa
0x6e004fbf
0x6e004fc4
0x6e004fd2
0x6e004fd5
0x6e004fd6
0x6e004f34
0x6e004f34
0x00000000
0x6e004f39
0x6e004e0e
0x6e004e14
0x6e004e1b
0x6e004e25
0x6e004e2b
0x6e004e2b
0x6e004e33
0x6e004e38
0x6e004e8a
0x6e004e8a
0x00000000
0x6e004e3a
0x6e004e3e
0x6e004e43
0x6e004e47
0x6e004e53
0x6e004e58
0x6e004e5a
0x6e004e5c
0x6e004e61
0x6e004e61
0x6e004e5a
0x6e004e6e
0x6e004f41
0x6e004f47
0x6e004f4b
0x6e004f6a
0x6e004f6f
0x6e004f4d
0x6e004f62
0x6e004f67
0x6e004f7f
0x6e004f80
0x6e004f81
0x00000000
0x6e004e74
0x6e004e78
0x6e004e82
0x6e004e88
0x6e004e88
0x00000000
0x6e004e78
0x6e004e6e
0x6e004e38
0x6e004df3
0x6e004bfe
0x6e004c01
0x6e004c04
0x6e004c07
0x6e004c09
0x6e004c0c
0x6e004c0e
0x6e004c0e
0x6e004c11
0x6e004c11
0x6e004c0c
0x6e004c14
0x6e004c17
0x6e004dae
0x6e004db2
0x6e004db7
0x6e004dba
0x6e004dbd
0x6e004ef1
0x6e004ef7
0x6e004efb
0x6e004f1a
0x6e004f1f
0x6e004efd
0x6e004f12
0x6e004f17
0x6e004f2b
0x6e004f2b
0x6e004f2d
0x6e004f2e
0x6e004f2f
0x00000000
0x6e004f2f
0x00000000
0x6e004c1d
0x6e004c1d
0x6e004c20
0x6e004c23
0x6e004c26
0x6e004c29
0x6e004c2c
0x6e004c2e
0x6e004d91
0x6e004d91
0x6e004d92
0x6e004d97
0x6e004d9e
0x00000000
0x6e004d9e
0x6e004c34
0x6e004c37
0x6e004c39
0x6e004c3c
0x00000000
0x00000000
0x6e004c45
0x6e004c48
0x6e004c4e
0x6e004c50
0x6e004c78
0x6e004c78
0x6e004c7b
0x6e004c7d
0x6e004c80
0x6e004c84
0x6e004cad
0x6e004cad
0x6e004cb0
0x6e004cb8
0x6e004cbb
0x6e004cbe
0x6e004cc1
0x6e004cc7
0x6e004cdc
0x6e004cc9
0x6e004cd2
0x6e004cd4
0x6e004cd4
0x6e004cde
0x6e004ce0
0x6e004d13
0x6e004d13
0x6e004d16
0x6e004d18
0x6e004d29
0x6e004d2a
0x6e004d2c
0x6e004d34
0x6e004d1a
0x6e004d1a
0x6e004d1a
0x6e004d1d
0x6e004d1f
0x6e004d22
0x6e004d24
0x6e004d24
0x6e004d3c
0x6e004d3f
0x6e004d45
0x6e004d47
0x6e004d6c
0x6e004d6c
0x6e004d70
0x6e004d7e
0x6e004d84
0x6e004d84
0x00000000
0x6e004d49
0x6e004d49
0x6e004d56
0x6e004d56
0x6e004d59
0x00000000
0x00000000
0x6e004d4e
0x6e004d50
0x6e004d52
0x6e004d8e
0x6e004d5d
0x6e004d5f
0x6e004d67
0x00000000
0x6e004d67
0x6e004d54
0x6e004d54
0x6e004d5b
0x00000000
0x6e004d5b
0x6e004ce2
0x6e004ce2
0x6e004ce5
0x6e004ce5
0x6e004ce7
0x6e004cfb
0x6e004ce9
0x6e004ce9
0x6e004cec
0x6e004cef
0x6e004cf1
0x6e004cf3
0x6e004cf3
0x6e004cf3
0x6e004cf6
0x6e004cf6
0x6e004d02
0x6e004d05
0x00000000
0x00000000
0x6e004d07
0x6e004d0f
0x6e004d11
0x00000000
0x00000000
0x00000000
0x6e004d11
0x00000000
0x6e004ce5
0x6e004ce0
0x6e004c8a
0x6e004c8f
0x6e004c91
0x00000000
0x00000000
0x6e004c9d
0x00000000
0x6e004c9d
0x6e004c52
0x6e004c5f
0x6e004c5f
0x6e004c62
0x00000000
0x00000000
0x6e004c57
0x6e004c59
0x6e004c5b
0x6e004caa
0x6e004c66
0x6e004c68
0x6e004c70
0x6e004c75
0x00000000
0x6e004c75
0x6e004c5d
0x6e004c5d
0x6e004c64
0x00000000
0x6e004c64
0x6e004c17
0x6e004b75
0x6e004bc4
0x6e004bc8
0x00000000
0x00000000
0x6e004bd9
0x00000000
0x00000000
0x00000000
0x6e004b77
0x6e004b7a
0x6e004b8c
0x6e004b7c
0x6e004b7e
0x6e004b83
0x6e004b86
0x6e004b86
0x6e004b90
0x6e004b93
0x00000000
0x00000000
0x6e004b95
0x6e004bab
0x6e004bb0
0x00000000
0x00000000
0x6e004bb2
0x6e004bb9
0x00000000
0x00000000
0x6e004bbb
0x6e004bbe
0x6e004bc1
0x6e004bc1
0x00000000
0x6e004bc1
0x6e004b97
0x6e004ba4
0x00000000
0x00000000
0x6e004ba6
0x00000000
0x6e004ba6
0x6e004ea9
0x6e004ea9
0x6e004eb2
0x00000000

APIs

RtlCompareMemoryUlong.9419(-00000008,?,FEEEFEEE), ref: 6E004DB2
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6E004EE6
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,-00000008,?,FEEEFEEE), ref: 6E004F12
DbgPrint.9419(HEAP: ,-00000008,?,FEEEFEEE), ref: 6E004F1F
DbgPrint.9419(Heap block at %p is not last block in segment (%p),-00000018,?), ref: 6E004F34
DbgPrint.9419(HEAP[%wZ]: ,-0000002C), ref: 6E004F62
DbgPrint.9419(HEAP: ), ref: 6E004F6F
DbgPrint.9419(HEAP[%wZ]: ,-0000002C), ref: 6E004FBF
DbgPrint.9419(HEAP: ), ref: 6E004FCC
DbgPrint.9419(HEAP[%wZ]: ,-0000002C), ref: 6E005022
DbgPrint.9419(HEAP: ), ref: 6E00502F
DbgPrint.9419(HEAP[%wZ]: ,-0000002C), ref: 6E005066
DbgPrint.9419(HEAP: ), ref: 6E005073
DbgPrint.9419(Heap entry %p has incorrect PreviousSize field (%04x instead of %04x),-00000018,?,?), ref: 6E005091
DbgPrint.9419(HEAP: ,-00000008,?,?), ref: 6E0050BB
DbgPrint.9419(Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x),?,00000000,?,-00000008,?,?), ref: 6E0050CB
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6E0050FF
DbgPrint.9419(HEAP: ,-00000008,?,?), ref: 6E00510C

Strings

Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 6E005119
Heap block at %p is not last block in segment (%p), xrefs: 6E004FD6
Heap block at %p has incorrect segment offset (%x), xrefs: 6E00503B
Free Heap block %p modified at %p after it was freed, xrefs: 6E004F2F
HEAP: , xrefs: 6E004F1A, 6E004F6A, 6E004FC7, 6E00502A, 6E00506E, 6E0050B6, 6E005107
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 6E00508C
HEAP[%wZ]: , xrefs: 6E004EE1, 6E004F0D, 6E004F5D, 6E004FBA, 6E00501D, 6E005061, 6E0050FA
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 6E0050C6
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 6E004F81

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemoryUlong
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 2560481200-3591852110
Opcode ID: 0701b51f12ddb09b35185ceca2bbc407cb2d07031509ed24fe6614f4f28e934c
Instruction ID: f631f86df07e38789b1e40ff37adf174ab5a0fd226a1e3db9f70b832278abeea
Opcode Fuzzy Hash: 0701b51f12ddb09b35185ceca2bbc407cb2d07031509ed24fe6614f4f28e934c
Instruction Fuzzy Hash: 3D121130204642EFE765CFA9C4A0BBABBF1FF59304F11C859E4958B642D735E882CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6E004496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6E004496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E6E0049A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x6e036378 = _t267;
						asm("int3");
						 *0x6e036378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E6DF7174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E6DF4B150();
							} else {
								E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E6DF4B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E6DF4B150();
							} else {
								E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E6DF4B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x6e036350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E6DF89660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E6DF7174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E6DF4B150();
										} else {
											E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_push( *((intOrPtr*)(_t330 + 8)));
										_push(_t330 + 0x10);
										E6DF4B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E6DF4B150();
									} else {
										E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E6DF4B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E6DF4B150();
								} else {
									E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E6DF4B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E6DF4B150();
							} else {
								E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E6E004AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E6DFFFA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E6DFF23E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x6e0044a1
0x6e0044a3
0x6e0044a7
0x6e0044ac
0x6e0044af
0x6e0044b2
0x6e0044b9
0x6e0044bc
0x6e0047f2
0x6e0047f2
0x6e0047f8
0x6e0047fc
0x6e0047fe
0x6e004804
0x6e004805
0x6e004805
0x6e00480c
0x6e004810
0x6e004812
0x6e004812
0x6e004812
0x6e004822
0x6e004822
0x6e004827
0x6e004827
0x00000000
0x6e004827
0x6e0044c4
0x6e0044d3
0x6e0044d9
0x6e0044dc
0x6e0044de
0x6e0044e0
0x6e004560
0x6e004520
0x6e004522
0x6e004525
0x6e004528
0x6e00452b
0x6e00452e
0x6e004530
0x6e004697
0x6e00469d
0x6e0046a1
0x6e0046c0
0x6e0046c5
0x6e0046a3
0x6e0046b8
0x6e0046bd
0x6e0046cb
0x6e0046d4
0x6e004677
0x6e004677
0x6e004679
0x6e00467c
0x6e00468a
0x6e004690
0x6e004690
0x6e0047f1
0x6e0047f1
0x6e0047f1
0x00000000
0x6e0047f1
0x6e004536
0x6e004539
0x6e00453c
0x6e004636
0x6e00463c
0x6e004640
0x6e00465f
0x6e004664
0x6e004642
0x6e004657
0x6e00465c
0x6e004670
0x00000000
0x6e004542
0x6e004542
0x6e004546
0x6e004548
0x6e00454b
0x6e004555
0x6e00455b
0x6e00455b
0x6e00455b
0x6e00455d
0x6e00455d
0x6e00455d
0x00000000
0x6e00455d
0x6e00453c
0x6e004579
0x6e00457c
0x6e004587
0x6e004589
0x6e004591
0x6e004592
0x6e004597
0x6e004598
0x6e0045a1
0x6e0045ab
0x6e0045ab
0x6e0045a1
0x6e0045ae
0x6e0045b4
0x6e0045b9
0x6e0045bd
0x6e004759
0x6e004759
0x6e00475f
0x6e004761
0x6e004763
0x6e004765
0x6e004768
0x6e00476b
0x6e00476d
0x6e00479c
0x6e00479c
0x6e00479f
0x6e0047a2
0x6e0047a4
0x6e004830
0x6e004833
0x6e004879
0x6e00487d
0x6e0048f1
0x6e0048f3
0x6e0048f3
0x00000000
0x6e0048f3
0x6e00487f
0x6e004885
0x6e004887
0x6e0048a8
0x6e0048a8
0x6e0048ae
0x6e0048b0
0x6e0048dc
0x6e0048dc
0x6e0048dc
0x6e0048dc
0x6e0048ec
0x00000000
0x6e0048ec
0x6e0048b2
0x6e0048bc
0x6e0048be
0x6e0048c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6e0048c3
0x6e0048c3
0x6e0048c6
0x6e0048c9
0x6e0048cc
0x6e0048d1
0x6e0048d4
0x00000000
0x00000000
0x6e0048d6
0x6e0048d7
0x6e0048da
0x00000000
0x00000000
0x00000000
0x6e0048da
0x6e00494f
0x6e004955
0x6e004959
0x6e004978
0x6e00497d
0x6e00495b
0x6e004970
0x6e004975
0x6e004986
0x6e004987
0x6e00498d
0x6e004990
0x6e004997
0x6e0047ef
0x6e0047ef
0x6e0047ef
0x00000000
0x6e0047ef
0x6e004890
0x6e004890
0x6e004891
0x6e004891
0x6e004894
0x6e004897
0x6e00489d
0x6e0048a0
0x00000000
0x00000000
0x6e0048a2
0x6e0048a3
0x6e0048a6
0x00000000
0x00000000
0x00000000
0x6e0048a6
0x6e0048fb
0x6e004901
0x6e004905
0x6e004924
0x6e004929
0x6e004907
0x6e00491c
0x6e004921
0x6e00492f
0x6e004935
0x6e004936
0x6e004939
0x6e004942
0x00000000
0x6e004947
0x6e004835
0x6e00483b
0x6e00483f
0x6e00485e
0x6e004863
0x6e004841
0x6e004856
0x6e00485b
0x6e004869
0x6e00486c
0x6e00486f
0x6e0047e7
0x6e0047e7
0x00000000
0x6e0047ec
0x6e0047aa
0x6e0047b0
0x6e0047b4
0x6e0047d3
0x6e0047d8
0x6e0047b6
0x6e0047cb
0x6e0047d0
0x6e0047de
0x6e0047df
0x6e0047e2
0x00000000
0x00000000
0x00000000
0x00000000
0x6e00476f
0x6e00476f
0x6e004778
0x6e004785
0x6e004787
0x6e00478c
0x6e00478e
0x00000000
0x00000000
0x6e004790
0x6e004792
0x6e004794
0x00000000
0x00000000
0x6e004796
0x6e004799
0x00000000
0x6e004799
0x00000000
0x6e0045c3
0x6e0045c3
0x6e0045c7
0x6e0045c7
0x6e0045ca
0x6e0045cf
0x6e0045d3
0x6e0045df
0x6e0045e4
0x6e0045e6
0x6e0045e8
0x6e0045ed
0x6e0045ed
0x6e0045f2
0x6e0045f2
0x6e0045f7
0x6e0045fc
0x6e004602
0x6e004606
0x6e004609
0x6e00460f
0x6e0046de
0x6e0046e3
0x6e0046e5
0x6e0046ec
0x6e0046ee
0x6e0046f6
0x6e0046f6
0x6e0046f6
0x6e0046f6
0x6e0046ec
0x6e004615
0x6e004615
0x6e00461d
0x6e00462e
0x6e00462e
0x6e00461d
0x6e00460f
0x6e004609
0x6e0046fd
0x00000000
0x00000000
0x6e004710
0x6e00471a
0x6e004720
0x6e004720
0x6e004722
0x6e00472c
0x00000000
0x6e00472e
0x6e00472e
0x00000000
0x6e00472e
0x6e00472c
0x6e004738
0x6e00473c
0x6e00474b
0x6e004751
0x6e004751
0x00000000
0x6e00473c
0x6e0048f4
0x6e0048f4
0x00000000
0x6e0048f4

APIs

Part of subcall function 6E0049A4: ZwAllocateVirtualMemory.9419(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6E0044B7,?), ref: 6E0049DF
Part of subcall function 6E0049A4: RtlCompareMemory.9419(?,01000000,?,00000000,?,00000000,?,?,6E0044B7,?), ref: 6E0049FE
Part of subcall function 6E0049A4: DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?), ref: 6E004A42
Part of subcall function 6E0049A4: DbgPrint.9419(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6E004A66

ZwAllocateVirtualMemory.9419(000000FF,?,00000000,?,00001000,00000004), ref: 6E00459A
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C), ref: 6E004657
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C,6DF9F07A), ref: 6E004664
DbgPrint.9419(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C), ref: 6E004670
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C), ref: 6E0046B8
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C,6DF9F07A), ref: 6E0046C5
DbgPrint.9419(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20), ref: 6E0046D4
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C), ref: 6E0047CB
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C,6DF9F07A), ref: 6E0047D8
DbgPrint.9419(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20), ref: 6E0047E7
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C), ref: 6E004856
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C,6DF9F07A), ref: 6E004863
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C), ref: 6E00491C
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C,6DF9F07A), ref: 6E004929
DbgPrint.9419(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6E004942
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C), ref: 6E004970
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20,0000001C,6DF9F07A), ref: 6E00497D
DbgPrint.9419(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6E004997

Strings

Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6E00486F
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6E0047E2
Non-Dedicated free list element %p is out of order, xrefs: 6E00466B
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6E004992
dedicated (%04Ix) free list element %p is marked busy, xrefs: 6E0046CF
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6E00493D
HEAP: , xrefs: 6E00465F, 6E0046C0, 6E0047D3, 6E00485E, 6E004924, 6E004978
HEAP[%wZ]: , xrefs: 6E004652, 6E0046B3, 6E0047C6, 6E004851, 6E004917, 6E00496B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: 3b93c7b6fdefc602bf8c8d5d3187bcfe6ef83983d7502d383a8f038c8babb1e0
Instruction ID: d778dff24a37471bf61acb94349931f58a4847797f435ba8a61c9459b12bb638
Opcode Fuzzy Hash: 3b93c7b6fdefc602bf8c8d5d3187bcfe6ef83983d7502d383a8f038c8babb1e0
Instruction Fuzzy Hash: C9F16131904646FFEB11CFE9C490BAEB7F1FF69308F018429E1559B242D731A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 6DF62990, Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 521
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E6DF62990(intOrPtr* __ecx, int __edx, signed short* _a4, signed int _a8, int _a12) {
				signed int _v12;
				short _v16;
				short _v20;
				short _v24;
				short* _v28;
				short* _v32;
				void* _v36;
				short _v38;
				void* _v40;
				signed int _v44;
				char _v45;
				signed short _v46;
				signed short _v48;
				signed int _v52;
				void* _v56;
				signed short* _v60;
				int _v64;
				int _v68;
				intOrPtr _v72;
				void* _v76;
				int _v80;
				signed int _v84;
				signed int _v88;
				void* _v92;
				signed char _v120;
				intOrPtr _v124;
				int _v128;
				int _v132;
				intOrPtr _v136;
				intOrPtr _v148;
				intOrPtr _v152;
				void _v156;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t208;
				signed int _t213;
				signed int _t222;
				void* _t225;
				signed char _t226;
				signed short _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed short _t241;
				void* _t243;
				signed int _t244;
				signed int _t247;
				signed int _t248;
				void* _t251;
				signed int _t252;
				signed char _t265;
				void* _t270;
				signed int _t271;
				unsigned int _t278;
				signed int _t280;
				void* _t288;
				void* _t291;
				signed int _t292;
				unsigned int _t298;
				void* _t304;
				signed int _t305;
				unsigned int _t316;
				signed short _t319;
				signed char _t323;
				signed int _t328;
				int _t329;
				short* _t331;
				intOrPtr _t334;
				signed short _t335;
				signed int _t336;
				intOrPtr _t337;
				signed int _t339;
				intOrPtr _t340;
				signed int _t341;
				intOrPtr _t344;
				intOrPtr _t351;
				signed short _t353;
				intOrPtr _t356;
				signed short* _t357;
				void* _t362;
				unsigned int _t364;
				signed short _t366;
				signed int _t367;
				int _t368;
				intOrPtr* _t369;
				signed int _t370;
				signed int _t371;
				signed short* _t372;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				void* _t378;
				void* _t379;

				_t361 = __edx;
				_v12 =  *0x6e03d360 ^ _t377;
				_t329 = _a12;
				_v60 = _a4;
				_t369 = __ecx;
				_v88 = _a8;
				_v45 = __edx;
				_v160 = 0x40;
				memset( &_v156, 0, 0x3c);
				_t379 = _t378 + 0xc;
				_v76 =  *_t369;
				_t368 = 0;
				_v72 =  *((intOrPtr*)(_t369 + 4));
				_t208 =  &_v16;
				_v32 = _t208;
				_v28 = _t208;
				_v36 = _t208;
				_v16 = 0;
				_v52 = 0;
				_v24 = 2;
				_v20 = 2;
				_v40 = 0x20000;
				_t370 = E6DF62D50(3, 0, 2,  &_v76,  &_v160);
				if(_t370 >= 0) {
					__eflags = _v45;
					if(_v45 != 0) {
						_t370 = 0;
						L2:
						_t213 = _v32;
						_t331 = _v28;
						if(_t213 != 0) {
							if(_t213 != _t331) {
								_v88 = _t213;
								RtlFreeUnicodeString( &_v92);
								_t331 = _v28;
							}
							_v32 = _t331;
							_v24 = _v20;
						}
						_v36 = _t331;
						if(_t331 != 0) {
							 *_t331 = 0;
						}
						_v40 = 0;
						_v38 = _v20;
						if(_t368 != 0) {
							E6DF79B10(_t368);
						}
						return E6DF8B640(_t370, _t329, _v12 ^ _t377, _t361, _t368, _t370);
					}
					__eflags = _v148 - 0x14;
					_t368 = _v128;
					if(_v148 < 0x14) {
						L57:
						_t370 = 0xc0150003;
						goto L2;
					}
					__eflags = _v156 - 1;
					if(_v156 != 1) {
						goto L57;
					}
					_t334 = _v152;
					_t361 =  *(_t334 + 0x10);
					__eflags = _t361 - _v132;
					if(_t361 > _v132) {
						goto L57;
					}
					_t222 =  *(_t334 + 0xc);
					__eflags = _t222 - 0x1fffffff;
					if(_t222 > 0x1fffffff) {
						goto L57;
					}
					_t371 = _t222 * 8;
					__eflags = _t361 -  !_t371;
					if(_t361 >  !_t371) {
						goto L57;
					}
					_t225 = _t371 + _t361;
					_t361 = _v132;
					__eflags = _t225 - _t361;
					if(_t225 > _t361) {
						goto L57;
					}
					_t226 =  *(_t334 + 4);
					__eflags = _t226 & 0x00000002;
					if((_t226 & 0x00000002) == 0) {
						L22:
						_t372 = _v60;
						_v56 =  *(_t334 + 0x10) + _v136;
						_v64 = 0;
						 *_t372 = 0;
						_t335 = 0;
						_v48 =  *(_t334 + 0xc);
						_t230 = 0;
						__eflags = _v48;
						if(_v48 != 0) {
							_t231 = 0;
							__eflags = 0;
							while(1) {
								_t336 = _t231 * 8;
								_t232 = _v56;
								_v44 = _t336;
								_t337 =  *((intOrPtr*)(_t336 + _t232 + 4));
								__eflags = _t337 - _t361;
								if(_t337 > _t361) {
									goto L57;
								}
								_t233 =  *(_v44 + _t232);
								_t372 = _v60;
								_v44 = _t233;
								__eflags = _t337 -  !_t233;
								if(_t337 >  !_t233) {
									goto L57;
								}
								__eflags = _v44 + _t337 - _t361;
								if(_v44 + _t337 > _t361) {
									goto L57;
								}
								_t335 = (_v44 & 0x0000ffff) +  *_t372;
								_v44 = _t335 & 0x0000ffff;
								_t231 = _v64 + 1;
								 *_t372 = _t335;
								_v64 = _t231;
								__eflags = _t231 - _v48;
								if(_t231 != _v48) {
									continue;
								}
								_t230 = _v44 & 0x0000ffff;
								goto L23;
							}
							goto L57;
						}
						L23:
						_t361 = _v52;
						_t241 = _t230 & 0x0000ffff;
						__eflags = _t361;
						if(_t361 != 0) {
							_t319 = ( *_t361 & 0x0000ffff) + _t335;
							__eflags = _t319;
							 *_t372 = _t319;
							_t241 = _t319 & 0x0000ffff;
						}
						_t243 = (_t241 & 0x0000ffff) + 2;
						__eflags = _t243 - 0xfffe;
						if(_t243 > 0xfffe) {
							_t370 = 0xc0000106;
							goto L2;
						} else {
							_t339 = _t329 + 8;
							__eflags = _t339;
							if(_t339 == 0) {
								L28:
								_t244 = E6DF7D690(0, _t339, _t243);
								__eflags = _t244;
								if(_t244 < 0) {
									L69:
									_t370 = 0xc0000017;
									goto L2;
								}
								_t361 = _v52;
								_t339 = _t329 + 8;
								L30:
								 *((intOrPtr*)(_t329 + 4)) =  *_t339;
								 *((short*)(_t329 + 2)) =  *((intOrPtr*)(_t329 + 0x10));
								__eflags = _t361;
								if(_t361 == 0) {
									L35:
									_t247 = 0;
									_v44 = 0;
									__eflags = _v48;
									if(_v48 != 0) {
										while(1) {
											_t362 = _v56;
											_t248 =  *(_t362 + _t247 * 8) & 0x0000ffff;
											_t375 = _t248;
											_t361 =  *((intOrPtr*)(_t362 + 4 + _v44 * 8)) + _v136;
											_v68 = _t248;
											_v84 = _t248;
											_v80 = _t375;
											_t251 = ( *_t329 & 0x0000ffff) + 2 + _t375;
											_v64 = _t361;
											_t372 = _v60;
											__eflags = _t251 - 0xfffe;
											if(_t251 > 0xfffe) {
												break;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L77:
												_t252 = E6DF7D690(0, _t339, _t251);
												__eflags = _t252;
												if(_t252 < 0) {
													goto L69;
												}
												_t361 = _v64;
												_t339 = _t329 + 8;
												L79:
												_t340 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t340;
												memmove(_t340 + (( *_t329 & 0x0000ffff) >> 1) * 2, _t361, _v80);
												_t341 =  *_t329 & 0x0000ffff;
												_t379 = _t379 + 0xc;
												_t364 = _v84 + _t341 & 0x0000ffff;
												 *_t329 = _t364;
												 *((short*)(_t329 + 2)) = _v68 + 2 + _t341;
												_t361 = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t364 >> 1) * 2)) = 0;
												_t339 = _t329 + 8;
												_t247 = _v44 + 1;
												_v44 = _t247;
												__eflags = _t247 - _v48;
												if(_t247 != _v48) {
													continue;
												}
												goto L36;
											}
											__eflags = _t251 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t251 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L79;
											}
											goto L77;
										}
										L85:
										_t370 = 0xc0000106;
										goto L2;
									}
									L36:
									_t265 =  *(_v152 + 4);
									__eflags = _t265 & 0x00000001;
									if((_t265 & 0x00000001) != 0) {
										L46:
										__eflags = _t265 & 0x00000004;
										if(__eflags != 0) {
											_t361 = _t329;
											_push( &_v40);
											_t370 = E6DFD3F4D(_t329, _t329, _t368, _t372, __eflags);
											__eflags = _t370;
											if(_t370 < 0) {
												goto L2;
											}
											_t361 = _v40;
											 *_t329 = 0;
											_t270 = (_t361 & 0x0000ffff) + 2;
											__eflags = _t270 - 0xfffe;
											if(_t270 <= 0xfffe) {
												_t376 = _t329 + 8;
												__eflags = _t376;
												if(_t376 == 0) {
													L93:
													_t271 = E6DF7D690(0, _t376, _t270);
													__eflags = _t271;
													if(_t271 >= 0) {
														_t361 = _v40;
														L96:
														_t344 =  *_t376;
														 *((intOrPtr*)(_t329 + 4)) = _t344;
														memmove(_t344 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v36, _t361 & 0x0000ffff);
														_t192 = ( *_t329 & 0x0000ffff) + _v40 + 2; // 0x20002
														 *((short*)(_t329 + 2)) = _t192;
														_t278 = ( *_t329 & 0x0000ffff) + _v40 & 0x0000ffff;
														 *_t329 = _t278;
														_t361 = 0;
														 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t278 >> 1) * 2)) = 0;
														goto L47;
													}
													_t370 = 0xc0000017;
													goto L2;
												}
												__eflags = _t270 -  *((intOrPtr*)(_t329 + 0x10));
												if(_t270 <=  *((intOrPtr*)(_t329 + 0x10))) {
													goto L96;
												}
												goto L93;
											}
											_t370 = 0xc0000106;
											goto L2;
										}
										L47:
										_t280 = _v88;
										__eflags = _t280;
										if(_t280 != 0) {
											 *_t280 =  *_t280 | 0x00000002;
										}
										_t370 = 0;
										goto L2;
									}
									__eflags = _t265 & 0x00000008;
									if((_t265 & 0x00000008) != 0) {
										_t370 = E6DF63690(1,  &_v76, 0x6df21810,  &_v48);
										__eflags = _t370;
										if(_t370 >= 0) {
											_t366 = _v76 + 0xfffe - _v48;
											_t372 = _v60;
											_t288 = _v72 + ((_v48 & 0x0000ffff) >> 1) * 2 + 2;
											_t339 = _t329 + 8;
											L39:
											_v46 = _t366;
											_t361 = _t366 & 0x0000ffff;
											 *_t372 =  *_t372 + _t361;
											__eflags =  *_t372 - 0xffff;
											_v56 = _t288;
											_v68 = _t361;
											if( *_t372 >= 0xffff) {
												goto L85;
											}
											_t291 = ( *_t329 & 0x0000ffff) + 2 + _t361;
											__eflags = _t291 - 0xfffe;
											if(_t291 > 0xfffe) {
												_t370 = 0xc0000106;
												goto L2;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L43:
												_t292 = E6DF7D690(0, _t339, _t291);
												__eflags = _t292;
												if(_t292 < 0) {
													_t370 = 0xc0000017;
													goto L2;
												}
												_t361 = _v68;
												_t339 = _t329 + 8;
												L45:
												_t351 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t351;
												memmove(_t351 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v56, _t361);
												_t379 = _t379 + 0xc;
												_t353 = ( *_t329 & 0x0000ffff) + _v46;
												 *((short*)(_t329 + 2)) = _t353 + 2;
												_t298 = _t353 & 0x0000ffff;
												 *_t329 = _t298;
												_t361 = 0;
												__eflags = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t298 >> 1) * 2)) = 0;
												_t265 =  *(_v152 + 4);
												goto L46;
											}
											__eflags = _t291 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t291 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L45;
											}
											goto L43;
										}
										__eflags = _t370 - 0xc0000225;
										if(_t370 == 0xc0000225) {
											E6DFE5100(_t339, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x477, "Status != STATUS_NOT_FOUND");
											_t370 = 0xc00000e5;
										}
										goto L2;
									}
									_t288 = _v72;
									_t366 = _v76;
									goto L39;
								}
								 *_t329 = 0;
								_t304 = ( *_t361 & 0x0000ffff) + 2;
								__eflags = _t304 - 0xfffe;
								if(_t304 > 0xfffe) {
									_t370 = 0xc0000106;
									goto L2;
								}
								__eflags = _t339;
								if(_t339 == 0) {
									L71:
									_t305 = E6DF7D690(0, _t339, _t304);
									__eflags = _t305;
									if(_t305 >= 0) {
										_t361 = _v52;
										_t339 = _t329 + 8;
										L34:
										_t356 =  *_t339;
										 *((intOrPtr*)(_t329 + 4)) = _t356;
										memmove(_t356 + (( *_t329 & 0x0000ffff) >> 1) * 2,  *(_t361 + 4),  *_t361 & 0x0000ffff);
										_t357 = _v52;
										_t379 = _t379 + 0xc;
										_t367 =  *_t329 & 0x0000ffff;
										 *((short*)(_t329 + 2)) = ( *_t357 & 0x0000ffff) + 2 + _t367;
										_t316 = ( *_t357 & 0x0000ffff) + _t367 & 0x0000ffff;
										 *_t329 = _t316;
										_t361 = 0;
										__eflags = 0;
										 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t316 >> 1) * 2)) = 0;
										_t339 = _t329 + 8;
										goto L35;
									}
									_t370 = 0xc0000017;
									goto L2;
								}
								__eflags = _t304 -  *((intOrPtr*)(_t329 + 0x10));
								if(_t304 >  *((intOrPtr*)(_t329 + 0x10))) {
									goto L71;
								}
								goto L34;
							}
							__eflags = _t243 -  *((intOrPtr*)(_t329 + 0x10));
							if(_t243 <=  *((intOrPtr*)(_t329 + 0x10))) {
								goto L30;
							}
							goto L28;
						}
					}
					_t360 = 0;
					_v44 = 0;
					__eflags = _t226 & 0x00000004;
					if((_t226 & 0x00000004) != 0) {
						_push("sxsisol_SearchActCtxForDllName");
						_push( *((intOrPtr*)( *[fs:0x18] + 0x24)));
						E6DFD5720(0x33, 0, "[%x.%x] SXS: %s - Relative redirection plus env var expansion.\n",  *((intOrPtr*)( *[fs:0x18] + 0x20)));
						goto L57;
					}
					_t323 = _v120;
					__eflags = _t323 & 0x00000001;
					if((_t323 & 0x00000001) != 0) {
						__eflags = _t323 & 0x00000002;
						if((_t323 & 0x00000002) != 0) {
							E6DFE5100(0, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x41b, "!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)");
							_t370 = 0xc00000e5;
							goto L2;
						}
						_t360 = 1;
					}
					__eflags = _t323 & 0x00000002;
					if((_t323 & 0x00000002) != 0) {
						_t360 = _t360 | 0x00000002;
					}
					_t361 = _t368;
					_t370 = E6DF7C63D(_t360, _t368, _v124,  &_v52, _t360,  &_v44);
					__eflags = _t370;
					if(_t370 < 0) {
						__eflags = _t370 - 0xc0000120;
						if(_t370 == 0xc0000120) {
							_t328 = _v44;
							__eflags = _t328;
							if(_t328 < 0) {
								_t370 = _t328;
							}
						}
						goto L2;
					} else {
						_t334 = _v152;
						_t361 = _v132;
						goto L22;
					}
				}
				if(_t370 == 0xc0150001) {
					_t370 = 0xc0150008;
				}
				goto L2;
			}

0x6df62990
0x6df629a2
0x6df629a9
0x6df629ae
0x6df629b1
0x6df629b8
0x6df629c4
0x6df629c7
0x6df629d1
0x6df629d8
0x6df629db
0x6df629de
0x6df629e3
0x6df629e6
0x6df629e9
0x6df629ec
0x6df629ef
0x6df629f4
0x6df62a02
0x6df62a0b
0x6df62a12
0x6df62a19
0x6df62a25
0x6df62a29
0x6df62a89
0x6df62a8d
0x6dfad3f9
0x6df62a37
0x6df62a37
0x6df62a3a
0x6df62a3f
0x6df62a43
0x6dfad6ed
0x6dfad6f4
0x6dfad6f9
0x6dfad6f9
0x6df62a4c
0x6df62a4f
0x6df62a4f
0x6df62a52
0x6df62a57
0x6df62a5b
0x6df62a5b
0x6df62a60
0x6df62a68
0x6df62a6e
0x6df62d15
0x6df62d15
0x6df62a86
0x6df62a86
0x6df62a93
0x6df62a9a
0x6df62a9d
0x6dfad428
0x6dfad428
0x00000000
0x6dfad428
0x6df62aa3
0x6df62aaa
0x00000000
0x00000000
0x6df62ab0
0x6df62ab6
0x6df62ab9
0x6df62abc
0x00000000
0x00000000
0x6df62ac2
0x6df62ac5
0x6df62aca
0x00000000
0x00000000
0x6df62ad0
0x6df62adb
0x6df62add
0x00000000
0x00000000
0x6df62ae3
0x6df62ae6
0x6df62ae9
0x6df62aeb
0x00000000
0x00000000
0x6df62af1
0x6df62af4
0x6df62af6
0x6df62b42
0x6df62b4b
0x6df62b4e
0x6df62b51
0x6df62b58
0x6df62b61
0x6df62b63
0x6df62b66
0x6df62b68
0x6df62b6b
0x6dfad473
0x6dfad473
0x6dfad475
0x6dfad475
0x6dfad47c
0x6dfad47f
0x6dfad482
0x6dfad486
0x6dfad488
0x00000000
0x00000000
0x6dfad48d
0x6dfad490
0x6dfad493
0x6dfad498
0x6dfad49a
0x00000000
0x00000000
0x6dfad4a1
0x6dfad4a3
0x00000000
0x00000000
0x6dfad4ab
0x6dfad4b0
0x6dfad4b6
0x6dfad4b7
0x6dfad4b9
0x6dfad4bc
0x6dfad4bf
0x00000000
0x00000000
0x6dfad4c4
0x00000000
0x6dfad4c4
0x00000000
0x6dfad475
0x6df62b71
0x6df62b71
0x6df62b74
0x6df62b77
0x6df62b79
0x6df62b7e
0x6df62b7e
0x6df62b80
0x6df62b82
0x6df62b82
0x6df62b88
0x6df62b8b
0x6df62b90
0x6dfad4cc
0x00000000
0x6df62b96
0x6df62b96
0x6df62b99
0x6df62b9b
0x6df62ba2
0x6df62ba6
0x6df62bab
0x6df62bad
0x6dfad4d6
0x6dfad4d6
0x00000000
0x6dfad4d6
0x6df62bb3
0x6df62bb6
0x6df62bb9
0x6df62bbb
0x6df62bc2
0x6df62bc6
0x6df62bc8
0x6df62c3e
0x6df62c3e
0x6df62c40
0x6df62c43
0x6df62c46
0x6dfad50c
0x6dfad50c
0x6dfad512
0x6dfad51a
0x6dfad51c
0x6dfad522
0x6dfad525
0x6dfad52e
0x6dfad531
0x6dfad533
0x6dfad536
0x6dfad539
0x6dfad53e
0x00000000
0x00000000
0x6dfad544
0x6dfad546
0x6dfad54d
0x6dfad551
0x6dfad556
0x6dfad558
0x00000000
0x00000000
0x6dfad55e
0x6dfad561
0x6dfad564
0x6dfad567
0x6dfad56f
0x6dfad576
0x6dfad57b
0x6dfad57e
0x6dfad586
0x6dfad58f
0x6dfad596
0x6dfad59a
0x6dfad5a1
0x6dfad5a5
0x6dfad5ab
0x6dfad5ac
0x6dfad5af
0x6dfad5b2
0x00000000
0x00000000
0x00000000
0x6dfad5b8
0x6dfad548
0x6dfad54b
0x00000000
0x00000000
0x00000000
0x6dfad54b
0x6dfad630
0x6dfad630
0x00000000
0x6dfad630
0x6df62c4c
0x6df62c52
0x6df62c55
0x6df62c57
0x6df62cfe
0x6df62cfe
0x6df62d00
0x6dfad651
0x6dfad653
0x6dfad659
0x6dfad65b
0x6dfad65d
0x00000000
0x00000000
0x6dfad663
0x6dfad669
0x6dfad66f
0x6dfad672
0x6dfad677
0x6dfad683
0x6dfad686
0x6dfad688
0x6dfad68f
0x6dfad693
0x6dfad698
0x6dfad69a
0x6dfad6a6
0x6dfad6aa
0x6dfad6aa
0x6dfad6b8
0x6dfad6bf
0x6dfad6ce
0x6dfad6d1
0x6dfad6d5
0x6dfad6da
0x6dfad6e2
0x6dfad6e4
0x00000000
0x6dfad6e4
0x6dfad69c
0x00000000
0x6dfad69c
0x6dfad68a
0x6dfad68d
0x00000000
0x00000000
0x00000000
0x6dfad68d
0x6dfad679
0x00000000
0x6dfad679
0x6df62d06
0x6df62d06
0x6df62d09
0x6df62d0b
0x6df62d39
0x6df62d39
0x6df62d0d
0x00000000
0x6df62d0d
0x6df62c5d
0x6df62c5f
0x6dfad5d1
0x6dfad5d3
0x6dfad5d5
0x6dfad617
0x6dfad61d
0x6dfad625
0x6dfad628
0x6df62c6c
0x6df62c6c
0x6df62c70
0x6df62c73
0x6df62c75
0x6df62c7b
0x6df62c7e
0x6df62c81
0x00000000
0x00000000
0x6df62c8d
0x6df62c8f
0x6df62c94
0x6dfad63a
0x00000000
0x6dfad63a
0x6df62c9a
0x6df62c9c
0x6df62ca3
0x6df62ca7
0x6df62cac
0x6df62cae
0x6dfad644
0x00000000
0x6dfad644
0x6df62cb4
0x6df62cb7
0x6df62cba
0x6df62cbd
0x6df62cc5
0x6df62ccc
0x6df62cd4
0x6df62cd7
0x6df62cde
0x6df62ce2
0x6df62ce7
0x6df62cef
0x6df62cef
0x6df62cf1
0x6df62cfb
0x00000000
0x6df62cfb
0x6df62c9e
0x6df62ca1
0x00000000
0x00000000
0x00000000
0x6df62ca1
0x6dfad5d7
0x6dfad5dd
0x6dfad5f7
0x6dfad5fc
0x6dfad5fc
0x00000000
0x6dfad5dd
0x6df62c65
0x6df62c68
0x00000000
0x6df62c68
0x6df62bcc
0x6df62bd2
0x6df62bd5
0x6df62bda
0x6dfad4e0
0x00000000
0x6dfad4e0
0x6df62be0
0x6df62be2
0x6dfad4ea
0x6dfad4ee
0x6dfad4f3
0x6dfad4f5
0x6dfad501
0x6dfad504
0x6df62bf1
0x6df62bf1
0x6df62bf3
0x6df62c06
0x6df62c0b
0x6df62c0e
0x6df62c11
0x6df62c1e
0x6df62c28
0x6df62c2d
0x6df62c35
0x6df62c35
0x6df62c37
0x6df62c3b
0x00000000
0x6df62c3b
0x6dfad4f7
0x00000000
0x6dfad4f7
0x6df62be8
0x6df62beb
0x00000000
0x00000000
0x00000000
0x6df62beb
0x6df62b9d
0x6df62ba0
0x00000000
0x00000000
0x00000000
0x6df62ba0
0x6df62b90
0x6df62af8
0x6df62afa
0x6df62b01
0x6df62b03
0x6dfad406
0x6dfad40b
0x6dfad420
0x00000000
0x6dfad425
0x6df62b09
0x6df62b0c
0x6df62b0e
0x6df62d27
0x6df62d29
0x6dfad446
0x6dfad44b
0x00000000
0x6dfad44b
0x6df62d2f
0x6df62d2f
0x6df62b14
0x6df62b16
0x6df62d1f
0x6df62d1f
0x6df62b1f
0x6df62b2f
0x6df62b31
0x6df62b33
0x6dfad455
0x6dfad45b
0x6dfad461
0x6dfad464
0x6dfad466
0x6dfad46c
0x6dfad46c
0x6dfad466
0x00000000
0x6df62b39
0x6df62b39
0x6df62b3f
0x00000000
0x6df62b3f
0x6df62b33
0x6df62a31
0x6dfad3ef
0x6dfad3ef
0x00000000

APIs

memset.9419(?,00000000,0000003C,?,00000000,?), ref: 6DF629D1
RtlFindActivationContextSectionString.9419(00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6DF62A20
RtlpEnsureBufferSize.9419(00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6DF62BA6
memmove.9419(6DF24F84,00000000,6DF24F84,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6DF62C06
RtlpEnsureBufferSize.9419(00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6DF62CA7
memmove.9419(00000000,00000001,00000000,00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000), ref: 6DF62CCC
RtlReleaseActivationContext.9419(?,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6DF62D15
RtlpEnsureBufferSize.9419(00000000,?,-00000002,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6DFAD4EE

Strings

sxsisol_SearchActCtxForDllName, xrefs: 6DFAD406
Internal error check failed, xrefs: 6DFAD441, 6DFAD5F2
!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT), xrefs: 6DFAD432
[%x.%x] SXS: %s - Relative redirection plus env var expansion., xrefs: 6DFAD417
@, xrefs: 6DF629C7
minkernel\ntdll\sxsisol.cpp, xrefs: 6DFAD43C, 6DFAD5ED
Status != STATUS_NOT_FOUND, xrefs: 6DFAD5E3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureRtlpSize$ActivationContextmemmove$FindReleaseSectionStringmemset
String ID: !(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)$@$Internal error check failed$Status != STATUS_NOT_FOUND$[%x.%x] SXS: %s - Relative redirection plus env var expansion.$minkernel\ntdll\sxsisol.cpp$sxsisol_SearchActCtxForDllName
API String ID: 2718660278-761764676
Opcode ID: 8fb161a6e95ee9ef09a33f5d4cffaa36b0cb879c9784881d04dec72c6d8b3137
Instruction ID: 40fc64558d26197b62aeeed0e94b972fc4053ce30bfc06fd321ce3b9eff6cc52
Opcode Fuzzy Hash: 8fb161a6e95ee9ef09a33f5d4cffaa36b0cb879c9784881d04dec72c6d8b3137
Instruction Fuzzy Hash: 62126D71A04269DFDB24CF9CC880AEDB7F1FF49314F19806AE849EB650E7759941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7CF6A, Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 321
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DF7CF6A(signed short* __edx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, signed short _a16, signed int* _a20) {
				signed int _v12;
				char _v536;
				signed int _v537;
				signed int* _v544;
				signed int _v548;
				intOrPtr _v552;
				void* _v556;
				signed short _v560;
				signed short _v564;
				char _v568;
				signed short* _v572;
				signed short* _v576;
				intOrPtr _v580;
				signed short _v584;
				void* _v588;
				signed short _v592;
				void* _v596;
				intOrPtr _v600;
				signed short _v604;
				char _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				intOrPtr _v628;
				char _v632;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t101;
				void* _t103;
				signed short _t113;
				signed short _t116;
				void _t119;
				char _t129;
				intOrPtr _t131;
				void* _t137;
				intOrPtr _t145;
				short* _t147;
				signed int _t157;
				signed short* _t159;
				void* _t160;
				signed short* _t161;
				signed short _t165;
				intOrPtr _t166;
				signed short _t169;
				intOrPtr _t172;
				void* _t173;
				intOrPtr _t174;
				short _t175;
				void* _t181;
				void* _t189;
				void* _t190;
				signed short* _t192;
				void* _t193;
				void* _t194;
				void* _t197;
				signed short _t199;
				signed int _t200;

				_v12 =  *0x6e03d360 ^ _t200;
				_t101 = _a8;
				_t166 = _a12;
				_v576 = __edx;
				_v584 = _a16;
				_t192 = _a4;
				_v544 = _a20;
				_v548 = _v548 & 0;
				_t189 = 0;
				_v560 = 0;
				_v537 = 0;
				_v568 = 0;
				_v564 = 0;
				_v588 = 0;
				_t187 = _v584;
				_v572 = _t192;
				_v580 = _t101;
				_v552 = _t166;
				_v556 = 0;
				if(_t187 != 0) {
					 *_t187 =  *_t187 & 0;
				}
				_t159 = _v576;
				if(_v544 != _t189) {
					 *_v544 =  *_v544 & _t189;
					_t166 = _v552;
				}
				if(_t159 == 0 || _t192 == 0 || _t101 == 0 || _t166 == 0 || _t187 == 0 || _v544 == _t189) {
					_push(_v544);
					_push(_t187);
					_push(_t166);
					_push(_t101);
					_push(_t192);
					_push(_t159);
					_push(0);
					E6DFD5720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Flags:               0x%lx\nSXS:  Root:                %p\nSXS:  AssemblyDirectory:   %p\nSXS:  PreAllocatedString:  %p\nSXS:  DynamicString:       %p\nSXS:  StringUsed:          %p\nSXS:  OpenDirectoryHandle: %p\n", "RtlpProbeAssemblyStorageRootForAssembly");
					_t193 = 0xc000000d;
					goto L24;
				} else {
					_t169 =  *_t159 & 0x0000ffff;
					_t187 = _t169;
					if(_t169 != 0) {
						_t157 =  *(_t159[2] + (_t169 >> 1) * 2 - 2) & 0x0000ffff;
						_t181 = 0x5c;
						_t169 =  *_t159 & 0x0000ffff;
						if(_t157 != _t181) {
							if(_t157 != 0x2f) {
								_v537 = 1;
								_t187 = _t187 + 2;
							}
						}
					}
					_t113 = ( *_t192 & 0x0000ffff) + 4 + _t187;
					_v592 = _t113;
					if(_t113 > 0xfffe) {
						_push("SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.\n");
						_push(0);
						_push(0x33);
						E6DFD5720();
						_t193 = 0xc0000106;
						L26:
						if(_t189 != 0 && _t189 !=  &_v536) {
							E6DF4AD30(_t189);
						}
						L28:
						if(_v548 != 0) {
							_push(_v548);
							E6DF895D0();
						}
						_pop(_t190);
						_pop(_t194);
						_pop(_t160);
						return E6DF8B640(_t193, _t160, _v12 ^ _t200, _t187, _t190, _t194);
					}
					if(_t113 > 0x208) {
						_t195 = _t113 & 0x0000ffff;
						_t189 = E6DF63A1C(_t113 & 0x0000ffff);
						_v556 = _t189;
						if(_t189 != 0) {
							_t116 =  *_t159 & 0x0000ffff;
							goto L15;
						}
						E6DFD5720(0x33, _t115, "SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.\n", _t195);
						_t193 = 0xc0000017;
						goto L28;
					} else {
						_t189 =  &_v536;
						_t116 = _t169 & 0x0000ffff;
						_v556 = _t189;
						L15:
						memcpy(_t189, _t159[2], _t116 & 0x0000ffff);
						_t197 = _t189 + ( *_t159 & 0x0000ffff);
						if(_v537 != 0) {
							_t119 = 0x5c;
							 *_t197 = _t119;
							_t197 = _t197 + 2;
						}
						_t161 = _v572;
						memcpy(_t197, _t161[2],  *_t161 & 0x0000ffff);
						 *((short*)(_t197 + ( *_t161 & 0x0000ffff))) = 0;
						_t165 = (_v537 & 0x000000ff) + (_v537 & 0x000000ff) +  *_v572 +  *_v576;
						_v560 = _t165;
						if(E6DF56A00(_t189,  &_v568, 0,  &_v608) == 0) {
							E6DFD5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n", _t189);
							_t193 = 0xc000003a;
							goto L26;
						} else {
							_t129 = _v608;
							_t187 = _v564;
							_v588 = _v564;
							if(_t129 != 0) {
								_v568 = _t129;
								_v564 = _v604;
								_t131 = _v600;
							} else {
								_t131 = 0;
							}
							_v628 = _t131;
							_push(0x21);
							_v624 =  &_v568;
							_push(3);
							_push( &_v640);
							_v632 = 0x18;
							_push( &_v632);
							_push(0x100020);
							_v620 = 0x40;
							_push( &_v548);
							_v616 = 0;
							_v612 = 0;
							_t193 = E6DF89830();
							_t137 = _v596;
							if(_t137 != 0) {
								asm("lock xadd [eax], ecx");
								if(0xffffffff == 0) {
									_push( *((intOrPtr*)(_t137 + 4)));
									E6DF895D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v596);
									_t189 = _v556;
									_t165 = _v560;
								}
							}
							if(_t193 < 0) {
								if(_t193 == 0xc000000f || _t193 == 0xc0000034 || _t193 == 0xc000003a) {
									_t193 = 0xc0150004;
								} else {
									_push(_t193);
									E6DFD5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n", _t189);
								}
								goto L24;
							} else {
								_t172 = _v580;
								_t199 = _v592;
								if(_t199 > ( *(_t172 + 2) & 0x0000ffff)) {
									if(_t189 ==  &_v536) {
										_t173 = E6DF63A1C(_t199);
										 *(_v552 + 4) = _t173;
										if(_t173 != 0) {
											memcpy(_t173, _t189, _t165 & 0x0000ffff);
											_t145 = _v552;
											L52:
											 *(_t145 + 2) = _t199;
											_t174 = _t145;
											goto L23;
										}
										_t193 = 0xc0000017;
										goto L24;
									}
									_t145 = _v552;
									 *(_t145 + 4) = _t189;
									_t189 = 0;
									_v556 = 0;
									goto L52;
								} else {
									memcpy( *(_t172 + 4), _t189, _t165 & 0x0000ffff);
									_t174 = _v580;
									L23:
									_t187 = _v584;
									 *_t187 = _t174;
									_t147 = (_t165 & 0x0000ffff) +  *((intOrPtr*)(_t174 + 4));
									_t175 = 0x5c;
									 *_t147 = _t175;
									 *((short*)(_t147 + 2)) = 0;
									 *( *_t187) = _v560 + 2;
									_v548 = _v548 & 0x00000000;
									_t193 = 0;
									 *_v544 = _v548;
									L24:
									_t103 = _v588;
									if(_t103 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t103);
										_t189 = _v556;
									}
									goto L26;
								}
							}
						}
					}
				}
			}

0x6df7cf7c
0x6df7cf7f
0x6df7cf82
0x6df7cf85
0x6df7cf8e
0x6df7cf99
0x6df7cf9c
0x6df7cfa4
0x6df7cfab
0x6df7cfad
0x6df7cfb3
0x6df7cfb9
0x6df7cfbf
0x6df7cfc5
0x6df7cfcb
0x6df7cfd1
0x6df7cfd7
0x6df7cfdd
0x6df7cfe3
0x6df7cfeb
0x6df7cfed
0x6df7cfed
0x6df7cfef
0x6df7cffb
0x6df7d003
0x6df7d005
0x6df7d005
0x6df7d00d
0x6dfbafc1
0x6dfbafc7
0x6dfbafc8
0x6dfbafc9
0x6dfbafca
0x6dfbafcb
0x6dfbafcc
0x6dfbafdc
0x6dfbafe4
0x00000000
0x6df7d03f
0x6df7d03f
0x6df7d042
0x6df7d047
0x6df7d050
0x6df7d055
0x6df7d059
0x6df7d05c
0x6dfbae41
0x6dfbae47
0x6dfbae4e
0x6dfbae4e
0x6dfbae41
0x6df7d05c
0x6df7d068
0x6df7d06a
0x6df7d075
0x6dfbae56
0x6dfbae5b
0x6dfbae5d
0x6dfbae5f
0x6dfbae67
0x6df7d230
0x6df7d232
0x6df7d261
0x6df7d261
0x6df7d23e
0x6df7d245
0x6dfbafee
0x6dfbaff4
0x6dfbaff4
0x6df7d250
0x6df7d251
0x6df7d254
0x6df7d25d
0x6df7d25d
0x6df7d080
0x6dfbae71
0x6dfbae7a
0x6dfbae7c
0x6dfbae84
0x6dfbaea1
0x00000000
0x6dfbaea1
0x6dfbae8f
0x6dfbae97
0x00000000
0x6df7d086
0x6df7d086
0x6df7d08c
0x6df7d08f
0x6df7d095
0x6df7d09d
0x6df7d0a8
0x6df7d0b1
0x6dfbaeab
0x6dfbaeac
0x6dfbaeaf
0x6dfbaeaf
0x6df7d0b7
0x6df7d0c5
0x6df7d0dc
0x6df7d0f1
0x6df7d102
0x6df7d112
0x6dfbaec0
0x6dfbaec8
0x00000000
0x6df7d118
0x6df7d118
0x6df7d11e
0x6df7d124
0x6df7d12d
0x6dfbaed2
0x6dfbaede
0x6dfbaee4
0x6df7d133
0x6df7d133
0x6df7d133
0x6df7d135
0x6df7d141
0x6df7d143
0x6df7d14f
0x6df7d151
0x6df7d158
0x6df7d162
0x6df7d163
0x6df7d16e
0x6df7d178
0x6df7d179
0x6df7d17f
0x6df7d18a
0x6df7d18c
0x6df7d194
0x6dfbaef2
0x6dfbaef6
0x6dfbaefc
0x6dfbaeff
0x6dfbaf15
0x6dfbaf1a
0x6dfbaf20
0x6dfbaf20
0x6dfbaef6
0x6df7d19c
0x6dfbaf32
0x6dfbaf5c
0x6dfbaf44
0x6dfbaf44
0x6dfbaf4f
0x6dfbaf54
0x00000000
0x6df7d1a2
0x6df7d1a2
0x6df7d1a8
0x6df7d1b4
0x6dfbaf6e
0x6dfbaf89
0x6dfbaf91
0x6dfbaf96
0x6dfbafa8
0x6dfbafad
0x6dfbafb6
0x6dfbafb6
0x6dfbafba
0x00000000
0x6dfbafba
0x6dfbaf98
0x00000000
0x6dfbaf98
0x6dfbaf70
0x6dfbaf76
0x6dfbaf79
0x6dfbaf7b
0x00000000
0x6df7d1ba
0x6df7d1c2
0x6df7d1c7
0x6df7d1d0
0x6df7d1d0
0x6df7d1db
0x6df7d1dd
0x6df7d1e0
0x6df7d1e1
0x6df7d1e6
0x6df7d1f5
0x6df7d204
0x6df7d20b
0x6df7d20d
0x6df7d20f
0x6df7d20f
0x6df7d217
0x6df7d225
0x6df7d22a
0x6df7d22a
0x00000000
0x6df7d217
0x6df7d1b4
0x6df7d19c
0x6df7d112
0x6df7d080

APIs

memcpy.9419(?,00000010,?,00000040,?,?), ref: 6DF7D09D
memcpy.9419(00000000,00000010,00000000,00000040,?,?), ref: 6DF7D0C5
RtlDosPathNameToRelativeNtPathName_U.9419(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6DF7D10B
ZwOpenFile.9419(?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6DF7D185
memcpy.9419(00000010,?,?,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6DF7D1C2
RtlFreeHeap.9419(?,00000000,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6DF7D225
RtlDeleteBoundaryDescriptor.9419(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6DF7D261

Part of subcall function 6DF4AD30: RtlFreeHeap.9419(?,00000000,00000001,?,6DF702E9,00000000,?,6DF5ECFB,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?), ref: 6DF4AD43

ZwClose.9419(00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?), ref: 6DFBAEFF
RtlFreeHeap.9419(?,00000000,?,00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6DFBAF15

Strings

RtlpProbeAssemblyStorageRootForAssembly, xrefs: 6DFBAFCE
@, xrefs: 6DF7D16E
SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p, xrefs: 6DFBAFD3
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6DFBAEB8
SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed., xrefs: 6DFBAE87
SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING., xrefs: 6DFBAE56
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6DFBAF46

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeapmemcpy$Path$BoundaryCloseDeleteDescriptorFileNameName_OpenRelative
String ID: @$RtlpProbeAssemblyStorageRootForAssembly$SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p$SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.$SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx
API String ID: 1343436988-541586583
Opcode ID: f3cc1a2c7ec177cab9ca095de2a57c02badaa0dc112397a7c5c6137da2c1e440
Instruction ID: 7c05f03a41f9d3b9914df6dafc868396c0bd5a522e8aba01d5e1b31bb94b4142
Opcode Fuzzy Hash: f3cc1a2c7ec177cab9ca095de2a57c02badaa0dc112397a7c5c6137da2c1e440
Instruction Fuzzy Hash: 9DC19071945229EBDB219F1DDC84BEAB7F4EF85304F1540DAE808AB250D7708E81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF699BF, Relevance: 33.8, APIs: 16, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E6DF699BF(signed int __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				signed int _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E6DFFFA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E6E00A80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E6DF9D540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E6DF4B150();
										} else {
											E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E6DF4B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x6e036378 = 1;
											asm("int3");
											 *0x6e036378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E6DF6A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								E6DF6A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E6DF6BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E6E00A80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E6DF6A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								E6DF6A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E6DF9D540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E6DF4B150();
								} else {
									E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E6DF4B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x6e036378 = 1;
									asm("int3");
									 *0x6e036378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E6DFFFA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E6E00A80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E6DF9D540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E6DF4B150();
													} else {
														E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E6DF4B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x6e036378 = 1;
														asm("int3");
														 *0x6e036378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E6DF6A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										E6DF6A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E6DF6BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E6E00A80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E6DF9D540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E6DF4B150();
													} else {
														E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E6DF4B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x6e036378 = 1;
														asm("int3");
														 *0x6e036378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E6DF6A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										E6DF6A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E6DF6BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E6DF6BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x6df699ca
0x6df699cc
0x6df699df
0x6df699e3
0x6df699f8
0x6df699fb
0x6df699fb
0x00000000
0x6df69a48
0x6df69a48
0x6df69a4c
0x6df69a51
0x6df69a55
0x6df69a61
0x6df69a66
0x6df69a68
0x6dfb1457
0x6dfb145c
0x6dfb145c
0x6df69a68
0x6df69a6e
0x6df69a71
0x6df69a74
0x6df69a76
0x6dfb1466
0x6dfb1469
0x6dfb1469
0x6dfb146c
0x6dfb146e
0x6dfb1471
0x6dfb1474
0x6dfb1477
0x6dfb1479
0x6dfb159c
0x6dfb159c
0x6dfb159d
0x6dfb15a6
0x6dfb15ab
0x6dfb15ab
0x00000000
0x6dfb15ab
0x6dfb147f
0x6dfb1481
0x00000000
0x00000000
0x6dfb148a
0x6dfb148d
0x6dfb1493
0x6dfb1495
0x6dfb14c0
0x6dfb14c0
0x6dfb14c3
0x6dfb14c6
0x6dfb14c8
0x6dfb14cb
0x6dfb14cf
0x6dfb14f2
0x6dfb14f2
0x6dfb14f5
0x6dfb14f8
0x6dfb1501
0x6dfb1508
0x6dfb150b
0x6dfb150e
0x6dfb1510
0x6dfb1513
0x6dfb1515
0x6dfb1515
0x6dfb1518
0x6dfb1518
0x6dfb1513
0x6dfb1521
0x6dfb1525
0x6dfb152a
0x6dfb152d
0x6dfb1530
0x6dfb1532
0x6dfb1539
0x6dfb153d
0x6dfb155d
0x6dfb1562
0x6dfb153f
0x6dfb1555
0x6dfb155a
0x6dfb1570
0x6dfb1577
0x6dfb157c
0x6dfb1582
0x6dfb1585
0x6dfb1589
0x6dfb158b
0x6dfb1592
0x6dfb1593
0x6dfb1593
0x6dfb1589
0x6dfb1530
0x00000000
0x6dfb14f8
0x6dfb14d5
0x6dfb14da
0x6dfb14dc
0x00000000
0x6dfb14de
0x6dfb14e8
0x00000000
0x6dfb14e8
0x6dfb1497
0x6dfb1497
0x6dfb14a4
0x6dfb14a4
0x6dfb14a7
0x6dfb14a9
0x6dfb14ab
0x6dfb14ab
0x6dfb149c
0x6dfb149e
0x6dfb14a0
0x6dfb14b0
0x6dfb14b0
0x00000000
0x6dfb14a2
0x6dfb14a2
0x00000000
0x6dfb14a2
0x6dfb14a0
0x6dfb14b3
0x6dfb14bb
0x00000000
0x6dfb14bb
0x6dfb1495
0x6df69a7c
0x6df69a7c
0x6df69a7f
0x6df69a7f
0x6df69a82
0x6df69a84
0x6df69a87
0x6df69a8a
0x6df69a8d
0x6df69a8f
0x6dfb166a
0x6dfb166a
0x6dfb166b
0x6dfb1674
0x00000000
0x6dfb1674
0x6df69a95
0x6df69a97
0x00000000
0x00000000
0x6df69aa0
0x6df69aa3
0x6df69aa9
0x6df69aab
0x6df69ad7
0x6df69ad7
0x6df69ada
0x6df69add
0x6df69adf
0x6df69ae2
0x6df69ae6
0x6df69b22
0x6df69b27
0x6df69b29
0x00000000
0x6df69b2b
0x6dfb15be
0x00000000
0x6dfb15be
0x6df69b29
0x6df69ae8
0x6df69ae8
0x6df69aeb
0x6df69aee
0x6dfb15cb
0x6dfb15d2
0x6dfb15d5
0x6dfb15d7
0x6dfb15da
0x6dfb15dc
0x6dfb15dc
0x6dfb15dc
0x6dfb15da
0x6dfb15e5
0x6dfb15e9
0x6dfb15ee
0x6dfb15f1
0x6dfb15f3
0x6dfb15f9
0x6dfb1600
0x6dfb1604
0x6dfb1624
0x6dfb1629
0x6dfb1606
0x6dfb161c
0x6dfb1621
0x6dfb1637
0x6dfb163e
0x6dfb1643
0x6dfb1649
0x6dfb164c
0x6dfb1650
0x6dfb1656
0x6dfb165d
0x6dfb165e
0x6dfb165e
0x6dfb1650
0x6dfb15f3
0x6df69af4
0x6df69af7
0x6df69afc
0x6df69b00
0x6df69b04
0x6df69b08
0x6df69b14
0x6df699fe
0x6df69a04
0x6df69a07
0x00000000
0x6df69a29
0x6dfb169c
0x6dfb16a0
0x6dfb16a5
0x6dfb16a9
0x6dfb16b5
0x6dfb16ba
0x6dfb16bc
0x6dfb16be
0x6dfb16c3
0x6dfb16c3
0x6dfb16bc
0x6dfb16c8
0x6dfb16cc
0x6dfb181b
0x6dfb181b
0x6dfb181e
0x6dfb181e
0x6dfb1821
0x6dfb1823
0x6dfb1826
0x6dfb1829
0x6dfb182c
0x6dfb182e
0x6dfb1688
0x6dfb1688
0x6dfb1689
0x6dfb168b
0x6dfb168c
0x6dfb168d
0x6dfb168f
0x6dfb1692
0x00000000
0x6dfb1692
0x6dfb1834
0x6dfb1836
0x00000000
0x00000000
0x6dfb183f
0x6dfb1842
0x6dfb1848
0x6dfb184a
0x6dfb1875
0x6dfb1875
0x6dfb1878
0x6dfb187b
0x6dfb187d
0x6dfb1880
0x6dfb1884
0x6dfb18a7
0x6dfb18a7
0x6dfb18aa
0x6dfb18ad
0x6dfb18b6
0x6dfb18bd
0x6dfb18c0
0x6dfb18c3
0x6dfb18c5
0x6dfb18c8
0x6dfb18ca
0x6dfb18ca
0x6dfb18cd
0x6dfb18cd
0x6dfb18c8
0x6dfb18d5
0x6dfb18da
0x6dfb18df
0x6dfb18e2
0x6dfb18e5
0x6dfb18e7
0x6dfb18ee
0x6dfb18f2
0x6dfb1912
0x6dfb1917
0x6dfb18f4
0x6dfb190a
0x6dfb190f
0x6dfb1925
0x6dfb192c
0x6dfb1931
0x6dfb193a
0x6dfb193e
0x6dfb1940
0x6dfb1947
0x6dfb1948
0x6dfb1948
0x6dfb193e
0x6dfb18e5
0x6dfb194f
0x6dfb1952
0x6dfb1956
0x6dfb195d
0x6dfb1961
0x6dfb196d
0x00000000
0x6dfb196d
0x6dfb188a
0x6dfb188f
0x6dfb1891
0x00000000
0x00000000
0x6dfb189d
0x00000000
0x6dfb189d
0x6dfb184c
0x6dfb1859
0x6dfb1859
0x6dfb185c
0x00000000
0x00000000
0x6dfb1851
0x6dfb1853
0x6dfb1855
0x6dfb1865
0x6dfb1865
0x6dfb1866
0x6dfb1868
0x6dfb1870
0x00000000
0x6dfb1870
0x6dfb1857
0x6dfb1857
0x6dfb185e
0x00000000
0x6dfb16d2
0x6dfb16d2
0x6dfb16d5
0x6dfb16d5
0x6dfb16d8
0x6dfb16da
0x6dfb16dd
0x6dfb16e0
0x6dfb16e3
0x6dfb16e5
0x6dfb1808
0x6dfb1808
0x6dfb1809
0x6dfb1812
0x6dfb1817
0x6dfb1817
0x00000000
0x6dfb1817
0x6dfb16eb
0x6dfb16ed
0x00000000
0x00000000
0x6dfb16f6
0x6dfb16f9
0x6dfb16ff
0x6dfb1701
0x6dfb172c
0x6dfb172c
0x6dfb172f
0x6dfb1732
0x6dfb1734
0x6dfb1737
0x6dfb173b
0x6dfb175e
0x6dfb175e
0x6dfb1761
0x6dfb1764
0x6dfb176d
0x6dfb1774
0x6dfb1777
0x6dfb177a
0x6dfb177c
0x6dfb177f
0x6dfb1781
0x6dfb1781
0x6dfb1784
0x6dfb1784
0x6dfb177f
0x6dfb178c
0x6dfb1791
0x6dfb1796
0x6dfb1799
0x6dfb179c
0x6dfb179e
0x6dfb17a5
0x6dfb17a9
0x6dfb17c9
0x6dfb17ce
0x6dfb17ab
0x6dfb17c1
0x6dfb17c6
0x6dfb17dc
0x6dfb17e3
0x6dfb17e8
0x6dfb17ee
0x6dfb17f1
0x6dfb17f5
0x6dfb17f7
0x6dfb17fe
0x6dfb17ff
0x6dfb17ff
0x6dfb17f5
0x6dfb179c
0x00000000
0x6dfb1764
0x6dfb1741
0x6dfb1746
0x6dfb1748
0x00000000
0x00000000
0x6dfb1754
0x00000000
0x6dfb1754
0x6dfb1703
0x6dfb1710
0x6dfb1710
0x6dfb1713
0x00000000
0x00000000
0x6dfb1708
0x6dfb170a
0x6dfb170c
0x6dfb171c
0x6dfb171c
0x6dfb171d
0x6dfb171f
0x6dfb1727
0x00000000
0x6dfb1727
0x6dfb170e
0x6dfb170e
0x6dfb1715
0x00000000
0x6dfb1715
0x6dfb16cc
0x6df69a45
0x6df69a45
0x6df69a0e
0x6df69a1c
0x6df69a23
0x6dfb167e
0x6dfb167f
0x6dfb1681
0x6dfb1683
0x6dfb1684
0x00000000
0x6dfb1684
0x00000000
0x6df69aad
0x6df69aad
0x6df69ab0
0x6df69ab3
0x6df69ab3
0x6df69ab6
0x00000000
0x00000000
0x6df69ab8
0x6df69aba
0x6df69abc
0x6df69ac8
0x6df69ac8
0x00000000
0x6df69abe
0x6df69abe
0x6df69ac0
0x00000000
0x6df69ac0
0x6df69abc
0x6df69ad2
0x00000000
0x6df69ad2
0x6df69aab

Strings

HEAP: , xrefs: 6DFB155D, 6DFB1624, 6DFB17C9, 6DFB1912
HEAP[%wZ]: , xrefs: 6DFB1550, 6DFB1617, 6DFB17BC, 6DFB1905
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 6DFB1572, 6DFB1639, 6DFB17DE, 6DFB1927

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: d30140ee5fc181f667504312ba2e95b761c5f0d280361e0df2941495ccde8f5a
Instruction ID: eb62c925d1bc33e29df003d804b73d010e635a5c52775d404708c9cac2a91ec6
Opcode Fuzzy Hash: d30140ee5fc181f667504312ba2e95b761c5f0d280361e0df2941495ccde8f5a
Instruction Fuzzy Hash: FC22FF70A046469FEB15CF6EC880B7ABBF5FF45708F24C569E8998B642E731D881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DF48239, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 233
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DF48239(signed int* __ecx, long* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				long _v568;
				long _v572;
				intOrPtr _v576;
				short _v578;
				void* _v580;
				signed int _v584;
				intOrPtr _v586;
				void* _v588;
				void* _v592;
				void* _v596;
				intOrPtr _v600;
				long* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				void* _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t94;
				void* _t99;
				long _t118;
				intOrPtr _t125;
				short _t126;
				signed int* _t137;
				void* _t138;
				intOrPtr _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t150;
				signed int _t151;
				void* _t152;
				signed int _t154;

				_t149 = __edx;
				_v12 =  *0x6e03d360 ^ _t154;
				_v564 = _v564 & 0x00000000;
				_t151 = _a4;
				_t137 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t150 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E6DF56D30( &_v580, L"UseFilter") < 0) {
					L4:
					return E6DF8B640(_t89, _t137, _v12 ^ _t154, _t149, _t150, _t151);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push(2);
				_push( &_v580);
				_push( *_t137);
				_t89 = E6DF89650();
				if(_t89 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t89 = 0;
					} else {
						_t94 =  *_t151;
						_t151 =  *(_t151 + 4);
						_v588 = _t94;
						_v584 = _t151;
						if(E6DF56D30( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(RtlPrefixUnicodeString( &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t151 + 8;
						}
						_t99 =  &_v560;
						_t143 = 0;
						_v596 = _t99;
						_v600 = 0;
						do {
							_t149 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t99);
							_push(0);
							_push(_t143);
							_push( *_t137);
							_t151 = E6DF89820();
							if(_t151 < 0) {
								goto L37;
							}
							_t145 = _v596;
							_v580 =  *((intOrPtr*)(_t145 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t145 + 0xc));
							_v576 = _t145 + 0x10;
							_v636 =  *_t137;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t151 = E6DF89600();
							if(_t151 < 0) {
								goto L37;
							}
							_t151 = E6DF56D30( &_v580, L"FilterFullPath");
							if(_t151 < 0) {
								L36:
								_push(_v564);
								E6DF895D0();
								goto L37;
							}
							_t138 = _v592;
							_t118 = _v568;
							do {
								_push( &_v572);
								_push(_t118);
								_push(_t138);
								_push(2);
								_push( &_v580);
								_push(_v564);
								_t152 = E6DF89650();
								if(_t152 == 0x80000005 || _t152 == 0xc0000023) {
									if(_t150 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
									}
									_t147 =  *( *[fs:0x30] + 0x18);
									if(_t147 != 0) {
										_t150 = RtlAllocateHeap(_t147,  *0x6e037b9c + 0x180000, _v572);
										if(_t150 == 0) {
											goto L25;
										}
										_t118 = _v572;
										_t138 = _t150;
										_v596 = _t150;
										_v568 = _t118;
										goto L27;
									} else {
										_t150 = 0;
										L25:
										_t151 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t118 = _v568;
								}
								L27:
							} while (_t151 == 0x80000005 || _t151 == 0xc0000023);
							_v592 = _t138;
							_t137 = _v608;
							if(_t151 >= 0) {
								_t148 = _v592;
								if( *((intOrPtr*)(_t148 + 4)) != 1) {
									goto L36;
								}
								_t125 =  *((intOrPtr*)(_t148 + 8));
								if(_t125 > 0xfffe) {
									goto L36;
								}
								_t126 = _t125 + 0xfffffffe;
								_v616 = _t126;
								_v614 = _t126;
								_v612 = _t148 + 0xc;
								if(RtlCompareUnicodeString( &_v588,  &_v616, 1) == 0) {
									break;
								}
								goto L36;
							}
							_push(_v564);
							E6DF895D0();
							_t65 = _t151 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t151 = _t151 &  ~_t65;
							L37:
							_t99 = _v596;
							_t143 = _v600 + 1;
							_v600 = _t143;
						} while (_t151 >= 0);
						if(_t150 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
						}
						if(_t151 >= 0) {
							_push( *_t137);
							E6DF895D0();
							 *_t137 = _v564;
						}
						_t85 = _t151 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t89 =  ~_t85 & _t151;
					}
					goto L4;
				}
				if(_t89 != 0xc0000034) {
					if(_t89 == 0xc0000023) {
						goto L3;
					}
					if(_t89 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x6df48239
0x6df4824b
0x6df4824e
0x6df4825d
0x6df48260
0x6df4826e
0x6df48275
0x6df4827b
0x6df4827d
0x6df48287
0x6df48294
0x6df482ce
0x6df482de
0x6df482de
0x6df4829c
0x6df4829d
0x6df482a8
0x6df482a9
0x6df482b1
0x6df482b2
0x6df482b4
0x6df482bb
0x6dfa2dfa
0x6df482cc
0x6df482cc
0x6dfa2e19
0x6dfa2e19
0x6dfa2e1b
0x6dfa2e1e
0x6dfa2e30
0x6dfa2e3d
0x00000000
0x00000000
0x6dfa2e5a
0x6dfa2e61
0x6dfa2e68
0x6dfa2e72
0x6dfa2e72
0x6dfa2e78
0x6dfa2e7e
0x6dfa2e80
0x6dfa2e86
0x6dfa2e8c
0x6dfa2e8c
0x6dfa2e92
0x6dfa2e93
0x6dfa2e99
0x6dfa2e9a
0x6dfa2e9c
0x6dfa2e9d
0x6dfa2ea4
0x6dfa2ea8
0x00000000
0x00000000
0x6dfa2eae
0x6dfa2eb8
0x6dfa2ec3
0x6dfa2eca
0x6dfa2ed1
0x6dfa2edb
0x6dfa2ee3
0x6dfa2eef
0x6dfa2efb
0x6dfa2efc
0x6dfa2f08
0x6dfa2f12
0x6dfa2f13
0x6dfa2f22
0x6dfa2f26
0x00000000
0x00000000
0x6dfa2f3d
0x6dfa2f41
0x6dfa3069
0x6dfa3069
0x6dfa306f
0x00000000
0x6dfa306f
0x6dfa2f47
0x6dfa2f4d
0x6dfa2f53
0x6dfa2f59
0x6dfa2f5a
0x6dfa2f5b
0x6dfa2f5c
0x6dfa2f64
0x6dfa2f65
0x6dfa2f70
0x6dfa2f78
0x6dfa2f84
0x6dfa2f92
0x6dfa2f92
0x6dfa2f9d
0x6dfa2fa2
0x6dfa3004
0x6dfa3008
0x00000000
0x00000000
0x6dfa300a
0x6dfa3010
0x6dfa3012
0x6dfa3018
0x00000000
0x6dfa2fa4
0x6dfa2fa4
0x6dfa2fa6
0x6dfa2fa6
0x00000000
0x6dfa2fa6
0x6dfa2fab
0x6dfa2fab
0x6dfa2fab
0x6dfa2fab
0x6dfa2fb1
0x6dfa2fb1
0x6dfa2fc1
0x6dfa2fc7
0x6dfa2fcf
0x6dfa3020
0x6dfa302a
0x00000000
0x00000000
0x6dfa302c
0x6dfa3034
0x00000000
0x00000000
0x6dfa3036
0x6dfa3039
0x6dfa3040
0x6dfa304a
0x6dfa3067
0x00000000
0x00000000
0x00000000
0x6dfa3067
0x6dfa2fd1
0x6dfa2fd7
0x6dfa2fdc
0x6dfa2fe4
0x6dfa2fe6
0x6dfa3074
0x6dfa307a
0x6dfa3080
0x6dfa3081
0x6dfa3087
0x6dfa3091
0x6dfa309f
0x6dfa309f
0x6dfa30a6
0x6dfa30a8
0x6dfa30aa
0x6dfa30b5
0x6dfa30b5
0x6dfa30b7
0x6dfa30bf
0x6dfa30c1
0x6dfa30c1
0x00000000
0x6dfa2dfa
0x6df482c6
0x6dfa2ddd
0x00000000
0x00000000
0x6dfa2de8
0x00000000
0x00000000
0x6dfa2dee
0x00000000

APIs

RtlInitUnicodeStringEx.9419(?,UseFilter,?,00000000,?), ref: 6DF4828D
ZwQueryValueKey.9419(?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6DF482B4
RtlInitUnicodeStringEx.9419(?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6DFA2E36
RtlPrefixUnicodeString.9419(?,?,00000001,?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6DFA2E53
ZwEnumerateKey.9419(?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?,00000220), ref: 6DFA2E9F
ZwOpenKey.9419(00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?), ref: 6DFA2F1D
RtlInitUnicodeStringEx.9419(?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\), ref: 6DFA2F38
ZwQueryValueKey.9419(00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220), ref: 6DFA2F6B
RtlFreeHeap.9419(?,00000000,00000000,00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000), ref: 6DFA2F92

Strings

FilterFullPath, xrefs: 6DFA2F2C
\??\, xrefs: 6DFA2E2A
UseFilter, xrefs: 6DF48263

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Init$QueryValue$EnumerateFreeHeapOpenPrefix
String ID: FilterFullPath$UseFilter$\??\
API String ID: 941260810-2779062949
Opcode ID: 91535efa1a3a131543a4099e5a0ebc7ebdad8c3b156d87c2b0235254b77d1173
Instruction ID: c93050d53c5ad386b7bc10f87d9996c587c545f502c8cfb8c9311935c7c3c8db
Opcode Fuzzy Hash: 91535efa1a3a131543a4099e5a0ebc7ebdad8c3b156d87c2b0235254b77d1173
Instruction Fuzzy Hash: 5DA18C31A11669DBDB31CF68CC88BAAB7B8EF44704F1541E9E909A7250D7359E84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF440FD, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6DF440FD(void* __ecx) {
				signed int _v8;
				long _v548;
				signed int _v552;
				char _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t53;
				unsigned int _t66;
				void* _t68;
				wchar_t* _t73;
				intOrPtr _t77;
				short* _t85;
				wchar_t* _t98;
				signed int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x6e03d360 ^ _t107;
				_v8 =  *0x6e03d360 ^ _t107;
				_t105 = __ecx;
				if( *0x6e0384d4 == 0) {
					L5:
					return E6DF8B640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E6DF5E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					if(E6DF442EB(_t105) != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E6DF441EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
						}
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E6DF896C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					if(E6DF4429E(_t105 + 0x2c, _t102) >= 0) {
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E6DFD5720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						memset( &_v548, 0, 0x214);
						_t106 =  *0x6e0384d4;
						_t110 = _t108 + 0x20;
						 *0x6e03b1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						if( *( *0x6e0384d4)() == 0) {
							goto L8;
						}
						_t66 = _v560;
						if(_t66 == 0 || _t66 >= 0x214) {
							goto L8;
						} else {
							_t68 = (_t66 >> 1) * 2 - 2;
							if(_t68 >= 0x214) {
								E6DF8B75A();
								goto L33;
							}
							_push(_t85);
							 *((short*)(_t107 + _t68 - 0x220)) = 0;
							E6DFD5720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
							_t111 = _t110 + 0x14;
							_t73 = wcsstr( &_v548, L"Execute=1");
							_push(_t85);
							if(_t73 == 0) {
								E6DFD5720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
								_t106 =  &_v548;
								_t98 = _t106;
								_t112 = _t111 + 0x14;
								_t77 = _t98 + _v560;
								_v556 = _t77;
								if(_t98 >= _t77) {
									goto L8;
								} else {
									goto L27;
								}
								do {
									L27:
									_t85 = wcschr(_t106, 0x20);
									if(_t85 != 0) {
										 *_t85 = 0;
									}
									E6DFD5720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
									_t112 = _t112 + 0x10;
									E6DFC3E13(_t105, _t106);
									if(_t85 == 0) {
										goto L8;
									}
									_t41 = _t85 + 2; // 0x2
									_t106 = _t41;
								} while (_t106 < _v556);
								goto L8;
							}
							_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
							_push(3);
							_push(0x55);
							E6DFD5720();
							goto L15;
						}
					}
					L8:
					if(E6DF441F7(_t105) != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x6df4410d
0x6df4410f
0x6df4411c
0x6df4411e
0x6df44158
0x6df44168
0x6df44168
0x6df44126
0x6df44130
0x6df4413c
0x6dfa04a2
0x6df44142
0x6df4414b
0x6df4414b
0x6df4414f
0x6df4416b
0x6df44178
0x6df441d0
0x6df441d2
0x6df441d3
0x6df441a7
0x6df441b0
0x6df441db
0x6df441b2
0x6df441b8
0x6df441bf
0x6df441c1
0x6df441c1
0x6df441c5
0x6df441df
0x6df441e2
0x6df441e2
0x6df441c9
0x6dfa0628
0x6dfa0628
0x6dfa0630
0x6dfa0631
0x6dfa0633
0x6dfa0635
0x6dfa0635
0x00000000
0x6df441c9
0x6df4417d
0x6df44183
0x6df44190
0x6dfa04af
0x00000000
0x00000000
0x6dfa04b5
0x6dfa04c8
0x6dfa04d5
0x6dfa04e5
0x6dfa04ea
0x6dfa04f6
0x6dfa0518
0x6dfa0522
0x00000000
0x00000000
0x6dfa0528
0x6dfa0530
0x00000000
0x6dfa0543
0x6dfa0545
0x6dfa054e
0x6dfa0623
0x00000000
0x6dfa0623
0x6dfa0556
0x6dfa0557
0x6dfa056f
0x6dfa0574
0x6dfa0583
0x6dfa058a
0x6dfa058d
0x6dfa05b5
0x6dfa05c0
0x6dfa05c6
0x6dfa05c8
0x6dfa05cb
0x6dfa05cd
0x6dfa05d5
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfa05db
0x6dfa05db
0x6dfa05e3
0x6dfa05e9
0x6dfa05ed
0x6dfa05ed
0x6dfa05fa
0x6dfa05ff
0x6dfa0606
0x6dfa060d
0x00000000
0x00000000
0x6dfa0613
0x6dfa0613
0x6dfa0616
0x00000000
0x6dfa061e
0x6dfa058f
0x6dfa0594
0x6dfa0596
0x6dfa0598
0x00000000
0x6dfa059d
0x6dfa0530
0x6df44196
0x6df4419f
0x00000000
0x00000000
0x6df441a1
0x00000000
0x6df44151
0x6df44151
0x6df44151
0x00000000
0x6df44151

APIs

RtlImageNtHeaderEx.9419(00000003,?,00000000,00000000,?), ref: 6DF44130
ZwSetInformationProcess.9419(000000FF,00000022,?,00000004,00000003,?,00000000,00000000,?), ref: 6DFA0635

Strings

CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 6DFA05AC
ExecuteOptions, xrefs: 6DFA050A
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 6DFA058F
Execute=1, xrefs: 6DFA057D
CLIENT(ntdll): Processing section info %ws..., xrefs: 6DFA05F1
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 6DFA04BF
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 6DFA0566

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImageInformationProcess
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 4034523672-484625025
Opcode ID: 29287f9b97d00b80b2d3c1ab0950cf53189ebb15c2866598226f621831ffb1bd
Instruction ID: 57372add34d55bc9f4d510e83d507bd87a09fbf180097da79ab8295778c3c865
Opcode Fuzzy Hash: 29287f9b97d00b80b2d3c1ab0950cf53189ebb15c2866598226f621831ffb1bd
Instruction Fuzzy Hash: 89611A7190411ABAEB11DE9CEC85FBA7BB8FF59308F1440A9D615B7182DBB0DE41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6DFFCF70(void* __ecx, intOrPtr _a4, intOrPtr _a8, unsigned int* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _t61;
				char _t92;
				unsigned int* _t94;
				void* _t104;
				char _t105;
				unsigned int _t107;
				intOrPtr _t109;

				_v44 = 7;
				_t92 = 0;
				_t96 = 0x2000000;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_t109 = E6DF4F108(0, __ecx, __ecx,  &_v40);
				if(_t109 >= 0) {
					if(_a4 != 1) {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop\\MuiCached");
						_v32 = _v48;
						_t104 = 0x18;
						_v28 =  &_v44;
						_push( &_v36);
						_push(0x20019);
						_v60 = 0;
						_push( &_v60);
						_v36 = _t104;
						_v24 = 0x40;
						_v20 = 0;
						_v16 = 0;
						_t109 = E6DF89600();
						if(_t109 < 0) {
							L5:
							if(_t109 == 0x80000005) {
								goto L9;
							} else {
								_push(_v60);
								E6DF895D0();
								_v64 = _t92;
								RtlInitUnicodeString( &_v48, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
								_v48 = _t104;
								_v44 = _t92;
								goto L7;
							}
						} else {
							RtlInitUnicodeString( &_v44, L"MachinePreferredUILanguages");
							_push(0x2000000);
							_t96 = _v68;
							_t109 = E6DF4F018(_t96,  &_v52,  &_v60, 0,  &_v64);
							if(_t109 >= 0) {
								goto L9;
							} else {
								goto L5;
							}
						}
					} else {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop");
						_v36 = 0x18;
						_v32 = _v48;
						L7:
						_v68 = _t92;
						_v36 =  &_v52;
						_push( &_v44);
						_push(0x20019);
						_v32 = 0x40;
						_push( &_v68);
						_v28 = _t92;
						_v24 = _t92;
						_t109 = E6DF89600();
						if(_t109 >= 0) {
							RtlInitUnicodeString( &_v52, L"PreferredUILanguages");
							_push(_t96);
							_t96 = _v76;
							_t109 = E6DF4F018(_t96,  &_v60,  &_v68, _t92,  &_v72);
							L9:
							if(_t109 != 0xc0000034) {
								_t105 = _v56;
								if(_t105 != 0) {
									if(_t109 != 0x80000005) {
										_t109 = 0xc0000034;
									} else {
										_t107 = _t105 + 1 >> 1;
										if(_a8 != _t92) {
											_t94 = _a12;
											if( *_t94 >= _t107) {
												_push(_t96);
												_t109 = E6DF4F018(_v60,  &_v44,  &_v52, _a8,  &_v56);
												if(_t109 < 0) {
													goto L17;
												} else {
													if(_v56 == 7) {
														goto L16;
													} else {
														_t109 = 0xc0000034;
														goto L17;
													}
												}
												L29:
											} else {
												_t109 = 0xc0000023;
												L16:
												 *_t94 = _t107;
											}
											L17:
											_t92 = 0;
										} else {
											_t109 = _t92;
											 *_a12 = _t107;
										}
									}
								}
							}
						}
					}
				}
				_t61 = _v40;
				if(_t61 != 0) {
					if(_t61 != 0xffffffff) {
						 *0x6df26cc4(_t61);
					}
					_v40 = _t92;
				}
				if(_v52 != 0) {
					_push(_v52);
					E6DF895D0();
				}
				return _t109;
				goto L29;
			}

0x6dffcf82
0x6dffcf8c
0x6dffcf91
0x6dffcf96
0x6dffcf9a
0x6dffcf9e
0x6dffcfa7
0x6dffcfab
0x6dffcfb9
0x6dffcfe1
0x6dffcfea
0x6dffcff4
0x6dffcff5
0x6dffcffd
0x6dffcffe
0x6dffd007
0x6dffd00b
0x6dffd00c
0x6dffd010
0x6dffd018
0x6dffd01c
0x6dffd025
0x6dffd029
0x6dffd05d
0x6dffd063
0x00000000
0x6dffd069
0x6dffd069
0x6dffd06d
0x6dffd07b
0x6dffd080
0x6dffd085
0x6dffd089
0x00000000
0x6dffd089
0x6dffd02b
0x6dffd035
0x6dffd03a
0x6dffd03b
0x6dffd053
0x6dffd057
0x00000000
0x00000000
0x00000000
0x00000000
0x6dffd057
0x6dffcfbb
0x6dffcfc1
0x6dffcfca
0x6dffcfd2
0x6dffd08d
0x6dffd091
0x6dffd095
0x6dffd09d
0x6dffd09e
0x6dffd0a7
0x6dffd0af
0x6dffd0b0
0x6dffd0b4
0x6dffd0bd
0x6dffd0c1
0x6dffd0cd
0x6dffd0d2
0x6dffd0d3
0x6dffd0eb
0x6dffd0ed
0x6dffd0f4
0x6dffd0f6
0x6dffd0fc
0x6dffd104
0x6dffd18d
0x6dffd10a
0x6dffd10b
0x6dffd110
0x6dffd11b
0x6dffd120
0x6dffd15e
0x6dffd179
0x6dffd17d
0x00000000
0x6dffd17f
0x6dffd184
0x00000000
0x6dffd186
0x6dffd186
0x00000000
0x6dffd186
0x6dffd184
0x00000000
0x6dffd122
0x6dffd122
0x6dffd127
0x6dffd127
0x6dffd127
0x6dffd129
0x6dffd129
0x6dffd112
0x6dffd115
0x6dffd117
0x6dffd117
0x6dffd110
0x6dffd104
0x6dffd0fc
0x6dffd0f4
0x6dffd0c1
0x6dffcfb9
0x6dffd12b
0x6dffd131
0x6dffd136
0x6dffd139
0x6dffd139
0x6dffd13f
0x6dffd13f
0x6dffd148
0x6dffd14a
0x6dffd14e
0x6dffd14e
0x6dffd15b
0x00000000

APIs

Part of subcall function 6DF4F108: RtlOpenCurrentUser.9419(02000000,00000000,?,00000000,02000000,?,6DFFCFA7,?,?,?), ref: 6DF4F12C

RtlInitUnicodeString.9419(?,Control Panel\Desktop,?,?,?), ref: 6DFFCFC1
RtlInitUnicodeString.9419(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6DFFCFE1
ZwOpenKey.9419(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6DFFD020
RtlInitUnicodeString.9419(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6DFFD035
ZwClose.9419(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6DFFD06D
RtlInitUnicodeString.9419(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6DFFD080
ZwOpenKey.9419(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6DFFD0B8
RtlInitUnicodeString.9419(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6DFFD0CD
ZwClose.9419(?,?,?,?), ref: 6DFFD139
ZwClose.9419(00000000,?,?,?), ref: 6DFFD14E

Strings

@, xrefs: 6DFFD0A7
Control Panel\Desktop\MuiCached, xrefs: 6DFFCFDB
Control Panel\Desktop, xrefs: 6DFFCFBB
@, xrefs: 6DFFD010
MachinePreferredUILanguages, xrefs: 6DFFD02B
PreferredUILanguages, xrefs: 6DFFD0C3
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6DFFD072

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: 0553eab03fddbc7302dfcedb0e82620a17e400529be00ae5a8e73f404161aef5
Instruction ID: f77d998841d5785fbdbdc33b046fc6d770c9d5c192c0d4e5f462a197cced3473
Opcode Fuzzy Hash: 0553eab03fddbc7302dfcedb0e82620a17e400529be00ae5a8e73f404161aef5
Instruction Fuzzy Hash: 47515371808306AFD311CF5DC880A5BB7E8BFC9754F014A2EF598A7250D771DA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF42FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6DF42FB0(intOrPtr* _a4) {
				signed int _v8;
				void* _v36;
				void* _v62;
				void* _v68;
				void* _v72;
				signed int _v96;
				void* _v98;
				char _v100;
				void* _v104;
				void* _v108;
				void* _v112;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int* _t83;
				signed int _t84;
				signed int _t88;
				char* _t89;
				char _t93;
				void* _t99;
				signed int* _t102;
				intOrPtr _t103;
				void* _t104;
				signed int* _t107;
				signed int _t108;
				char* _t115;
				signed int _t118;
				signed int _t124;
				void* _t125;
				void* _t126;
				signed int _t127;
				intOrPtr* _t128;
				void* _t135;
				intOrPtr _t137;
				intOrPtr* _t159;
				void* _t160;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				signed int* _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x64;
				_v8 =  *0x6e03d360 ^ _t174;
				_push(_t125);
				_t159 = _a4;
				if(_t159 == 0) {
					__eflags =  *0x6e038748 - 2;
					if( *0x6e038748 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E6DF4B150();
						} else {
							E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E6DF4B150();
						__eflags =  *0x6e037bc8;
						if(__eflags == 0) {
							_t135 = 2;
							E6E002073(_t125, _t135, _t159, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t160);
					_pop(_t162);
					_pop(_t126);
					return E6DF8B640(_t62, _t126, _v8 ^ _t174, _t155, _t160, _t162);
				}
				if( *((intOrPtr*)(_t159 + 8)) == 0xddeeddee) {
					_t137 =  *[fs:0x30];
					__eflags = _t159 -  *((intOrPtr*)(_t137 + 0x18));
					if(_t159 ==  *((intOrPtr*)(_t137 + 0x18))) {
						L30:
						_t62 = _t159;
						goto L27;
					}
					_t138 =  *(_t159 + 0x20);
					__eflags =  *(_t159 + 0x20);
					if( *(_t159 + 0x20) != 0) {
						_t155 = _t159;
						E6DFECB1E(_t138, _t159, 0, 8, 0);
					}
					E6DF431B0(_t125, _t159, _t155);
					E6E00274F(_t159);
					_t155 = 1;
					E6DF71249(_t159, 1, 0, 0);
					E6E00B581(_t159);
					goto L26;
				}
				if(( *(_t159 + 0x44) & 0x01000000) != 0) {
					_t164 =  *0x6e035718; // 0x0
					 *0x6e03b1e0(_t159);
					_t62 =  *_t164();
					goto L27;
				}
				_t144 =  *((intOrPtr*)(_t159 + 0x58));
				if( *((intOrPtr*)(_t159 + 0x58)) != 0) {
					_t155 = _t159;
					E6DFECB1E(_t144, _t159, 0, 8, 0);
				}
				E6DF431B0(_t125, _t159, _t155);
				if(( *(_t159 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t159 + 0x40) & 0x10000000;
					if(( *(_t159 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t124 = E6E003518(_t159);
					__eflags = _t124;
					if(_t124 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t159 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						_t155 = 1;
						E6DF71249(_t159, 1, 0, 0);
						_t83 = _t159 + 0x9c;
						_t127 =  *_t83;
						while(_t83 != _t127) {
							_t84 = _t127;
							_t155 =  &_v96;
							_t127 =  *_t127;
							_v96 = _t84 & 0xffff0000;
							_v100 = 0;
							E6DF7174B( &_v96,  &_v100, 0x8000);
							_t88 = E6DF67D50();
							__eflags = _t88;
							if(_t88 == 0) {
								_t89 = 0x7ffe0388;
							} else {
								_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t89;
							if(__eflags != 0) {
								_t155 = _v96;
								E6DFFFE3F(_t159, _v96, _v100);
							}
							_t83 = _t159 + 0x9c;
						}
						if( *((char*)(_t159 + 0xda)) == 2) {
							_t93 =  *((intOrPtr*)(_t159 + 0xd4));
						} else {
							_t93 = 0;
						}
						if(_t93 != 0) {
							 *((intOrPtr*)(_t174 + 0x1c)) = _t93;
							_t155 = _t174 + 0x1c;
							 *((intOrPtr*)(_t174 + 0x1c)) = 0;
							E6DF7174B(_t174 + 0x1c, _t174 + 0x1c, 0x8000);
						}
						_t128 = _t159 + 0x88;
						if( *_t128 != 0) {
							 *((intOrPtr*)(_t174 + 0x24)) = 0;
							_t155 = _t128;
							E6DF7174B(_t128, _t174 + 0x24, 0x8000);
							 *_t128 = 0;
						}
						if(( *(_t159 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t159 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t167 =  *((intOrPtr*)(_t159 + 0xa8)) - 0x10;
						E6DF43138(_t167);
						if(_t167 != _t159) {
							goto L16;
						} else {
							_t99 = E6DF67D50();
							_t168 = 0x7ffe0380;
							if(_t99 != 0) {
								_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t102 = 0x7ffe0380;
							}
							if( *_t102 != 0) {
								_t103 =  *[fs:0x30];
								__eflags =  *(_t103 + 0x240) & 0x00000001;
								if(( *(_t103 + 0x240) & 0x00000001) != 0) {
									_t118 = E6DF67D50();
									__eflags = _t118;
									if(_t118 != 0) {
										_t168 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t168;
									}
									 *((short*)(_t174 + 0x2a)) = 0x1023;
									_push(_t174 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t168 & 0x000000ff);
									 *((intOrPtr*)(_t174 + 0x54)) = _t159;
									E6DF89AE0();
								}
							}
							_t104 = E6DF67D50();
							_t169 = 0x7ffe038a;
							if(_t104 != 0) {
								_t107 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t107 = 0x7ffe038a;
							}
							if( *_t107 != 0) {
								_t108 = E6DF67D50();
								__eflags = _t108;
								if(_t108 != 0) {
									_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t169;
								}
								 *((short*)(_t174 + 0x4e)) = 0x1023;
								_push(_t174 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t169 & 0x000000ff);
								 *((intOrPtr*)(_t174 + 0x78)) = _t159;
								E6DF89AE0();
							}
							if(E6DF67D50() != 0) {
								_t115 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t115 = 0x7ffe0388;
							}
							if( *_t115 != 0) {
								E6DFFFDD3(_t159);
							}
							goto L26;
						}
					}
				}
			}

0x6df42fb8
0x6df42fc2
0x6df42fc6
0x6df42fc9
0x6df42fce
0x6df9fb7d
0x6df9fb84
0x6df9fb8a
0x6df9fb90
0x6df9fb94
0x6df9fbb3
0x6df9fbb8
0x6df9fb96
0x6df9fbab
0x6df9fbb0
0x6df9fbbe
0x6df9fbc3
0x6df9fbc8
0x6df9fbd0
0x6df9fbd8
0x6df9fbd9
0x6df9fbd9
0x6df9fbd0
0x6df430ea
0x6df430ea
0x6df430ec
0x6df430f0
0x6df430f1
0x6df430f2
0x6df430fd
0x6df430fd
0x6df42fdb
0x6df9fbe3
0x6df9fbea
0x6df9fbed
0x6df4312b
0x6df4312b
0x00000000
0x6df4312b
0x6df9fbf3
0x6df9fbf8
0x6df9fbfa
0x6df9fc00
0x6df9fc02
0x6df9fc02
0x6df9fc09
0x6df9fc10
0x6df9fc1b
0x6df9fc1c
0x6df9fc23
0x00000000
0x6df9fc23
0x6df42fe8
0x6df9fc2d
0x6df9fc36
0x6df9fc3c
0x00000000
0x6df9fc3c
0x6df42fee
0x6df42ff5
0x6df9fc47
0x6df9fc49
0x6df9fc49
0x6df42ffd
0x6df43009
0x6df9fc53
0x6df9fc5a
0x00000000
0x00000000
0x6df9fc62
0x6df9fc67
0x6df9fc69
0x00000000
0x00000000
0x00000000
0x6df4300f
0x6df4300f
0x6df43018
0x00000000
0x6df4301e
0x6df43024
0x6df43025
0x6df4302a
0x6df43030
0x6df43032
0x6df9fc74
0x6df9fc76
0x6df9fc7a
0x6df9fc81
0x6df9fc8f
0x6df9fc93
0x6df9fc98
0x6df9fc9d
0x6df9fc9f
0x6df9fcb1
0x6df9fca1
0x6df9fcaa
0x6df9fcaa
0x6df9fcb6
0x6df9fcb9
0x6df9fcbf
0x6df9fcc5
0x6df9fcc5
0x6df9fcca
0x6df9fcca
0x6df43041
0x6df43100
0x6df43047
0x6df43047
0x6df43047
0x6df4304b
0x6df4310b
0x6df4310f
0x6df4311c
0x6df43121
0x6df43121
0x6df43051
0x6df43059
0x6df9fcde
0x6df9fce3
0x6df9fce5
0x6df9fcea
0x6df9fcea
0x6df43063
0x6df43075
0x6df43075
0x00000000
0x6df4307b
0x6df43081
0x6df43086
0x6df4308d
0x00000000
0x6df4308f
0x6df4308f
0x6df43094
0x6df430a0
0x6df9fcfa
0x6df430a6
0x6df430a6
0x6df430a6
0x6df430ab
0x6df9fd01
0x6df9fd07
0x6df9fd0e
0x6df9fd14
0x6df9fd19
0x6df9fd1b
0x6df9fd26
0x6df9fd26
0x6df9fd26
0x6df9fd2f
0x6df9fd38
0x6df9fd39
0x6df9fd3b
0x6df9fd43
0x6df9fd44
0x6df9fd48
0x6df9fd48
0x6df9fd0e
0x6df430b1
0x6df430b6
0x6df430c2
0x6df9fd5b
0x6df430c8
0x6df430c8
0x6df430c8
0x6df430cd
0x6df9fd62
0x6df9fd67
0x6df9fd69
0x6df9fd74
0x6df9fd74
0x6df9fd74
0x6df9fd7d
0x6df9fd86
0x6df9fd87
0x6df9fd89
0x6df9fd91
0x6df9fd92
0x6df9fd96
0x6df9fd96
0x6df430da
0x6df9fda9
0x6df430e0
0x6df430e0
0x6df430e0
0x6df430e8
0x6df43131
0x6df43131
0x00000000
0x6df430e8
0x6df4308d
0x6df43018

APIs

RtlDeleteCriticalSection.9419(?,00000000,00008000), ref: 6DF43070
RtlGetCurrentServiceSessionId.9419(00000000,00008000), ref: 6DF4308F
RtlGetCurrentServiceSessionId.9419 ref: 6DF430B1
RtlGetCurrentServiceSessionId.9419 ref: 6DF430D3
DbgPrint.9419(HEAP[%wZ]: ,-0000002C), ref: 6DF9FBAB
DbgPrint.9419((HeapHandle != NULL)), ref: 6DF9FBC3
RtlDebugPrintTimes.9419(?), ref: 6DF9FC36

Part of subcall function 6DF431B0: RtlAcquireSRWLockExclusive.9419(6E038660,?,00000000,6DF9FC0E), ref: 6DF431BC
Part of subcall function 6DF431B0: RtlReleaseSRWLockExclusive.9419(6E038660,6E038660,?,00000000,6DF9FC0E), ref: 6DF431CF

Strings

(HeapHandle != NULL), xrefs: 6DF9FBBE
HEAP: , xrefs: 6DF9FBB3
HEAP[%wZ]: , xrefs: 6DF9FBA6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: 277536498fc8fe8501e9bf3043c511c803bd0dc45f174f7f391e8ebb5ba79900
Instruction ID: a941d79007d19127d8fd6108e83b788a6e193acdd8620602ab7a8a0ee48dce02
Opcode Fuzzy Hash: 277536498fc8fe8501e9bf3043c511c803bd0dc45f174f7f391e8ebb5ba79900
Instruction Fuzzy Hash: 20913531B486429BE316CF2CC854B6ABBE4FF85708F05C559FA448B282DB35ED45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7CCC0, Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 218
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DF7CCC0(intOrPtr _a4, intOrPtr* _a8, signed int* _a12) {
				signed int _v8;
				char _v540;
				signed int _v544;
				char _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				signed int _v576;
				char _v580;
				char _v584;
				char* _v588;
				signed int _v590;
				signed int _v592;
				int _v596;
				signed int _v600;
				void* _v608;
				void* _v612;
				signed int _v616;
				intOrPtr _v620;
				signed int _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				intOrPtr _t79;
				signed int _t82;
				intOrPtr _t84;
				intOrPtr* _t103;
				void* _t104;
				intOrPtr _t107;
				void* _t110;
				void* _t111;
				void* _t117;
				int _t121;
				signed int* _t124;
				void* _t125;
				signed int _t129;
				signed int _t131;

				_t131 = (_t129 & 0xfffffff8) - 0x25c;
				_v8 =  *0x6e03d360 ^ _t131;
				_t103 = _a8;
				_t124 = _a12;
				_t76 = _a4 - 1;
				if(_t76 == 0) {
					_v580 = 0x18;
					_push( &_v580);
					_v568 = 0x40;
					_push(8);
					_v600 = 0;
					_push( &_v600);
					_v576 = 0;
					_v572 = 0x6df213a8;
					_v564 = 0;
					_v560 = 0;
					_t79 = E6DF89600();
					_v620 = _t79;
					if(_t79 >= 0 || _t79 == 0xc0000034 || _t79 == 0xc0000189) {
						_t80 = _v600;
						 *(_t103 + 0x18) =  *(_t103 + 0x18) | 0xffffffff;
						 *((intOrPtr*)(_t103 + 8)) = _v600;
					} else {
						_push(_t79);
						_t80 = E6DFD5720(0x33, 0, "SXS: Unable to open registry key %wZ Status = 0x%08lx\n", 0x6df213a8);
						 *((char*)(_t103 + 0x1c)) = 1;
						L36:
						_t131 = _t131 + 0x14;
						if(_t124 == 0) {
							L9:
							_pop(_t117);
							_pop(_t125);
							_pop(_t104);
							return E6DF8B640(_t80, _t104, _v8 ^ _t131, _t113, _t117, _t125);
						}
						_t80 = _v608;
						L38:
						 *_t124 = _t80;
					}
					goto L9;
				}
				_t82 = _t76 - 1;
				if(_t82 != 0) {
					_t80 = _t82;
					if(_t80 == 0 &&  *_t103 != _t80) {
						_push( *_t103);
						_t80 = E6DF895D0();
					}
					goto L9;
				}
				_t84 =  *((intOrPtr*)(_t103 + 4));
				if(_t84 != 0) {
					if(_t84 != 1) {
						_t107 =  *_t103;
						_t80 = _t84 + 0xfffffffe;
						_v608 = _t107;
						_v584 = 0;
						_v596 = _t80;
						if(_t107 == 0) {
							L30:
							 *((char*)(_t103 + 9)) = 1;
							goto L9;
						}
						_push( &_v584);
						_push(0x220);
						_t113 =  &_v556;
						_push( &_v556);
						_push(0);
						_push(_t80);
						_push(_t107);
						_t80 = E6DF89820();
						_v624 = _t80;
						if(_t80 >= 0) {
							_t80 = _v544;
							if(_t80 > 0xfffe) {
								L20:
								 *((char*)(_t103 + 8)) = 1;
								if(_t124 != 0) {
									 *_t124 = 0xc0000106;
								}
								goto L9;
							}
							_t113 =  &_v592;
							_v592 = _t80;
							_v590 = _t80;
							_v588 =  &_v540;
							_t80 = E6DFD4A28(_v608,  &_v592, _t103 + 0xc);
							_v612 = _t80;
							if(_t80 >= 0) {
								goto L9;
							}
							_push(_t80);
							_t80 = E6DFD5720(0x33, 0, "SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx\n",  &_v592);
							 *((char*)(_t103 + 8)) = 1;
							goto L36;
						}
						if(_t80 == 0x8000001a) {
							goto L30;
						}
						_push(_t80);
						_t80 = E6DFD5720(0x33, 0, "SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx\n", _v596);
						_t131 = _t131 + 0x14;
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 == 0) {
							goto L9;
						}
						_t80 = _v600;
						goto L38;
					}
					RtlInitUnicodeString( &_v608, E6DF5AAB0());
					_t113 = _v616 & 0x0000ffff;
					 *(_t103 + 0xc) = 0;
					_t27 = _t113 + 0x10; // 0x50
					_t80 = _t27;
					if(_t27 > ( *(_t103 + 0xe) & 0x0000ffff)) {
						L22:
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 != 0) {
							 *_t124 = 0xc0000023;
						}
						goto L9;
					}
					memcpy( *(_t103 + 0x10), _v612, _t113);
					_t131 = _t131 + 0xc;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t80 = _v616 + 0x10;
					L8:
					 *(_t103 + 0xc) = _t80;
					goto L9;
				}
				_t80 =  *( *[fs:0x30] + 0x10);
				_t121 =  *( *( *[fs:0x30] + 0x10) + 0x38) & 0x0000ffff;
				_v596 = _t121;
				_t9 = _t121 + 0x10; // 0x6df56177
				_t110 = _t9;
				if(_t110 > 0xfffe) {
					goto L20;
				}
				_t80 =  *(_t103 + 0xe) & 0x0000ffff;
				if(_t110 > ( *(_t103 + 0xe) & 0x0000ffff)) {
					goto L22;
				}
				_t111 =  *( *( *[fs:0x30] + 0x10) + 0x3c);
				if(( *( *( *[fs:0x30] + 0x10) + 8) & 0x00000001) == 0) {
					_t111 = _t111 +  *( *[fs:0x30] + 0x10);
				}
				memcpy( *(_t103 + 0x10), _t111, _t121);
				_t131 = _t131 + 0xc;
				_t113 = 1;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t103 + 0xc) = _v596 + 0xe;
				if(E6DF7D268( *(_t103 + 0x10), 1) != 0) {
					goto L9;
				} else {
					_t80 = 0;
					goto L8;
				}
			}

0x6df7ccc8
0x6df7ccd5
0x6df7cce0
0x6df7cce4
0x6df7cce8
0x6df7cceb
0x6df7ce12
0x6df7ce1a
0x6df7ce1d
0x6df7ce25
0x6df7ce2b
0x6df7ce2f
0x6df7ce30
0x6df7ce34
0x6df7ce3c
0x6df7ce40
0x6df7ce44
0x6df7ce49
0x6df7ce4f
0x6df7ce5c
0x6df7ce60
0x6df7ce64
0x6dfbad96
0x6dfbad96
0x6dfbada4
0x6dfbada9
0x6dfbadad
0x6dfbadad
0x6dfbadb2
0x6df7cd88
0x6df7cd8f
0x6df7cd90
0x6df7cd91
0x6df7cd9c
0x6df7cd9c
0x6dfbadb8
0x6dfbadbc
0x6dfbadbc
0x6dfbadbc
0x00000000
0x6df7ce4f
0x6df7ccf1
0x6df7ccf4
0x6df7cda0
0x6df7cda3
0x6dfbac7c
0x6dfbac7e
0x6dfbac7e
0x00000000
0x6df7cda3
0x6df7ccfa
0x6df7ccff
0x6df7cdb1
0x6dfbacc4
0x6dfbacc8
0x6dfbaccb
0x6dfbaccf
0x6dfbacd3
0x6dfbacd9
0x6dfbad2b
0x6dfbad2b
0x00000000
0x6dfbad2b
0x6dfbacdf
0x6dfbace0
0x6dfbace5
0x6dfbace9
0x6dfbacea
0x6dfbaceb
0x6dfbacec
0x6dfbaced
0x6dfbacf2
0x6dfbacf8
0x6dfbad34
0x6dfbad3d
0x6dfbac88
0x6dfbac88
0x6dfbac8e
0x6dfbac94
0x6dfbac94
0x00000000
0x6dfbac8e
0x6dfbad47
0x6dfbad4b
0x6dfbad50
0x6dfbad59
0x6dfbad61
0x6dfbad66
0x6dfbad6c
0x00000000
0x00000000
0x6dfbad72
0x6dfbad80
0x6dfbad85
0x00000000
0x6dfbad85
0x6dfbacff
0x00000000
0x00000000
0x6dfbad01
0x6dfbad0e
0x6dfbad13
0x6dfbad16
0x6dfbad1c
0x00000000
0x00000000
0x6dfbad22
0x00000000
0x6dfbad22
0x6df7cdc2
0x6df7cdc7
0x6df7cdd2
0x6df7cdd6
0x6df7cdd6
0x6df7cddb
0x6dfbac9f
0x6dfbac9f
0x6dfbaca5
0x6dfbacab
0x6dfbacab
0x00000000
0x6dfbaca5
0x6df7cde9
0x6df7cdfb
0x6df7cdfe
0x6df7cdff
0x6df7ce00
0x6df7ce01
0x6df7ce06
0x6df7cd84
0x6df7cd84
0x00000000
0x6df7cd84
0x6df7cd0b
0x6df7cd0e
0x6df7cd12
0x6df7cd16
0x6df7cd16
0x6df7cd1f
0x00000000
0x00000000
0x6df7cd25
0x6df7cd2b
0x00000000
0x00000000
0x6df7cd3a
0x6df7cd4a
0x6dfbacbc
0x6dfbacbc
0x6df7cd56
0x6df7cd66
0x6df7cd6c
0x6df7cd6e
0x6df7cd6f
0x6df7cd70
0x6df7cd71
0x6df7cd75
0x6df7cd80
0x00000000
0x6df7cd82
0x6df7cd82
0x00000000
0x6df7cd82

APIs

memcpy.9419(6DF24F84,?,6DF56167,00000040,?,?), ref: 6DF7CD56

Part of subcall function 6DF7D268: RtlInitUnicodeStringEx.9419(?,00000000,00000000,?,?,6DFC4718,00000030,?,00000000,?,6DFAF5F2,?,00000024,00000000,?), ref: 6DF7D278

RtlGetNtSystemRoot.9419(00000040,?,?), ref: 6DF7CDB7
RtlInitUnicodeString.9419(00000000,00000000,00000040,?,?), ref: 6DF7CDC2
memcpy.9419(6DF24F84,00000000,00000040,00000000,00000000,00000040,?,?), ref: 6DF7CDE9
ZwOpenKey.9419(?,00000008,?,?,?,?), ref: 6DF7CE44
ZwClose.9419(?,00000040,?,?), ref: 6DFBAC7E

Strings

SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx, xrefs: 6DFBAD06
SXS: Unable to open registry key %wZ Status = 0x%08lx, xrefs: 6DFBAD9C
.Local\, xrefs: 6DF7CD61
\WinSxS\, xrefs: 6DF7CDF3
@, xrefs: 6DF7CE1D
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx, xrefs: 6DFBAD78

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicodememcpy$CloseOpenRootSystem
String ID: .Local\$@$SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx$SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx$SXS: Unable to open registry key %wZ Status = 0x%08lx$\WinSxS\
API String ID: 3618765437-3926108909
Opcode ID: 64c9321d53ad06f44a88ad5a2ce70c43fb38f4f7b3e804448a19dfd9be88dd3c
Instruction ID: 76d244f56159101d0fdeec45f12ef175d2dd7b117253d9c805244ad9061c0a74
Opcode Fuzzy Hash: 64c9321d53ad06f44a88ad5a2ce70c43fb38f4f7b3e804448a19dfd9be88dd3c
Instruction Fuzzy Hash: CD81AE715083429FD721CF2ED880A6BBBE4BF86704F05895EF8A49B351D770D954CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF465A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DF465A0(intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v28;
				signed int _v300;
				intOrPtr _v304;
				signed int _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				void _v324;
				intOrPtr* _v328;
				void _v332;
				int _v336;
				void* _v340;
				char _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				void* _v372;
				void* _v388;
				void* __ebx;
				void* __edi;
				void* __esi;
				void _t75;
				intOrPtr* _t110;
				void* _t111;
				signed int _t112;
				signed int _t118;
				void* _t132;
				void* _t135;
				intOrPtr* _t137;
				void* _t142;
				signed int _t143;
				signed int _t145;

				_t145 = (_t143 & 0xfffffff8) - 0x15c;
				_v8 =  *0x6e03d360 ^ _t145;
				_t75 = _a4;
				_t124 = 0;
				_v332 = _t75;
				_t110 = _a12;
				_t137 = _a8;
				_v328 = _t137;
				if(_t75 != 0) {
					_push("true");
					_pop(_t112);
					_v340 = 0;
					_v336 = 0;
					memset( &_v324, 0, _t112 << 2);
					_t145 = _t145 + 0xc;
					_v344 = 0;
					_v348 = 0;
					_t132 = 0;
					RtlInitUnicodeString( &_v340, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
					_v332 = 0x18;
					_v324 =  &_v348;
					_v328 = 0;
					_push( &_v332);
					_push(0x20119);
					_v320 = 0x40;
					_push( &_v352);
					_v316 = 0;
					_v312 = 0;
					if(E6DF89600() >= 0) {
						if(E6DF466D4(_v352, L"UBR",  &_v356) >= 0) {
							_t132 = _v356;
						}
						_push(_v352);
						E6DF895D0();
					}
					_v308 = 0x11c;
					E6DF74020( &_v308);
					_t89 = _v344;
					asm("adc esi, edx");
					asm("adc esi, 0x0");
					 *_t89 = 0 + _v300 * 0x10000 + _t132;
					 *((intOrPtr*)(_t89 + 4)) = _v308 * 0x10000 + _v304;
					_t124 = 0;
					_t137 = _v340;
				}
				if(_t137 != 0) {
					_v348 = _t124;
					_v344 = _t124;
					_v356 = 3;
					RtlInitUnicodeString( &_v348, L"Kernel-OneCore-DeviceFamilyID");
					_push( &_v344);
					_push(4);
					_push( &_v364);
					_push( &_v348);
					_push( &_v356);
					E6DF8A9B0();
					_t89 =  *((intOrPtr*)(_t145 + 0x10));
					 *_t137 =  *((intOrPtr*)(_t145 + 0x10));
				}
				if(_t110 != 0) {
					_t118 = 6;
					memset( &_v332, 0, _t118 << 2);
					_t145 = _t145 + 0xc;
					_v348 = 0;
					_v344 = 0;
					_v352 = 0;
					_v356 = 0;
					 *_t110 = 0;
					RtlInitUnicodeString( &_v348, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM");
					_v340 = 0x18;
					_v332 =  &_v356;
					_push( &_v340);
					_push(0x20119);
					_v336 = 0;
					_push( &_v360);
					_v328 = 0x40;
					_v324 = 0;
					_v320 = 0;
					if(E6DF89600() >= 0) {
						_t124 = L"DeviceForm";
						if(E6DF466D4(_v360, L"DeviceForm",  &_v364) >= 0) {
							 *_t110 = _v364;
						}
						_push(_v360);
						_t89 = E6DF895D0();
					}
				}
				_pop(_t135);
				_pop(_t142);
				_pop(_t111);
				return E6DF8B640(_t89, _t111,  *(_t145 + 0x164) ^ _t145, _t124, _t135, _t142);
			}

0x6df465a8
0x6df465b5
0x6df465bc
0x6df465bf
0x6df465c1
0x6df465c6
0x6df465ca
0x6df465cd
0x6df465d4
0x6dfa19a6
0x6dfa19a8
0x6dfa19ab
0x6dfa19b3
0x6dfa19b7
0x6dfa19b7
0x6dfa19c2
0x6dfa19c7
0x6dfa19cb
0x6dfa19cd
0x6dfa19d6
0x6dfa19de
0x6dfa19e8
0x6dfa19ec
0x6dfa19ed
0x6dfa19f6
0x6dfa19fe
0x6dfa19ff
0x6dfa1a03
0x6dfa1a0e
0x6dfa1a25
0x6dfa1a27
0x6dfa1a27
0x6dfa1a2b
0x6dfa1a2f
0x6dfa1a2f
0x6dfa1a38
0x6dfa1a41
0x6dfa1a66
0x6dfa1a6a
0x6dfa1a6e
0x6dfa1a71
0x6dfa1a73
0x6dfa1a76
0x6dfa1a78
0x6dfa1a78
0x6df465dc
0x6df465e7
0x6df465ec
0x6df465f0
0x6df465f8
0x6df46601
0x6df46602
0x6df46608
0x6df4660d
0x6df46612
0x6df46613
0x6df46618
0x6df4661c
0x6df4661c
0x6df46620
0x6df4663b
0x6df46644
0x6df46644
0x6df4664f
0x6df46654
0x6df46658
0x6df4665c
0x6df46660
0x6df46662
0x6df4666b
0x6df46673
0x6df4667b
0x6df4667c
0x6df46685
0x6df46689
0x6df4668a
0x6df46692
0x6df46696
0x6df466a1
0x6df466b0
0x6df466bc
0x6df466d0
0x6df466d0
0x6df466be
0x6df466c2
0x6df466c2
0x6df466a1
0x6df46629
0x6df4662a
0x6df4662b
0x6df46636

APIs

RtlInitUnicodeString.9419 ref: 6DF465F8
ZwQueryLicenseValue.9419(?,?,00000003,00000004,?), ref: 6DF46613
RtlInitUnicodeString.9419(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM), ref: 6DF46662
ZwClose.9419(?,?,?,?,?,?,00020119,00000018), ref: 6DF466C2
ZwOpenKey.9419(?,?,?,?,00020119,00000018), ref: 6DF4669A

Part of subcall function 6DF89600: LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

RtlInitUnicodeString.9419(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DFA19CD
ZwOpenKey.9419(?,?,?,?,00020119,00000018), ref: 6DFA1A07
ZwClose.9419(?,?,?,?,?,?,00020119,00000018), ref: 6DFA1A2F
RtlGetVersion.9419(?,?,?,?,?,00020119,00000018), ref: 6DFA1A41

Strings

@, xrefs: 6DFA19F6
@, xrefs: 6DF4668A
Kernel-OneCore-DeviceFamilyID, xrefs: 6DF465DE
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6DFA19B9
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM, xrefs: 6DF46646
DeviceForm, xrefs: 6DF466B0
UBR, xrefs: 6DFA1A19

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$InitializeLicenseQueryThunkValueVersion
String ID: @$@$DeviceForm$Kernel-OneCore-DeviceFamilyID$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM
API String ID: 2689724482-2811273990
Opcode ID: 6ebaa48077dae6d78679ca93a9446159f40ce7743408482868d2fe8c06ce8054
Instruction ID: 0831e219af412d90a734c0d3b08d26b862bd8f61fd1a3117cbb07da85d2bb581
Opcode Fuzzy Hash: 6ebaa48077dae6d78679ca93a9446159f40ce7743408482868d2fe8c06ce8054
Instruction Fuzzy Hash: 2E51FAB15083159FD314CF19C880A9BBBE8BFC8754F05892EFA98D7251D731DA098B93

Uniqueness

Uniqueness Score: -1.00%

Function 6DF62430, Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 461
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6DF62430(signed char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr* _a20, signed int _a24, intOrPtr* _a28, int _a32, intOrPtr* _a36) {
				signed int _v8;
				char _v140;
				short _v172;
				char _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				signed int _v196;
				signed int _v200;
				short* _v204;
				short* _v208;
				short* _v212;
				signed int _v214;
				void _v216;
				short _v224;
				short _v228;
				short* _v232;
				signed short* _v236;
				signed short* _v240;
				short _v242;
				char _v244;
				intOrPtr _v248;
				void* _v252;
				intOrPtr _v256;
				void* _v260;
				char* _v280;
				char _v284;
				int _v288;
				char _v292;
				signed int _v296;
				int _v300;
				signed int _v304;
				int _v312;
				intOrPtr _v316;
				char _v320;
				signed int _v324;
				signed short _v328;
				signed short* _v332;
				signed int _v336;
				char _v337;
				void* _v338;
				void* _v342;
				void* _v344;
				void* _v348;
				void* _v352;
				void* _v353;
				void* _v354;
				void* _v356;
				void* _v364;
				void* _v366;
				void* _v368;
				void* _v370;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t179;
				signed short* _t180;
				intOrPtr _t182;
				intOrPtr _t186;
				short* _t187;
				intOrPtr _t193;
				short* _t194;
				short* _t202;
				signed int _t224;
				char _t225;
				signed int _t226;
				intOrPtr* _t233;
				intOrPtr* _t246;
				void* _t247;
				intOrPtr* _t248;
				char* _t249;
				intOrPtr* _t255;
				short* _t256;
				signed short* _t259;
				signed int _t262;
				intOrPtr* _t264;
				void* _t265;
				signed short* _t266;
				intOrPtr _t267;
				int _t268;
				signed short* _t269;
				void* _t274;
				void* _t275;
				signed int _t276;
				void* _t278;
				signed int _t280;
				signed int _t282;

				_t282 = (_t280 & 0xfffffff8) - 0x154;
				_v8 =  *0x6e03d360 ^ _t282;
				_t248 = _a28;
				_t258 = _a32;
				_t179 = _a36;
				_t246 = _a20;
				_v296 = _t248;
				_v320 = 0;
				_v316 = 0;
				_v280 =  &_v140;
				_v300 = _t258;
				_v284 = 0x800000;
				_v288 = 0;
				_v328 = 0;
				_v304 = 0;
				_t264 = _a8;
				if(_t248 != 0) {
					 *_t248 = 0;
				}
				if(_t258 != 0) {
					 *_t258 = 0;
				}
				if(_t179 != 0) {
					 *_t179 = 0x208;
				}
				if(_t246 != 0) {
					 *_t246 = 0;
					 *((intOrPtr*)(_t246 + 4)) = 0;
				}
				_t180 =  &_v172;
				_v228 = 0x20;
				_v236 = _t180;
				_v232 = _t180;
				_v240 = _t180;
				_v172 = 0;
				_t182 = _a16;
				_v224 = 0x20;
				_v244 = 0x200000;
				if(_t182 == 0) {
					_t249 =  &_v192;
					_v200 = 2;
					_v208 = _t249;
					_v204 = _t249;
					_v212 = _t249;
					_v196 = 2;
					_v192 = 0;
					_v216 = 0x20000;
				} else {
					_t262 =  *(_t182 + 2) & 0x0000ffff;
					_t256 =  *((intOrPtr*)(_t182 + 4));
					if(_t262 < 2) {
						_t256 =  &_v192;
						_t262 = 2;
					}
					_v208 = _t256;
					_v200 = _t262;
					_v204 = _t256;
					_v196 = _t262;
					_v212 = _t256;
					if(_t256 != 0) {
						 *_t256 = 0;
					}
					_v214 = _t262;
					_t258 = _v300;
					_v216 = 0;
				}
				_t251 = _a24;
				_v188 = _t182;
				_v184 = _t246;
				_v180 = _t251;
				_v176 = 1;
				if((_a4 & 0xfffffffe) != 0) {
					_t274 = 0xc000000d;
					goto L82;
				} else {
					if(_t264 == 0) {
						_t274 = 0xc000000d;
						L82:
						if(_t274 >= 0) {
							L57:
							_t183 = _v316;
							if(_v316 != 0) {
								E6DF4AD30(_t183);
								_v324 = 0;
								_v320 = 0;
							}
							_t186 = _v236;
							if(_t186 != 0) {
								if(_t186 != _v232) {
									_v248 = _t186;
									RtlFreeUnicodeString( &_v252);
								}
								_v240 = _v236;
								_v232 = _v228;
							}
							_t187 = _v232;
							_v240 = _t187;
							if(_t187 != 0) {
								_t251 = 0;
								 *_t187 = 0;
							}
							_v244 = 0;
							_v242 = _v224;
							if(_t274 == 0xc0150001) {
								E6DFE5100(_t251, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x1b2, "Status != STATUS_SXS_SECTION_NOT_FOUND");
								_t274 = 0xc00000e5;
								goto L82;
							} else {
								_pop(_t265);
								_pop(_t275);
								_pop(_t247);
								return E6DF8B640(_t274, _t247, _v8 ^ _t282, _t258, _t265, _t275);
							}
						}
						L51:
						if(_v176 != 0) {
							_t193 = _v208;
							if(_t193 != 0 && _t193 != _v204) {
								_v256 = _t193;
								RtlFreeUnicodeString( &_v260);
							}
							_t194 = _v204;
							if(_t194 != 0) {
								_t251 = 0;
								 *_t194 = 0;
							}
						}
						memset( &_v216, 0, 0x2c);
						_t282 = _t282 + 0xc;
						goto L57;
					}
					if(_t182 == 0) {
						if(_t246 != 0 || _t258 == 0) {
							L15:
							_t251 = 0;
							_t266 =  *(_t264 + 4);
							_v336 =  *_t264;
							_t202 = _a12;
							_v332 = _t266;
							_v338 = 0;
							if(_t202 == 0 ||  *_t202 == 0) {
								L23:
								_t274 = 0;
								goto L24;
							} else {
								_v337 = 0;
								_t278 = E6DF63690(1,  &_v336, 0x6df211bc,  &_v292);
								if(_t278 < 0) {
									if(_t278 == 0xc0000225) {
										L19:
										_t274 = 0;
										L20:
										_t266 = _v332;
										if(_t274 < 0) {
											L97:
											_t251 = _v338;
											L24:
											if(_t274 < 0) {
												goto L51;
											}
											if(_t251 != 0) {
												_t266 = _v240;
												_v336 = _v244;
												_v332 = _t266;
											}
											_v312 = 0;
											_v338 = 0;
											if(_v316 != 0) {
												_t274 = 0xc000000d;
												goto L42;
											} else {
												_t224 = _v336;
												if(_t224 < 2) {
													L30:
													if(_t224 < 4 ||  *_t266 == 0 || _t266[1] != 0x3a || _t224 < 6) {
														L40:
														_t225 = _v338;
														goto L41;
													} else {
														_t226 = _t266[2] & 0x0000ffff;
														if(_t226 != 0x5c) {
															if(_t226 != 0x2f) {
																goto L40;
															}
														}
														_v324 = 2;
														L36:
														_t274 = E6DF63850( &_v336,  &_v284,  &_v320,  &_v312, 0, 0,  &_v324, 0);
														if(_t274 < 0) {
															L42:
															_t204 = _v316;
															if(_v316 != 0) {
																E6DF4AD30(_t204);
																_v324 = 0;
																_v320 = 0;
															}
															L43:
															if(_t274 < 0) {
																goto L51;
															}
															if((_a4 & 0x00000001) == 0 ||  *((intOrPtr*)( *[fs:0x30] + 0x10)) == 0 || ( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00001000) == 0) {
																L47:
																_t267 = _a16;
																if((_v304 & 0x00000001) != 0) {
																	L77:
																	if(_t246 == 0) {
																		if(_t267 == 0 || _v212 ==  *((intOrPtr*)(_t267 + 4))) {
																			goto L78;
																		} else {
																			_t274 = 0xc0000023;
																			goto L82;
																		}
																	}
																	L78:
																	_t268 = _v300;
																	if(_t268 != 0) {
																		_t274 = E6DF63690(1,  &_v216, 0x6df21810,  &_v328);
																		if(_t274 < 0) {
																			goto L51;
																		}
																		 *_t268 = ((_v328 & 0x0000ffff) >> 1) + 1;
																	}
																	_t251 =  &_v216;
																	_t274 = E6DF85969( &_v216);
																	if(_t274 < 0) {
																		goto L51;
																	}
																	_t251 = _v296;
																	if(_t251 != 0) {
																		 *_t251 = _v304;
																	}
																	_t274 = 0;
																	goto L82;
																}
																if(_t267 == 0) {
																	if(_t246 != 0) {
																		goto L49;
																	}
																	_t258 = 1;
																	L50:
																	_t251 =  &_v336;
																	_t274 = E6DF62990( &_v336, _t258,  &_v288, _v296,  &_v216);
																	if(_t274 >= 0) {
																		goto L77;
																	}
																	goto L51;
																}
																L49:
																_t258 = 0;
																goto L50;
															} else {
																_t258 =  &_v216;
																_t251 =  &_v336;
																_t274 = E6DFD40D2( &_v336,  &_v216,  &_v304);
																if(_t274 < 0) {
																	goto L51;
																}
																goto L47;
															}
														}
														_t233 = _v312;
														_t276 =  *_t233;
														_t269 =  *(_t233 + 4);
														_v312 = _t276;
														if(_v324 == 6) {
															_t259 = _v332;
															if( *((short*)(_t259 + 0xa)) != 0x3a ||  *((short*)(_t259 + 0xc)) != 0x5c) {
																goto L38;
															} else {
																_v332 = _t259 + 8;
																_t251 = _v336 + 0xfff8;
																 *((intOrPtr*)(_t282 + 0x16)) =  *((intOrPtr*)(_t282 + 0x16)) + 0xfff8;
																_t258 = _v312 + 0xfff8;
																_t269 =  &(_t269[4]);
																_v312 = _t258;
																 *((intOrPtr*)(_t282 + 0x2e)) =  *((intOrPtr*)(_t282 + 0x2e)) + 0xfff8;
																_t276 = _v312;
																_v336 = _t251;
																L39:
																if(_t251 > _t258) {
																	_t251 =  &_v320;
																	if(_t233 ==  &_v320) {
																		_t225 = 1;
																	} else {
																		_t225 = _v338;
																	}
																	_v336 = _t276;
																	_v332 = _t269;
																	L41:
																	_t274 = 0;
																	if(_t225 != 0) {
																		goto L43;
																	}
																	goto L42;
																}
																goto L40;
															}
														}
														L38:
														_t251 = _v336;
														_t258 = _v312;
														goto L39;
													}
												}
												_t251 =  *_t266 & 0x0000ffff;
												if(_t251 == 0x5c || _t251 == 0x2f) {
													if(_t224 < 4) {
														goto L40;
													}
													_t251 = _t266[1] & 0x0000ffff;
													if(_t251 == 0x5c || _t251 == 0x2f) {
														if(_t224 < 6) {
															L110:
															_v324 = 1;
															goto L36;
														}
														_t251 = _t266[2] & 0x0000ffff;
														if(_t251 == 0x2e || _t251 == 0x3f) {
															if(_t224 < 8) {
																L109:
																if(_t224 == 6) {
																	goto L40;
																}
																goto L110;
															}
															_t251 = _t266[3] & 0x0000ffff;
															if(_t251 == 0x5c || _t251 == 0x2f) {
																_v324 = 6;
																goto L36;
															} else {
																goto L109;
															}
														} else {
															goto L110;
														}
													} else {
														goto L40;
													}
												} else {
													goto L30;
												}
											}
										}
										if(_v337 == 0) {
											_t255 = _a12;
											 *(_t282 + 0x50) = _v336;
											 *(_t282 + 0x54) = _t266;
											 *((intOrPtr*)(_t282 + 0x58)) =  *_t255;
											 *((intOrPtr*)(_t282 + 0x5c)) =  *((intOrPtr*)(_t255 + 4));
											_v244 = 0;
											_t274 = E6DF7D5C0(_t255,  &_v244, 2, _t282 + 0x50);
											if(_t274 < 0) {
												goto L97;
											}
											_t251 = 1;
											goto L23;
										}
										_t251 = _v338;
										goto L23;
									}
									goto L20;
								}
								_v337 = 1;
								goto L19;
							}
						} else {
							L96:
							_t274 = 0xc000000d;
							goto L82;
						}
					}
					if(_t246 == 0 || _t251 != 0) {
						goto L15;
					} else {
						goto L96;
					}
				}
			}

0x6df62438
0x6df62445
0x6df6244c
0x6df6244f
0x6df62452
0x6df62456
0x6df6245c
0x6df62460
0x6df62464
0x6df6246f
0x6df62475
0x6df62479
0x6df62481
0x6df62489
0x6df6248e
0x6df62493
0x6df62498
0x6df628f5
0x6df628f5
0x6df624a0
0x6df62956
0x6df62956
0x6df624a8
0x6df6295d
0x6df6295d
0x6df624b0
0x6df624b4
0x6df624b6
0x6df624b6
0x6df624b9
0x6df624c0
0x6df624cb
0x6df624cf
0x6df624d3
0x6df624d9
0x6df624e1
0x6df624e4
0x6df624ef
0x6df624f9
0x6df6280f
0x6df62816
0x6df62821
0x6df62828
0x6df6282f
0x6df62838
0x6df62843
0x6df6284b
0x6df624ff
0x6df624ff
0x6df62503
0x6df62509
0x6dfad20f
0x6dfad216
0x6dfad216
0x6df6250f
0x6df62516
0x6df6251d
0x6df62524
0x6df6252b
0x6df62534
0x6df62538
0x6df62538
0x6df6253d
0x6df62545
0x6df62549
0x6df62549
0x6df62558
0x6df6255b
0x6df62562
0x6df62569
0x6df62570
0x6df62578
0x6dfad220
0x00000000
0x6df6257e
0x6df62580
0x6dfad22a
0x6df62930
0x6df62932
0x6df62791
0x6df62791
0x6df62797
0x6dfad3b8
0x6dfad3bf
0x6dfad3c3
0x6dfad3c3
0x6df6279d
0x6df627a3
0x6df627a9
0x6df62968
0x6df62971
0x6df62971
0x6df627b3
0x6df627be
0x6df627be
0x6df627c5
0x6df627c9
0x6df627cf
0x6df627d1
0x6df627d3
0x6df627d3
0x6df627d8
0x6df627e5
0x6df627f0
0x6dfad3e0
0x6dfad3e5
0x00000000
0x6df627f6
0x6df627ff
0x6df62800
0x6df62801
0x6df6280c
0x6df6280c
0x6df627f0
0x6df6274b
0x6df62753
0x6df62755
0x6df6275e
0x6dfad3a4
0x6dfad3ad
0x6dfad3ad
0x6df6276d
0x6df62776
0x6df62778
0x6df6277a
0x6df6277a
0x6df62776
0x6df62789
0x6df6278e
0x00000000
0x6df6278e
0x6df62588
0x6df6285d
0x6df6259a
0x6df6259c
0x6df6259e
0x6df625a1
0x6df625a5
0x6df625a8
0x6df625ac
0x6df625b2
0x6df62600
0x6df62600
0x00000000
0x6df625ba
0x6df625be
0x6df625d4
0x6df625d8
0x6df6287b
0x6df625e3
0x6df625e3
0x6df625e5
0x6df625e5
0x6df625eb
0x6dfad246
0x6dfad246
0x6df62602
0x6df62604
0x00000000
0x00000000
0x6df6260c
0x6df628cf
0x6df628d3
0x6df628d7
0x6df628d7
0x6df62617
0x6df6261f
0x6df62624
0x6dfad24f
0x00000000
0x6df6262a
0x6df6262a
0x6df62633
0x6df6264a
0x6df6264e
0x6df626cd
0x6df626cd
0x00000000
0x6df62663
0x6df62663
0x6df6266a
0x6dfad2c4
0x00000000
0x00000000
0x6dfad2ca
0x6df62670
0x6df62678
0x6df6269c
0x6df626a0
0x6df626d7
0x6df626d7
0x6df626dd
0x6df628e1
0x6df628e8
0x6df628ec
0x6df628ec
0x6df626e3
0x6df626e5
0x00000000
0x00000000
0x6df626eb
0x6df6270f
0x6df62714
0x6df62717
0x6df628fc
0x6df628fe
0x6dfad352
0x00000000
0x6dfad368
0x6dfad368
0x00000000
0x6dfad368
0x6dfad352
0x6df62904
0x6df62904
0x6df6290a
0x6dfad38b
0x6dfad38f
0x00000000
0x00000000
0x6dfad39d
0x6dfad39d
0x6df62910
0x6df6291c
0x6df62920
0x00000000
0x00000000
0x6df62926
0x6df6292c
0x6df62983
0x6df62983
0x6df6292e
0x00000000
0x6df6292e
0x6df6271f
0x6df6286a
0x00000000
0x00000000
0x6dfad349
0x6df62727
0x6df62738
0x6df62741
0x6df62745
0x00000000
0x00000000
0x00000000
0x6df62745
0x6df62725
0x6df62725
0x00000000
0x6dfad325
0x6dfad32a
0x6dfad331
0x6dfad33a
0x6dfad33e
0x00000000
0x00000000
0x00000000
0x6dfad344
0x6df626eb
0x6df626a7
0x6df626ab
0x6df626ad
0x6df626b0
0x6df626b4
0x6dfad2cf
0x6dfad2d8
0x00000000
0x6dfad2e9
0x6dfad2f6
0x6dfad2ff
0x6dfad302
0x6dfad307
0x6dfad30a
0x6dfad30d
0x6dfad312
0x6dfad317
0x6dfad31b
0x6df626c4
0x6df626c7
0x6df6293d
0x6df62943
0x6df6297b
0x6df62945
0x6df62945
0x6df62945
0x6df62949
0x6df6294d
0x6df626d1
0x6df626d1
0x6df626d5
0x00000000
0x00000000
0x00000000
0x6df626d5
0x00000000
0x6df626c7
0x6dfad2d8
0x6df626ba
0x6df626ba
0x6df626bf
0x00000000
0x6df626bf
0x6df6264e
0x6df62635
0x6df6263b
0x6dfad25d
0x00000000
0x00000000
0x6dfad263
0x6dfad26a
0x6dfad279
0x6dfad2b4
0x6dfad2b4
0x00000000
0x6dfad2b4
0x6dfad27b
0x6dfad282
0x6dfad28d
0x6dfad2aa
0x6dfad2ae
0x00000000
0x00000000
0x00000000
0x6dfad2ae
0x6dfad28f
0x6dfad296
0x6dfad29d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6263b
0x6df62624
0x6df625f6
0x6df62886
0x6df6288d
0x6df62891
0x6df62897
0x6df6289e
0x6df628a4
0x6df628ba
0x6df628be
0x00000000
0x00000000
0x6df628c4
0x00000000
0x6df628c4
0x6df625fc
0x00000000
0x6df625fc
0x00000000
0x6df62881
0x6df625de
0x00000000
0x6df625de
0x6dfad23c
0x6dfad23c
0x6dfad23c
0x00000000
0x6dfad23c
0x6df6285d
0x6df62590
0x00000000
0x00000000
0x00000000
0x00000000
0x6df62590

APIs

RtlFindCharInUnicodeString.9419(00000001,?,6DF211BC,00000000), ref: 6DF625CF
RtlGetFullPathName_UstrEx.9419(?,?,?,?,00000000,00000000,?,00000000), ref: 6DF62697
memset.9419(?,00000000,0000002C), ref: 6DF62789
RtlMultiAppendUnicodeStringBuffer.9419(?,00000002,?,00000001,?,6DF211BC,00000000), ref: 6DF628B5
RtlFreeUnicodeString.9419(?,?,?,00000001), ref: 6DF62971
RtlDeleteBoundaryDescriptor.9419(00000000), ref: 6DF628E1

Part of subcall function 6DF4AD30: RtlFreeHeap.9419(?,00000000,00000001,?,6DF702E9,00000000,?,6DF5ECFB,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?), ref: 6DF4AD43

Strings

, xrefs: 6DF624C0
Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 6DFAD3CC
Internal error check failed, xrefs: 6DFAD3DB
, xrefs: 6DF624E4
minkernel\ntdll\sxsisol.cpp, xrefs: 6DFAD3D6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Free$AppendBoundaryBufferCharDeleteDescriptorFindFullHeapMultiName_PathUstrmemset
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 3547848382-3393094623
Opcode ID: 763846b69b5dfb1e9c10ea6270239799c3ceeb31987f0f1eb976c15fdd327d24
Instruction ID: 1b4df527cad2adbd28ac745625da5442845c7e45b4abe14c7e3d54b40433a959
Opcode Fuzzy Hash: 763846b69b5dfb1e9c10ea6270239799c3ceeb31987f0f1eb976c15fdd327d24
Instruction Fuzzy Hash: 42026A715187928BD331CF2CC480BABB7F5BF89704F14892EE99897650E772D944CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6A229, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 183
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6DF6A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E6DF6DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E6DF89730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E6E00A80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E6DF89660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E6DF4B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E6DF67D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E6E00138A(_t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E6DF67D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E6DF67D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E6E001582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E6DF67D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E6DF67D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E6E001582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E6DF9D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x6df6a229
0x6df6a231
0x6df6a23f
0x6df6a242
0x6df6a244
0x6df6a24c
0x6df6a255
0x6df6a25a
0x6df6a25f
0x6dfb1c76
0x6dfb1c78
0x6dfb1c7e
0x6dfb1c7f
0x6dfb1c81
0x6dfb1c82
0x6dfb1c84
0x6dfb1c89
0x6dfb1c8b
0x6dfb1c9e
0x6dfb1c9e
0x6dfb1cab
0x6dfb1cb2
0x00000000
0x6dfb1cb2
0x6dfb1c8d
0x6dfb1c92
0x00000000
0x00000000
0x6dfb1c94
0x6dfb1c98
0x00000000
0x00000000
0x00000000
0x6dfb1c98
0x6df6a265
0x6df6a265
0x6df6a266
0x6df6a26f
0x6df6a270
0x6df6a276
0x6df6a277
0x6df6a279
0x6df6a27e
0x6df6a282
0x6dfb1db5
0x6dfb1dbb
0x6dfb1dc1
0x6dfb1dc5
0x6dfb1de4
0x6dfb1de9
0x6dfb1dc7
0x6dfb1ddc
0x6dfb1de1
0x6dfb1def
0x6dfb1df3
0x6dfb1df7
0x6dfb1dfe
0x6dfb1e06
0x6df6a302
0x6df6a308
0x6df6a308
0x6df6a288
0x6df6a28d
0x6df6a294
0x6dfb1cc1
0x6df6a29a
0x6df6a29a
0x6df6a29a
0x6df6a29f
0x6dfb1ccb
0x6dfb1cd1
0x6dfb1cd8
0x6dfb1cea
0x6dfb1cea
0x6dfb1cd8
0x6df6a2a9
0x6df6a2af
0x6df6a2bc
0x6dfb1cfd
0x6df6a2c2
0x6df6a2c2
0x6df6a2c2
0x6df6a2c7
0x6dfb1d07
0x6dfb1d0d
0x6dfb1d14
0x6dfb1d1f
0x6dfb1d21
0x6dfb1d2c
0x6dfb1d2c
0x6dfb1d2c
0x6dfb1d47
0x6dfb1d47
0x6dfb1d14
0x6df6a2cd
0x6df6a2d2
0x6df6a2d9
0x6dfb1d5a
0x6df6a2df
0x6df6a2df
0x6df6a2df
0x6df6a2e4
0x6dfb1d69
0x6dfb1d6b
0x6dfb1d76
0x6dfb1d76
0x6dfb1d76
0x6dfb1d91
0x6dfb1d91
0x6df6a2ea
0x6df6a2f0
0x6df6a2f5
0x6dfb1da8
0x6dfb1dad
0x6dfb1dad
0x6df6a2fd
0x6df6a300
0x00000000

APIs

ZwAllocateVirtualMemory.9419(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6DF6A279

Part of subcall function 6DF89660: LdrInitializeThunk.NTDLL(6DFD18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6E020810,0000001C,6DFD1616), ref: 6DF8966A

RtlGetCurrentServiceSessionId.9419(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6DF6A288
RtlGetCurrentServiceSessionId.9419 ref: 6DF6A2B5
RtlGetCurrentServiceSessionId.9419 ref: 6DF6A2CD
ZwQueryVirtualMemory.9419(000000FF,?,00000003,00000014,00000014,00000000,?,?,?,-00000018,?,?,?,?,6E004C8F), ref: 6DFB1C84
DbgPrint.9419(HEAP[%wZ]: ,-0000002C), ref: 6DFB1DDC
DbgPrint.9419(ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix),00000000,?,?,?), ref: 6DFB1DFE

Strings

ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6DFB1DF9
HEAP: , xrefs: 6DFB1DE4
HEAP[%wZ]: , xrefs: 6DFB1DD7
`, xrefs: 6DFB1C8D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$MemoryPrintVirtual$AllocateInitializeQueryThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 1108326835-2586055223
Opcode ID: 6d72e36652c6f83264aacfeba7b93e325142957fdef2039f74e0133d5b944eaa
Instruction ID: 84d1b23e703a197f3953fd122c6c8ff0d9bb23771be46e8bbff485873f6276d6
Opcode Fuzzy Hash: 6d72e36652c6f83264aacfeba7b93e325142957fdef2039f74e0133d5b944eaa
Instruction Fuzzy Hash: 0E510132698681AFE312CFACC844F6777F8FB84B54F154868F9618B692D735D804CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6DF46F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DF46F60(WCHAR* _a4, WCHAR* _a8, void* _a12, signed int _a16, void* _a20, unsigned int _a24, int* _a28) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				char _v32;
				void* _v36;
				void* _v44;
				long _v48;
				char _v52;
				char _v56;
				char _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v80;
				signed int _t72;
				signed int _t81;
				WCHAR* _t88;
				int* _t96;
				void _t100;
				void _t106;
				void* _t107;
				int* _t108;
				long _t111;
				unsigned int _t113;
				unsigned int _t115;
				int _t117;
				void* _t118;
				intOrPtr* _t121;
				void* _t123;
				int _t126;
				void* _t127;
				void* _t128;
				void* _t131;
				signed int _t134;
				long _t136;
				void* _t137;
				signed int _t138;

				_t72 = _a16;
				_t111 = 0;
				_v44 = 0;
				_v52 = 0;
				_v48 = 0;
				_t131 = 0;
				if(_t72 != 0) {
					if(_t72 == 1) {
						goto L1;
					}
					_t81 = 0xc00000f1;
					L14:
					return _t81;
				}
				L1:
				_v28 = 0x18;
				_v20 = 0x6df216a8 + _t72 * 8;
				_push( &_v28);
				_push(0x20019);
				_v24 = _t111;
				_push( &_v52);
				_v16 = 0x40;
				_v12 = _t111;
				_v8 = _t111;
				_t134 = E6DF89600();
				if(_t134 != 0xc0000034) {
					if(_t134 < 0) {
						L10:
						if(_v52 != 0) {
							_push(_v52);
							E6DF895D0();
						}
						if(_v48 != 0) {
							_push(_v48);
							E6DF895D0();
						}
						if(_t131 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t111, _t131);
						}
						_t81 = _t134;
						goto L14;
					}
					RtlInitUnicodeString( &_v36, _a4);
					_v32 = _v60;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v56);
					_v24 = 0x40;
					_v20 = _t111;
					_v16 = _t111;
					_t134 = E6DF89600();
					if(_t134 == 0xc0000034) {
						goto L2;
					}
					L20:
					if(_t134 < 0) {
						goto L10;
					}
					_t88 = _a8;
					if(_t88 == 0) {
						_t88 = L"TargetPath";
					}
					RtlInitUnicodeString( &_v44, _t88);
					_t113 = _a24;
					_t136 = _t113 + 0x10;
					if(_t136 >= _t113) {
						_t131 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t136);
						if(_t131 != 0) {
							_push( &_v80);
							_push(_t136);
							_push(_t131);
							_push(2);
							_push( &_v60);
							_push(_v72);
							_t134 = E6DF89650();
							if(_t134 < 0) {
								if(_t134 != 0x80000005) {
									goto L51;
								}
								L32:
								_t117 =  *(_t131 + 8);
								_t49 = _t131 + 0xc; // 0xc
								_t128 = _t49;
								_v80 = _t117;
								if(_t134 < 0) {
									L47:
									_t96 = _a28;
									if(_t96 != 0) {
										 *_t96 = _t117;
									}
									if(_t134 >= 0) {
										memcpy(_a20, _t128, _t117);
									}
									goto L51;
								}
								_t115 = _a24;
								if( *((intOrPtr*)(_t128 + (_t117 >> 1) * 2 - 2)) != 0) {
									_t117 = _t117 + 2;
									_v80 = _t117;
									if(_t115 < _t117) {
										_t134 = 0x80000005;
									} else {
										 *((short*)(_t128 + (_t117 >> 1) * 2 - 2)) = 0;
										_t117 = _v80;
									}
								}
								if(_t134 < 0 ||  *((intOrPtr*)(_t131 + 4)) != 2) {
									goto L47;
								} else {
									_t118 = _t128;
									_t61 = _t118 + 2; // 0xe
									_t137 = _t61;
									do {
										_t100 =  *_t118;
										_t118 = _t118 + 2;
									} while (_t100 != _v68);
									_t111 = 0;
									_t134 = E6DF72440(0, _t128, _t118 - _t137 >> 1, _a20, _t115 >> 1,  &_v64);
									if(_t134 >= 0 || _t134 == 0xc0000023) {
										_t121 = _a28;
										if(_t121 != 0) {
											 *_t121 = _v64 + _v64;
										}
										if(_t134 == 0xc0000023) {
											_t134 = 0x80000005;
										}
									}
									goto L10;
								}
							}
							if( *((intOrPtr*)(_t131 + 4)) == 1 ||  *((intOrPtr*)(_t131 + 4)) == 2) {
								goto L32;
							} else {
								_t134 = 0xc0000024;
								goto L51;
							}
						}
						_t134 = 0xc0000017;
						goto L51;
					} else {
						_t134 = 0xc0000095;
						L51:
						_t111 = 0;
						goto L10;
					}
				}
				L2:
				_t127 = _a12;
				if(_t127 == 0) {
					goto L20;
				} else {
					_t123 = _t127;
					_t138 = _t123 + 2;
					goto L4;
					L4:
					_t106 =  *_t123;
					_t123 = _t123 + 2;
					if(_t106 != _t111) {
						goto L4;
					} else {
						_t107 = (_t123 - _t138 >> 1) + 1;
						_t126 = _t107 + _t107;
						_v64 = _t126;
						if(_t126 < _t107) {
							_t134 = 0xc0000095;
						} else {
							_t108 = _a28;
							asm("sbb esi, esi");
							_t134 = _t138 & 0x80000005;
							if(_t108 != 0) {
								 *_t108 = _t126;
							}
							if(_t126 <= _a24) {
								memcpy(_a20, _t127, _t126);
							}
						}
						goto L10;
					}
				}
			}

0x6df46f6b
0x6df46f6f
0x6df46f71
0x6df46f75
0x6df46f79
0x6df46f7f
0x6df46f83
0x6dfa20d3
0x00000000
0x00000000
0x6dfa20d9
0x6df47045
0x6df4704b
0x6df4704b
0x6df46f89
0x6df46f90
0x6df46f98
0x6df46fa0
0x6df46fa1
0x6df46faa
0x6df46fae
0x6df46faf
0x6df46fb7
0x6df46fbb
0x6df46fc4
0x6df46fcc
0x6dfa20e5
0x6df47025
0x6df4702a
0x6dfa22a1
0x6dfa22a5
0x6dfa22a5
0x6df47035
0x6dfa22af
0x6dfa22b3
0x6dfa22b3
0x6df4703d
0x6dfa22c8
0x6dfa22c8
0x6df47043
0x00000000
0x6df47043
0x6dfa20f3
0x6dfa20fc
0x6dfa2104
0x6dfa210c
0x6dfa210d
0x6dfa2116
0x6dfa211e
0x6dfa211f
0x6dfa2127
0x6dfa212b
0x6dfa2134
0x6dfa213c
0x00000000
0x00000000
0x6dfa2142
0x6dfa2144
0x00000000
0x00000000
0x6dfa214a
0x6dfa214f
0x6dfa2151
0x6dfa2151
0x6dfa215c
0x6dfa2161
0x6dfa2164
0x6dfa2169
0x6dfa2187
0x6dfa218b
0x6dfa219b
0x6dfa219c
0x6dfa219d
0x6dfa219e
0x6dfa21a4
0x6dfa21a5
0x6dfa21ae
0x6dfa21b2
0x6dfa21d0
0x00000000
0x00000000
0x6dfa21d6
0x6dfa21d6
0x6dfa21d9
0x6dfa21d9
0x6dfa21dc
0x6dfa21e2
0x6dfa2280
0x6dfa2280
0x6dfa2285
0x6dfa2287
0x6dfa2287
0x6dfa228b
0x6dfa2292
0x6dfa2297
0x00000000
0x6dfa228b
0x6dfa21f3
0x6dfa21f6
0x6dfa21f8
0x6dfa21fb
0x6dfa2201
0x6dfa2212
0x6dfa2203
0x6dfa2207
0x6dfa220c
0x6dfa220c
0x6dfa2201
0x6dfa2219
0x00000000
0x6dfa2221
0x6dfa2221
0x6dfa2223
0x6dfa2223
0x6dfa2226
0x6dfa2226
0x6dfa2229
0x6dfa222c
0x6dfa2240
0x6dfa224c
0x6dfa2255
0x6dfa225f
0x6dfa2264
0x6dfa226c
0x6dfa226c
0x6dfa2270
0x6dfa2276
0x6dfa2276
0x6dfa2270
0x00000000
0x6dfa2255
0x6dfa2219
0x6dfa21b8
0x00000000
0x6dfa21c0
0x6dfa21c0
0x00000000
0x6dfa21c0
0x6dfa21b8
0x6dfa218d
0x00000000
0x6dfa216b
0x6dfa216b
0x6dfa229a
0x6dfa229a
0x00000000
0x6dfa229a
0x6dfa2169
0x6df46fd2
0x6df46fd2
0x6df46fd7
0x00000000
0x6df46fdd
0x6df46fdd
0x6df46fdf
0x6df46fdf
0x6df46fe2
0x6df46fe2
0x6df46fe5
0x6df46feb
0x00000000
0x6df46fed
0x6df46ff1
0x6df46ff4
0x6df46ff7
0x6df46ffd
0x6df4704e
0x6df46fff
0x6df47002
0x6df47005
0x6df47007
0x6df4700f
0x6df47011
0x6df47011
0x6df47016
0x6df4701d
0x6df47022
0x6df47016
0x00000000
0x6df46ffd
0x6df46feb

APIs

ZwOpenKey.9419(?,?,?,?,00020019,00000018), ref: 6DF46FBF

Part of subcall function 6DF89600: LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

memcpy.9419(?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6DF4701D
RtlInitUnicodeString.9419(?,?,?,?,?,?,00020019,00000018), ref: 6DFA20F3
ZwOpenKey.9419(?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6DFA212F
RtlInitUnicodeString.9419(?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6DFA215C
RtlAllocateHeap.9419(?,00000000,?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6DFA2182
ZwClose.9419(00000000,?,?,?,?,00020019,00000018), ref: 6DFA22A5

Strings

TargetPath, xrefs: 6DFA2151, 6DFA2156
@, xrefs: 6DFA211F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode$AllocateCloseHeapInitializeThunkmemcpy
String ID: @$TargetPath
API String ID: 1135747570-4164548946
Opcode ID: 3af94717e6aef9bff444698363b66bd9c7146217f6bf1a2b0ce1ed5f4b3c2638
Instruction ID: 01dc4ab579ce97ad6959a916fce7c518377066afd46fedc709a9fd6a6e17e8e7
Opcode Fuzzy Hash: 3af94717e6aef9bff444698363b66bd9c7146217f6bf1a2b0ce1ed5f4b3c2638
Instruction Fuzzy Hash: 3C81BC72A08216DFD721CE2DC880A6BBBF8BB84314F09852DED5597211E736DC45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DF4F51D(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t54;
				intOrPtr _t63;
				intOrPtr _t76;
				signed int _t77;
				signed int _t86;
				void* _t88;
				signed int _t89;
				void* _t90;
				intOrPtr* _t91;
				intOrPtr _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				signed int _t101;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				void* _t113;
				intOrPtr* _t115;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t120;

				_t106 = __edx;
				_t93 = __ecx;
				_t120 = (_t118 & 0xfffffff8) - 0x14;
				_v8 =  *0x6e03d360 ^ _t120;
				_t115 = __ecx;
				_v24 =  *[fs:0x30];
				_t88 = 0;
				_v16 = __ecx;
				_push(_t108);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L3:
					 *(_t115 + 0x20) =  *(_t115 + 0x20) | 0xffffffff;
					E6DF50225(_t88, _t93, _t108, _t115,  *(_t115 + 0x20));
					L4:
					if( *0x6e038472 != _t88) {
						_t106 =  *0x7ffe0330;
						_t89 =  *0x6e03b210; // 0x0
						_t94 = 0x20;
						_t93 = _t94 - (_t106 & 0x0000001f);
						asm("ror ebx, cl");
						_t88 = _t89 ^ _t106;
					}
					L6DF5EEF0(0x6e0352d8);
					_t54 =  *_t115;
					while(1) {
						_v20 = _t54;
						if(_t54 == _t115) {
							break;
						}
						_t22 = _t54 - 0x54; // -84
						_t109 = _t22;
						__eflags =  *(_t109 + 0x34) & 0x00000008;
						if(( *(_t109 + 0x34) & 0x00000008) != 0) {
							_push(_t93);
							_t106 = 2;
							E6DF58B80(_t109, _t106);
							__eflags = _t88;
							if(_t88 != 0) {
								 *0x6e03b1e0(_t109);
								 *_t88();
							}
							_t93 = _t109;
							E6DF58800(_t93, 1);
							_t63 = _v32;
							__eflags =  *(_t63 + 0x68) & 0x00000100;
							if(( *(_t63 + 0x68) & 0x00000100) != 0) {
								_t93 = _t109;
								E6DFCEA20(_t93);
							}
						}
						__eflags =  *0x6e035780 & 0x00000005;
						if(__eflags != 0) {
							_t46 = _t109 + 0x24; // -48
							E6DFC5510("minkernel\\ntdll\\ldrsnap.c", 0xc5e, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t46);
							_t120 = _t120 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t109 + 0x18)));
						E6DF50100(_t88, _t93, _t109, _t115, __eflags);
						_t54 =  *_v28;
					}
					_t65 = E6DF5EB70(_t93, 0x6e0352d8);
					while(1) {
						L8:
						_t95 =  *(_t115 + 0x18);
						if(_t95 == 0) {
							break;
						}
						_t110 =  *_t95;
						__eflags = _t110 - _t95;
						if(_t110 != _t95) {
							_t65 =  *_t110;
							 *_t95 =  *_t110;
						} else {
							_t34 = _t115 + 0x18;
							 *_t34 =  *(_t115 + 0x18) & 0x00000000;
							__eflags =  *_t34;
						}
						__eflags = _t110;
						if(_t110 == 0) {
							break;
						} else {
							E6DF62280(_t65, 0x6e0384d8);
							_t92 =  *((intOrPtr*)(_t110 + 4));
							_t37 = _t110 + 8; // -76
							_t107 = _t37;
							_t101 =  *(_t92 + 0x1c);
							_t76 =  *_t101;
							_v28 = _t76;
							__eflags = _t76 - _t107;
							if(_t76 != _t107) {
								_t117 = _v24;
								do {
									_t77 =  *_t117;
									_t101 = _t117;
									_t117 = _t77;
									__eflags = _t77 - _t107;
								} while (_t77 != _t107);
								_t115 = _v16;
							}
							 *_t101 =  *_t107;
							__eflags =  *(_t92 + 0x1c) - _t107;
							if(__eflags == 0) {
								asm("sbb eax, eax");
								_t86 =  ~(_t101 - _t107) & _t101;
								__eflags = _t86;
								 *(_t92 + 0x1c) = _t86;
							}
							_t106 = 0;
							_push( &_v12);
							E6DF5093F(_t92, _t92, 0, _t110, _t115, __eflags);
							E6DF5FFB0(_t92, _t110, 0x6e0384d8);
							__eflags = _v20;
							if(_v20 != 0) {
								E6DF4F51D(_t92, 0);
							}
							_t65 = RtlFreeHeap( *0x6e037b98, 0, _t110);
							continue;
						}
					}
					_t111 =  *_t115;
					 *(_t115 + 0x20) = 0xfffffffe;
					if(_t111 == _t115) {
						L14:
						_pop(_t112);
						_pop(_t116);
						_pop(_t90);
						return E6DF8B640(_t65, _t90, _v8 ^ _t120, _t106, _t112, _t116);
					} else {
						goto L10;
					}
					do {
						L10:
						_t91 =  *_t111;
						_t113 = _t111 + 0xffffffac;
						 *(_t113 + 0x34) =  *(_t113 + 0x34) | 0x00000002;
						E6DF62280(_t65, 0x6e0384d8);
						E6DF5008A(_t113, _t115);
						if(( *(_t113 + 0x34) & 0x00000080) != 0) {
							_t17 = _t113 + 0x74; // -140
							L6DF4F900(0x6e0385fc, _t17);
							_t18 = _t113 + 0x68; // -152
							L6DF4F900(0x6e0385f4, _t18);
							 *(_t113 + 0x20) =  *(_t113 + 0x20) & 0x00000000;
						}
						E6DF5FFB0(_t91, _t113, 0x6e0384d8);
						if( *0x6e037b94 != 0) {
							E6DF80413(_t113);
						}
						_t65 = E6DF5EC7F(_t113);
						_t111 = _t91;
					} while (_t91 != _t115);
					goto L14;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L4;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) != 9) {
					goto L8;
				}
				goto L3;
			}

0x6df4f51d
0x6df4f51d
0x6df4f525
0x6df4f52f
0x6df4f53b
0x6df4f53d
0x6df4f541
0x6df4f543
0x6df4f547
0x6df4f54c
0x6df4f55a
0x6df4f55a
0x6df4f55e
0x6df4f563
0x6df4f569
0x6df4f718
0x6df4f720
0x6df4f72b
0x6df4f72c
0x6df4f72e
0x6df4f730
0x6df4f730
0x6df4f574
0x6df4f579
0x6df4f57b
0x6df4f57b
0x6df4f581
0x00000000
0x00000000
0x6df4f61f
0x6df4f61f
0x6df4f622
0x6df4f626
0x6df4f628
0x6df4f62b
0x6df4f62e
0x6df4f633
0x6df4f635
0x6df4f73a
0x6df4f740
0x6df4f740
0x6df4f63d
0x6df4f63f
0x6df4f644
0x6df4f648
0x6df4f64f
0x6dfa5d11
0x6dfa5d13
0x6dfa5d13
0x6df4f64f
0x6df4f655
0x6df4f65c
0x6dfa5d1d
0x6dfa5d37
0x6dfa5d3c
0x6dfa5d3c
0x6df4f662
0x6df4f664
0x6df4f667
0x6df4f670
0x6df4f670
0x6df4f58c
0x6df4f591
0x6df4f591
0x6df4f591
0x6df4f596
0x00000000
0x00000000
0x6df4f677
0x6df4f679
0x6df4f67b
0x6df4f706
0x6df4f708
0x6df4f681
0x6df4f681
0x6df4f681
0x6df4f681
0x6df4f681
0x6df4f685
0x6df4f687
0x00000000
0x6df4f68d
0x6df4f692
0x6df4f697
0x6df4f69a
0x6df4f69a
0x6df4f69d
0x6df4f6a0
0x6df4f6a2
0x6df4f6a6
0x6df4f6a8
0x6df4f6f2
0x6df4f6f6
0x6df4f6f6
0x6df4f6f8
0x6df4f6fa
0x6df4f6fc
0x6df4f6fc
0x6df4f700
0x6df4f700
0x6df4f6ac
0x6df4f6ae
0x6df4f6b1
0x6df4f6b9
0x6df4f6bb
0x6df4f6bb
0x6df4f6bd
0x6df4f6bd
0x6df4f6c4
0x6df4f6c6
0x6df4f6c9
0x6df4f6d3
0x6df4f6d8
0x6df4f6dd
0x6df4f711
0x6df4f711
0x6df4f6e8
0x00000000
0x6df4f6e8
0x6df4f687
0x6df4f59c
0x6df4f59e
0x6df4f5a7
0x6df4f60d
0x6df4f611
0x6df4f612
0x6df4f613
0x6df4f61e
0x00000000
0x00000000
0x00000000
0x6df4f5a9
0x6df4f5a9
0x6df4f5a9
0x6df4f5ab
0x6df4f5b3
0x6df4f5b7
0x6df4f5be
0x6df4f5c7
0x6df4f5c9
0x6df4f5d2
0x6df4f5d7
0x6df4f5e0
0x6df4f5e5
0x6df4f5e5
0x6df4f5ee
0x6df4f5fa
0x6dfa5d46
0x6dfa5d46
0x6df4f602
0x6df4f607
0x6df4f609
0x00000000
0x6df4f5a9
0x6df4f552
0x00000000
0x00000000
0x6df4f558
0x00000000
0x00000000
0x00000000

APIs

RtlEnterCriticalSection.9419(6E0352D8), ref: 6DF4F574
RtlLeaveCriticalSection.9419(6E0352D8,?,00000000,6E0352D8), ref: 6DF4F58C
RtlAcquireSRWLockExclusive.9419 ref: 6DF4F5B7
RtlRbRemoveNode.9419(6E0385FC,-0000008C), ref: 6DF4F5D2
RtlRbRemoveNode.9419(6E0385F4,-00000098,6E0385FC,-0000008C), ref: 6DF4F5E0
RtlReleaseSRWLockExclusive.9419(6E0384D8), ref: 6DF4F5EE
LdrUnloadAlternateResourceModuleEx.9419(?,00000000,6E0352D8), ref: 6DF4F667
RtlAcquireSRWLockExclusive.9419(6E0384D8,6E0352D8,?,00000000,6E0352D8), ref: 6DF4F692
RtlReleaseSRWLockExclusive.9419(6E0384D8,?,6E0384D8,6E0352D8,?,00000000,6E0352D8), ref: 6DF4F6D3
RtlFreeHeap.9419(00000000,-00000054,6E0384D8,?,6E0384D8,6E0352D8), ref: 6DF4F6E8
RtlDebugPrintTimes.9419(-00000054,?,6E0352D8), ref: 6DF4F73A

Strings

LdrpUnloadNode, xrefs: 6DFA5D28
minkernel\ntdll\ldrsnap.c, xrefs: 6DFA5D32
Unmapping DLL "%wZ", xrefs: 6DFA5D21

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: 7acad7429e8bb21dbfb082949e775540796d978510673d839ab03d296a0652da
Instruction ID: 41f6788961f24ee0a4c64af0fabc62e3859b0a6a83dbda95ff9ade942d4f0db6
Opcode Fuzzy Hash: 7acad7429e8bb21dbfb082949e775540796d978510673d839ab03d296a0652da
Instruction Fuzzy Hash: F7511571218703AFD754DF7CC884B2A7BA1BF85328F158A5CE5598B6A2D730EC14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD5F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6DFD5F5F(WCHAR* __ecx, intOrPtr __edx, void** _a4) {
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v60;
				void* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				char _v84;
				WCHAR* _v88;
				intOrPtr _v100;
				signed int _t48;
				signed int _t54;
				int _t64;
				intOrPtr _t82;
				void* _t85;
				void* _t87;
				void* _t91;
				void* _t96;
				void* _t97;
				signed int _t100;

				_v76 = _v76 & 0x00000000;
				_t85 = 0;
				_v72 = __edx;
				if(__ecx == 0 || __edx == 0 || _a4 == 0) {
					_t48 = 0xc000000d;
					goto L26;
				} else {
					if( *__ecx == 0x5c) {
						RtlInitUnicodeString( &_v68, __ecx);
						L8:
						_v32 = _v32 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_push(0x4021);
						_v28 =  &_v76;
						_push(7);
						_push( &_v60);
						_v36 = 0x18;
						_push( &_v36);
						_push(0x100001);
						_v24 = 0x40;
						_push( &_v84);
						_t54 = E6DF89830();
						_t100 = _t54;
						if(_t85 == 0) {
							L13:
							if(_t100 >= 0) {
								_t96 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x410);
								if(_t96 != 0) {
									RtlInitUnicodeString( &_v76, _v88);
									_push(0);
									_push( &_v84);
									_push(1);
									_push(3);
									_push(0x410);
									_push(_t96);
									_push( &_v76);
									_push(0);
									_push(0);
									_push(0);
									_push(_v100);
									_t100 = E6DF89850();
									if(_t100 >= 0) {
										_t64 =  *(_t96 + 0x3c);
										if(_t64 <= 0x104) {
											_t87 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t64 + 4);
											if(_t87 != 0) {
												_t39 = _t96 + 0x5e; // 0x5e
												memcpy(_t87, _t39,  *(_t96 + 0x3c));
												 *((short*)(_t87 + ( *(_t96 + 0x3c) >> 1) * 2)) = 0;
												 *_a4 = _t87;
											} else {
												_t100 = 0xc0000017;
											}
										}
									}
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t96);
								} else {
									_t100 = 0xc0000017;
								}
							}
							L22:
							if(_v84 != 0) {
								_push(_v84);
								E6DF895D0();
							}
							_t48 = _t100;
							L26:
							return _t48;
						}
						_t97 = _v40;
						if(_t97 != 0) {
							asm("lock xadd [edi], eax");
							if((_t54 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t97 + 4)));
								E6DF895D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t97);
							}
						}
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						goto L13;
					}
					_push( &_v44);
					_push(0);
					_push( &_v68);
					_t91 = 2;
					_t100 = E6DF565BA(_t91, __ecx);
					if(_t100 < 0) {
						goto L22;
					} else {
						_t82 = _v44;
						_t85 = _v64;
						if(_t82 != 0) {
							_v68 = _t82;
							_v64 = _v40;
						}
						goto L8;
					}
				}
			}

0x6dfd5f6a
0x6dfd5f73
0x6dfd5f75
0x6dfd5f7c
0x6dfd6137
0x00000000
0x6dfd5f93
0x6dfd5f97
0x6dfd5fd9
0x6dfd5fde
0x6dfd5fde
0x6dfd5fe7
0x6dfd5fec
0x6dfd5ff1
0x6dfd5ff6
0x6dfd5ffe
0x6dfd6000
0x6dfd6005
0x6dfd600d
0x6dfd600e
0x6dfd6017
0x6dfd601f
0x6dfd6020
0x6dfd6025
0x6dfd6029
0x6dfd6066
0x6dfd6068
0x6dfd6084
0x6dfd6088
0x6dfd609d
0x6dfd60a8
0x6dfd60a9
0x6dfd60aa
0x6dfd60ac
0x6dfd60ae
0x6dfd60af
0x6dfd60b4
0x6dfd60b5
0x6dfd60b6
0x6dfd60b7
0x6dfd60b8
0x6dfd60c1
0x6dfd60c5
0x6dfd60c7
0x6dfd60cf
0x6dfd60e5
0x6dfd60e9
0x6dfd60f5
0x6dfd60fa
0x6dfd6109
0x6dfd6110
0x6dfd60eb
0x6dfd60eb
0x6dfd60eb
0x6dfd60e9
0x6dfd60cf
0x6dfd611e
0x6dfd608a
0x6dfd608a
0x6dfd608a
0x6dfd6088
0x6dfd6123
0x6dfd6128
0x6dfd612a
0x6dfd612e
0x6dfd612e
0x6dfd6133
0x6dfd613c
0x6dfd6142
0x6dfd6142
0x6dfd602b
0x6dfd6031
0x6dfd6036
0x6dfd603a
0x6dfd603c
0x6dfd603f
0x6dfd6050
0x6dfd6050
0x6dfd603a
0x6dfd6061
0x00000000
0x6dfd6061
0x6dfd5f9f
0x6dfd5fa0
0x6dfd5fa5
0x6dfd5fa8
0x6dfd5fae
0x6dfd5fb2
0x00000000
0x6dfd5fb8
0x6dfd5fb8
0x6dfd5fbc
0x6dfd5fc3
0x6dfd5fc5
0x6dfd5fcd
0x6dfd5fcd
0x00000000
0x6dfd5fc3
0x6dfd5fb2

APIs

RtlInitUnicodeString.9419(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 6DFD5FD9
ZwOpenFile.9419(?,00100001,?,?,00000007,00004021), ref: 6DFD6020
ZwClose.9419(00000000,?,00100001,?,?,00000007,00004021), ref: 6DFD603F
RtlFreeHeap.9419(?,00000000,?,00000000,?,00100001,?,?,00000007,00004021), ref: 6DFD6050
RtlFreeHeap.9419(?,00000000,00000000,?,00100001,?,?,00000007,00004021), ref: 6DFD6061
RtlAllocateHeap.9419(?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6DFD607F
ZwClose.9419(00000000,?,00100001,?,?,00000007,00004021), ref: 6DFD612E

Part of subcall function 6DF565BA: RtlInitUnicodeStringEx.9419(?,?,?), ref: 6DF565CA

RtlInitUnicodeString.9419(?,?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6DFD609D
ZwQueryDirectoryFile.9419(?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?,00000008,00000410,?), ref: 6DFD60BC
RtlAllocateHeap.9419(?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6DFD60E0
memcpy.9419(00000000,0000005E,?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000), ref: 6DFD60FA
RtlFreeHeap.9419(?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6DFD611E

Strings

@, xrefs: 6DFD6017

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeInitStringUnicode$AllocateCloseFile$DirectoryOpenQuerymemcpy
String ID: @
API String ID: 1610808139-2766056989
Opcode ID: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction ID: b7fe446a37a19227d355dbb287d891bcd1eff35dcd211ac9fe1dc4b089989741
Opcode Fuzzy Hash: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction Fuzzy Hash: B651CC7250874AAFD352CF18C840F6BB7E8FB84B14F050929B6409B691DBB4ED04CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD4A28, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.9419(?,00000001,00000018,00000000,?,?), ref: 6DFD4AB1

Part of subcall function 6DF89600: LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

DbgPrintEx.9419(00000033,00000000,SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx,?,00000000,?,6DF21B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?), ref: 6DFD4ACC
ZwQueryValueKey.9419(?,6DF21B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6DFD4AF9
DbgPrintEx.9419(00000033,00000000,SXS: Assembly storage root location value has non-even size,?,6DF21B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6DFD4B24
DbgPrintEx.9419(00000033,00000000,SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING,?,?,6DF21B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6DFD4B67
memcpy.9419(00000010,?,?,?,6DF21B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6DFD4BA2
ZwClose.9419(?,00000000,?,?), ref: 6DFD4BCB

Strings

SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx, xrefs: 6DFD4AC4
SXS: Assembly storage root location value has non-even size, xrefs: 6DFD4B41
@, xrefs: 6DFD4A9B
SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING, xrefs: 6DFD4B5F
SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx, xrefs: 6DFD4B0C
SXS: Assembly storage root location value type is not REG_SZ, xrefs: 6DFD4B1C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CloseInitializeOpenQueryThunkValuememcpy
String ID: @$SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING$SXS: Assembly storage root location value has non-even size$SXS: Assembly storage root location value type is not REG_SZ$SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx$SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx
API String ID: 248942162-306078230
Opcode ID: 4402b66dad2d9b2a24e0fbe29335a5d0afa26992f89ca9fe78c73f7efd5312cc
Instruction ID: 5c7397002fa9a71b581c7402ea6261d5f6a940d6fffd5f5e4004b71d7699014e
Opcode Fuzzy Hash: 4402b66dad2d9b2a24e0fbe29335a5d0afa26992f89ca9fe78c73f7efd5312cc
Instruction Fuzzy Hash: E441B671D4112DAADB60CF589C84BBAB2B8FF18304F1541EAE90DA7640D7309E84CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E0049A4, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 114memorynativeCOMMON

Download Yara Rule

APIs

ZwAllocateVirtualMemory.9419(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6E0044B7,?), ref: 6E0049DF

Part of subcall function 6DF89660: LdrInitializeThunk.NTDLL(6DFD18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6E020810,0000001C,6DFD1616), ref: 6DF8966A

RtlCompareMemory.9419(?,01000000,?,00000000,?,00000000,?,?,6E0044B7,?), ref: 6E0049FE
memcpy.9419(01000000,?,?,00000000,?,00000000,?,?,6E0044B7,?), ref: 6E004A0C
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?), ref: 6E004A42
DbgPrint.9419(HEAP: ,?), ref: 6E004A4F
DbgPrint.9419(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6E004A66
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?), ref: 6E004ABC
DbgPrint.9419(HEAP: ,?,?,?,?,?,?), ref: 6E004AC9
DbgPrint.9419( This is located in the %s field of the heap header.,?,?,?,?,?,?), ref: 6E004ADB

Strings

This is located in the %s field of the heap header., xrefs: 6E004AD6
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 6E004A61
HEAP: , xrefs: 6E004A4A, 6E004A5D, 6E004A5F, 6E004AC4
HEAP[%wZ]: , xrefs: 6E004A3D, 6E004AB7

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateCompareInitializeThunkVirtualmemcpy
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 4107597528-336120773
Opcode ID: 6ee80251c0593e593c8bd1601f930783639955ffd3be288a5c6ad37839780925
Instruction ID: 98ebec6c5dc802d8ddc7fdef62893f33ba5b66eb284318b104b84fd8f5397fab
Opcode Fuzzy Hash: 6ee80251c0593e593c8bd1601f930783639955ffd3be288a5c6ad37839780925
Instruction Fuzzy Hash: A331DC35108524FFE350CFEDC884FAA73E8EF16764F128465F5158B252E732A881CAAD

Uniqueness

Uniqueness Score: -1.00%

Function 6DF63360, Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 355
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6DF63360(signed short* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr* _a8, unsigned int _a12, void* _a16) {
				signed int _v8;
				void _v32;
				char _v33;
				void* _v40;
				signed short* _v44;
				struct _EXCEPTION_RECORD _v48;
				char _v52;
				intOrPtr _v56;
				short _v58;
				void* _v60;
				signed short _v64;
				unsigned int _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t144;
				short _t165;
				void _t171;
				signed int _t173;
				void* _t177;
				void _t178;
				short _t181;
				void _t187;
				signed short* _t193;
				signed int _t198;
				signed int _t199;
				void* _t200;
				signed int _t206;
				signed short _t207;
				signed short _t208;
				signed char _t220;
				char _t221;
				intOrPtr* _t223;
				signed int _t225;
				void* _t226;
				signed int _t228;
				unsigned int _t229;
				signed short* _t231;
				void* _t233;
				signed int _t235;
				signed int _t237;
				void* _t238;

				_v8 =  *0x6e03d360 ^ _t237;
				_t193 = __ecx;
				_v48 = _a4;
				_t233 = _a16;
				_t229 = _a12;
				_v72 = __edx;
				_v44 = __ecx;
				_v80 = _a8;
				_v68 = _t229;
				_v40 = _t233;
				_v33 = 1;
				if((__ecx[8] & 0x00000001) == 0) {
					_t220 = 0;
				} else {
					_t220 = 1;
				}
				_v52 = _t220;
				if( *_t193 != 0x64487353) {
					L71:
					_t140 = 0xc0150003;
					goto L32;
				} else {
					if(_t193[0xa] == 0) {
						L31:
						_t140 = 0xc0150008;
						goto L32;
					} else {
						_t198 = _t193[0xe];
						if(_t198 == 0xffffffff) {
							_t221 = 0;
							goto L21;
						} else {
							if( *_t229 == _t198) {
								L20:
								_t221 = _v33;
								goto L21;
							} else {
								_t187 = 0;
								if(_v48 == 0 || _t233 == 0) {
									_t140 = 0xc000000d;
									goto L18;
								} else {
									_t231 = _v48;
									_t193 = _t231[2];
									 *_t233 = 0;
									_t229 = ( *_t231 & 0x0000ffff) >> 1;
									if(_t198 > 1) {
										L65:
										if(E6DF5FAB0(_t198, _v48, _v52, 0,  &_v76) < 0) {
											goto L32;
										} else {
											_t193 = _v44;
											E6DFD5720(0x33, 0, "RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.\n", _t193[0xe]);
											_t238 = _t238 + 0x10;
											_t221 = 0;
											L21:
											_v33 = _t221;
											if(_t193[4] != 1) {
												_t220 = 0;
											}
											_t199 = _t193[0x10];
											asm("sbb al, al");
											if((_t220 &  ~_t199) == 0) {
												if(_t220 == 0 || (_t193[8] & 0x00000002) == 0) {
													_t229 = _v44;
													_t193 = _t193[0xc] + _t229;
													_t233 =  *(_t229 + 0x14);
													if(_t233 != 0) {
														_t200 = _v40;
														do {
															_t144 = _t193[4];
															_v60 = _t144;
															_v58 = _t144;
															_v56 = _t193[2] + _t229;
															if(_t220 == 0 ||  *_t193 ==  *_t200) {
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																	goto L52;
																} else {
																	_t220 = _v33;
																	_t200 = _v40;
																	goto L81;
																}
															} else {
																goto L81;
															}
															goto L83;
															L81:
															_t193 =  &(_t193[0xc]);
															_t233 = _t233 - 1;
														} while (_t233 != 0);
													}
													goto L31;
												} else {
													_t205 = _t193[0xa];
													_t233 = _t193 + _t193[0xc];
													_t65 = _t205 - 1; // -1
													_t229 = _t233 + (_t65 + _t65 * 2) * 8;
													_v32 =  *_v40;
													_t193 = bsearch( &_v32, _t233, _t193[0xa], 0x18, 0x6df78c30);
													if(_t193 == 0) {
														goto L31;
													} else {
														if(_t193 != _t233) {
															_t171 =  *_v40;
															while( *_t193 == _t171) {
																_t193 = _t193 - 0x18;
																if(_t193 != _t233) {
																	continue;
																}
																goto L42;
															}
														}
														L42:
														_t233 =  *_v40;
														if( *_t193 != _t233) {
															_t193 =  &(_t193[0xc]);
														}
														while(1) {
															_t165 = _t193[4];
															_v60 = _t165;
															_v58 = _t165;
															_v56 = _v44 + _t193[2];
															if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																break;
															}
															_t193 =  &(_t193[0xc]);
															if(_t193 > _t229) {
																goto L31;
															} else {
																if( *_t193 == _t233) {
																	continue;
																} else {
																	break;
																}
															}
															goto L83;
														}
														if(_t193 > _t229) {
															goto L31;
														} else {
															if( *_t193 == _t233) {
																goto L51;
															} else {
																goto L31;
															}
														}
													}
												}
											} else {
												_t233 = _t193 + _t199;
												_t206 =  *_v40;
												_t173 = _t206;
												_v68 = _t206;
												if( *_t233 != 0xb) {
													_t225 = _t173 %  *_t233;
												} else {
													_t225 = _t173 % 0xb;
												}
												_t41 = _t233 + 4; // 0x1cc
												_t229 = 0;
												_v40 = _t225;
												_t226 =  *_t41 + _t225 * 8;
												_t220 = _t226 + _t193;
												_t177 =  *((intOrPtr*)(_t226 +  &(_t193[2]))) + _t193;
												_v64 = _t220;
												_v76 = _t177;
												if( *_t220 <= 0) {
													goto L31;
												} else {
													_t233 = _t177;
													while(1) {
														_t178 =  *_t233;
														if(_t178 > _v72) {
															break;
														}
														_t193 = _t193 + _t178;
														if(_v33 == 0 ||  *_t193 == _t206) {
															_t207 = _t193[2];
															if(_t207 > _v72) {
																_push(_v76);
																_push(_t220);
																_push(_v40);
																_push(_v44);
																_push(_t207);
																E6DFD5720(0x33, 0, "SXS: String hash table entry at %p has invalid key offset (= %ld)\n   Header = %p; Index = %lu; Bucket = %p; Chain = %p\n", _t193);
																_t140 = 0xc0150003;
																goto L32;
															} else {
																_t181 = _t193[4];
																_v60 = _t181;
																_v58 = _t181;
																_v56 = _v44 + _t207;
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) != 0) {
																	_t206 = _v68;
																	_t220 = _v64;
																	goto L30;
																} else {
																	L51:
																	_t229 = _v44;
																	L52:
																	if(_t193 == 0 || _t193[6] == 0) {
																		goto L31;
																	} else {
																		_t223 = _v80;
																		if(_t223 != 0) {
																			 *((intOrPtr*)(_t223 + 4)) =  *((intOrPtr*)(_t229 + 0xc));
																			 *((intOrPtr*)(_t223 + 8)) = _t193[6] + _t229;
																			 *(_t223 + 0xc) = _t193[8];
																			if(_t223 + 0x28 <=  *_t223 + _t223) {
																				 *(_t223 + 0x24) = _t193[0xa];
																			}
																		}
																		return E6DF8B640(0, _t193, _v8 ^ _t237, _t223, _t229, _t233);
																	}
																}
															}
														} else {
															L30:
															_t193 = _v44;
															_t229 = _t229 + 1;
															_t233 = _t233 + 4;
															if(_t229 <  *_t220) {
																continue;
															} else {
																goto L31;
															}
														}
														goto L83;
													}
													_push(_t178);
													E6DFD5720(0x33, 0, "SXS: String hash collision chain offset at %p (= %ld) out of bounds\n", _t233);
													goto L71;
												}
											}
										}
									} else {
										if(_t220 == 0) {
											if(_t229 != 0) {
												do {
													_t198 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t187 = _t187 * 0x1003f + _t198;
													_t229 = _t229 - 1;
												} while (_t229 != 0);
											}
										} else {
											if(_t229 != 0) {
												_t220 =  *0x6e036d5c;
												do {
													_t208 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t229 = _t229 - 1;
													_v64 = _t208;
													if(_t208 < 0x61) {
														L34:
														_t198 = _t208 & 0x0000ffff;
													} else {
														if(_t208 > 0x7a) {
															_t235 = _t208 & 0x0000ffff;
															_t228 = ( *(_t220 + (_t235 >> 8) * 2) & 0x0000ffff) + (_t235 >> 0x00000004 & 0x0000000f);
															_t220 =  *0x6e036d5c;
															_t208 =  *((intOrPtr*)(_t220 + (( *( *0x6e036d5c + _t228 * 2) & 0x0000ffff) + (_t235 & 0x0000000f)) * 2)) + _v64;
															goto L34;
														} else {
															_t198 = (_t208 & 0x0000ffff) - 0x20;
														}
													}
													_t187 = _t187 * 0x1003f + _t198;
												} while (_t229 != 0);
												_t233 = _v40;
											}
										}
										_t193 = _v44;
										_t229 = _v68;
										 *_t233 = _t187;
										_t140 = 0;
										L18:
										if(_t140 < 0) {
											if(_t140 != 0xc000000d) {
												L32:
												return E6DF8B640(_t140, _t193, _v8 ^ _t237, _t220, _t229, _t233);
											} else {
												goto L65;
											}
										} else {
											 *_t229 = _t193[0xe];
											goto L20;
										}
									}
								}
							}
						}
					}
				}
				L83:
			}

0x6df6336f
0x6df63376
0x6df63378
0x6df6337f
0x6df63387
0x6df6338a
0x6df6338d
0x6df63390
0x6df63393
0x6df63396
0x6df63399
0x6df6339d
0x6dfad994
0x6df633a3
0x6df633a3
0x6df633a3
0x6df633ab
0x6df633ae
0x6dfada5a
0x6dfada5a
0x00000000
0x6df633b4
0x6df633b8
0x6df634ea
0x6df634ea
0x00000000
0x6df633be
0x6df633be
0x6df633c4
0x6dfad99b
0x00000000
0x6df633ca
0x6df633cc
0x6df63458
0x6df63458
0x00000000
0x6df633d2
0x6df633d2
0x6df633d7
0x6dfad9c2
0x00000000
0x6df633e5
0x6df633e5
0x6df633e8
0x6df633eb
0x6df633f0
0x6df633f5
0x6dfad9d7
0x6dfad9ea
0x00000000
0x6dfad9f0
0x6dfad9f0
0x6dfad9ff
0x6dfada04
0x6dfada07
0x6df6345b
0x6df63461
0x6df63464
0x6dfada0e
0x6dfada0e
0x6df6346a
0x6df63471
0x6df63475
0x6df6353f
0x6dfada7c
0x6dfada82
0x6dfada84
0x6dfada89
0x6dfada8f
0x6dfada92
0x6dfada92
0x6dfada96
0x6dfada9a
0x6dfadaa3
0x6dfadaa8
0x6dfadac1
0x00000000
0x6dfadac7
0x6dfadac7
0x6dfadaca
0x00000000
0x6dfadaca
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfadacd
0x6dfadacd
0x6dfadad0
0x6dfadad0
0x6dfadad5
0x00000000
0x6df6354f
0x6df6354f
0x6df63555
0x6df6355c
0x6df63562
0x6df6356e
0x6df6357a
0x6df63581
0x00000000
0x6df63587
0x6df63589
0x6df6358e
0x6df63590
0x6df63594
0x6df63599
0x00000000
0x00000000
0x00000000
0x6df63599
0x6df63590
0x6df6359b
0x6df6359e
0x6df635a2
0x6df635a4
0x6df635a4
0x6df635b0
0x6df635b0
0x6df635b7
0x6df635bb
0x6df635c5
0x6df635d6
0x00000000
0x00000000
0x6dfada64
0x6dfada69
0x00000000
0x6dfada6f
0x6dfada71
0x00000000
0x6dfada77
0x00000000
0x6dfada77
0x6dfada71
0x00000000
0x6dfada69
0x6df635de
0x00000000
0x6df635e4
0x6df635e6
0x00000000
0x6df635e8
0x00000000
0x6df635e8
0x6df635e6
0x6df635de
0x6df63581
0x6df6347b
0x6df6347e
0x6df63486
0x6df63488
0x6df6348a
0x6df6348d
0x6df635ed
0x6df63493
0x6df63498
0x6df63498
0x6df6349a
0x6df6349d
0x6df6349f
0x6df634a2
0x6df634a9
0x6df634ab
0x6df634ad
0x6df634b0
0x6df634b5
0x00000000
0x6df634b7
0x6df634b7
0x6df634c0
0x6df634c0
0x6df634c5
0x00000000
0x00000000
0x6df634cb
0x6df634d1
0x6df635f4
0x6df635fa
0x6dfada20
0x6dfada23
0x6dfada24
0x6dfada27
0x6dfada2a
0x6dfada35
0x6dfada3d
0x00000000
0x6df63600
0x6df63600
0x6df63607
0x6df6360b
0x6df63614
0x6df63625
0x6dfada15
0x6dfada18
0x00000000
0x6df6362b
0x6df6362b
0x6df6362b
0x6df6362e
0x6df63630
0x00000000
0x6df63640
0x6df63640
0x6df63645
0x6df6364c
0x6df63656
0x6df6365c
0x6df63664
0x6df63669
0x6df63669
0x6df63664
0x6df6367e
0x6df6367e
0x6df63630
0x6df63625
0x6df634df
0x6df634df
0x6df634df
0x6df634e2
0x6df634e3
0x6df634e8
0x00000000
0x00000000
0x00000000
0x00000000
0x6df634e8
0x00000000
0x6df634d1
0x6dfada47
0x6dfada52
0x00000000
0x6dfada57
0x6df634b5
0x6df63475
0x6df633fb
0x6df633fd
0x6dfad9a4
0x6dfad9aa
0x6dfad9aa
0x6dfad9ad
0x6dfad9b6
0x6dfad9b8
0x6dfad9b8
0x6dfad9bd
0x6df63403
0x6df63405
0x6df63407
0x6df63410
0x6df63410
0x6df63413
0x6df63416
0x6df63417
0x6df6341d
0x6df63535
0x6df63535
0x6df63423
0x6df63426
0x6df63502
0x6df63519
0x6df63525
0x6df63531
0x00000000
0x6df6342c
0x6df6342f
0x6df6342f
0x6df63426
0x6df63438
0x6df6343a
0x6df6343e
0x6df6343e
0x6df63405
0x6df63441
0x6df63444
0x6df63447
0x6df63449
0x6df6344b
0x6df6344d
0x6dfad9d1
0x6df634f2
0x6df634ff
0x00000000
0x00000000
0x00000000
0x6df63453
0x6df63456
0x00000000
0x6df63456
0x6df6344d
0x6df633f5
0x6df633d7
0x6df633cc
0x6df633c4
0x6df633b8
0x00000000

APIs

bsearch.9419(?,?,00000000,00000018,6DF78C30,6DF62A25,00000000,00000000), ref: 6DF63575
RtlCompareUnicodeString.9419(?,?,?,?,?,6DF62A25,00000000,00000000), ref: 6DF635CF
RtlHashUnicodeString.9419(?,?,00000000,?,6DF62A25,00000000,00000000), ref: 6DFAD9E3
DbgPrintEx.9419(00000033,00000000,RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.,?,?,?,00000000,?,6DF62A25,00000000,00000000), ref: 6DFAD9FF

Strings

SsHd, xrefs: 6DF633A5
SXS: String hash collision chain offset at %p (= %ld) out of bounds, xrefs: 6DFADA49
SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p, xrefs: 6DFADA2C
RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section., xrefs: 6DFAD9F6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$CompareHashPrintbsearch
String ID: RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.$SXS: String hash collision chain offset at %p (= %ld) out of bounds$SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p$SsHd
API String ID: 856964118-2905229100
Opcode ID: c56a71ac7285b73776890f1c28d07ed84f791641979a528486ff555f5f6b29f2
Instruction ID: 8688eadaa86b5f700056d0980c4a548be3899b849b7cd39873960a0fca92c327
Opcode Fuzzy Hash: c56a71ac7285b73776890f1c28d07ed84f791641979a528486ff555f5f6b29f2
Instruction Fuzzy Hash: C0D1AF71A0425ADFCB15CF9CC8D0AADB7F1FF49304F19406AE905AB251E732E954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF43ACA, Relevance: 21.3, APIs: 14, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6DF43ACA(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t197;
				intOrPtr _t200;
				intOrPtr _t206;
				intOrPtr _t209;
				intOrPtr _t217;
				signed int _t224;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr _t238;
				signed int _t246;
				signed int _t249;
				char* _t252;
				intOrPtr _t257;
				signed int _t272;
				intOrPtr _t280;
				intOrPtr _t281;
				signed char _t286;
				signed int _t291;
				signed int _t292;
				intOrPtr _t299;
				intOrPtr _t301;
				signed int _t307;
				intOrPtr* _t308;
				signed int _t309;
				intOrPtr _t312;
				signed int* _t313;
				intOrPtr _t315;
				signed int _t316;
				void* _t317;

				_push(0x84);
				_push(0x6e01f4d0);
				E6DF9D0E8(__ebx, __edi, __esi);
				_t312 = __edx;
				 *((intOrPtr*)(_t317 - 0x38)) = __edx;
				 *((intOrPtr*)(_t317 - 0x20)) = __ecx;
				_t307 = 0;
				 *(_t317 - 0x74) = 0;
				 *((intOrPtr*)(_t317 - 0x78)) = 0;
				_t272 = 0;
				 *(_t317 - 0x60) = 0;
				 *((intOrPtr*)(_t317 - 0x68)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t197 = __edx + 0x28;
				 *((intOrPtr*)(_t317 - 0x7c)) = _t197;
				 *((intOrPtr*)(_t317 - 0x88)) = _t197;
				E6DF62280(_t197, _t197);
				_t280 =  *((intOrPtr*)(_t312 + 0x2c));
				 *((intOrPtr*)(_t317 - 0x34)) = _t280;
				L1:
				while(1) {
					if(_t280 == _t312 + 0x2c) {
						E6DF5FFB0(_t272, _t307,  *((intOrPtr*)(_t317 - 0x7c)));
						asm("sbb ebx, ebx");
						return E6DF9D130( ~_t272 & 0xc000022d, _t307, _t312);
					}
					_t15 = _t280 - 4; // -4
					_t200 = _t15;
					 *((intOrPtr*)(_t317 - 0x70)) = _t200;
					 *((intOrPtr*)(_t317 - 0x8c)) = _t200;
					 *((intOrPtr*)(_t317 - 0x6c)) = _t200;
					_t308 = 0x7ffe0010;
					_t313 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									 *(_t317 - 0x30) =  *0x6e038628;
									 *(_t317 - 0x44) =  *0x6e03862c;
									 *(_t317 - 0x28) =  *_t313;
									 *(_t317 - 0x58) = _t313[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t281 =  *0x7ffe0008;
										__eflags = _t301 -  *_t308;
										if(_t301 ==  *_t308) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t313 = 0x7ffe03b0;
									_t309 =  *0x7ffe03b0;
									 *(_t317 - 0x40) = _t309;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t317 - 0x3c)) = _t206;
									__eflags =  *(_t317 - 0x28) - _t309;
									_t308 = 0x7ffe0010;
								} while ( *(_t317 - 0x28) != _t309);
								__eflags =  *(_t317 - 0x58) - _t206;
							} while ( *(_t317 - 0x58) != _t206);
							 *(_t317 - 0x28) =  *0x6e03862c;
							__eflags =  *(_t317 - 0x30) -  *0x6e038628;
							_t308 = 0x7ffe0010;
						} while ( *(_t317 - 0x30) !=  *0x6e038628);
						__eflags =  *(_t317 - 0x44) -  *(_t317 - 0x28);
					} while ( *(_t317 - 0x44) !=  *(_t317 - 0x28));
					_t315 =  *((intOrPtr*)(_t317 - 0x6c));
					_t307 = 0;
					_t272 =  *(_t317 - 0x60);
					asm("sbb edx, [ebp-0x3c]");
					asm("sbb edx, eax");
					 *(_t317 - 0x28) = _t281 -  *(_t317 - 0x40) -  *(_t317 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x2c]");
					_t209 =  *((intOrPtr*)(_t317 - 0x20));
					_t286 =  *(_t315 + 0x24) &  *(_t209 + 0x18);
					 *(_t317 - 0x40) = _t286;
					__eflags =  *(_t315 + 0x34);
					if( *(_t315 + 0x34) != 0) {
						L37:
						 *((intOrPtr*)(_t317 - 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t317 - 0x34))));
						E6DF7DF4C(_t317 - 0x78, _t315, _t317 - 0x74, _t317 - 0x78);
						_t316 =  *(_t317 - 0x74);
						__eflags = _t316;
						_t280 =  *((intOrPtr*)(_t317 - 0x34));
						if(_t316 != 0) {
							 *0x6e03b1e0( *((intOrPtr*)(_t317 - 0x78)));
							 *_t316();
							_t280 =  *((intOrPtr*)(_t317 - 0x34));
						}
						_t312 =  *((intOrPtr*)(_t317 - 0x38));
						continue;
					}
					__eflags = _t286;
					if(_t286 == 0) {
						goto L37;
					}
					 *(_t317 - 0x5c) = _t286;
					_t45 = _t317 - 0x5c;
					 *_t45 =  *(_t317 - 0x5c) & 0x00000001;
					__eflags =  *_t45;
					if( *_t45 == 0) {
						L40:
						__eflags = _t286 & 0xfffffffe;
						if((_t286 & 0xfffffffe) != 0) {
							__eflags =  *((intOrPtr*)(_t315 + 0x64)) - _t307;
							if( *((intOrPtr*)(_t315 + 0x64)) == _t307) {
								L14:
								__eflags =  *(_t315 + 0x40) - _t307;
								if( *(_t315 + 0x40) != _t307) {
									__eflags = _t301 -  *(_t315 + 0x4c);
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t299 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *(_t315 + 0x5c) -  *((intOrPtr*)(_t299 + 0x10));
										if( *(_t315 + 0x5c) >=  *((intOrPtr*)(_t299 + 0x10))) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t317 - 0x28) -  *(_t315 + 0x48);
									if( *(_t317 - 0x28) >=  *(_t315 + 0x48)) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *((intOrPtr*)(_t317 + 8)) - _t307;
								if( *((intOrPtr*)(_t317 + 8)) != _t307) {
									__eflags =  *((intOrPtr*)(_t315 + 0x58)) - _t307;
									if( *((intOrPtr*)(_t315 + 0x58)) != _t307) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t317 - 0x24) = _t307;
								 *(_t317 - 0x30) = _t307;
								 *((intOrPtr*)(_t317 - 0x2c)) =  *((intOrPtr*)(_t315 + 0x10));
								_t217 =  *((intOrPtr*)(_t315 + 0xc));
								 *((intOrPtr*)(_t317 - 0x4c)) =  *((intOrPtr*)(_t217 + 0x10));
								 *((intOrPtr*)(_t317 - 0x48)) =  *((intOrPtr*)(_t217 + 0x14));
								 *(_t317 - 0x58) =  *(_t217 + 0x24);
								 *((intOrPtr*)(_t317 - 0x3c)) =  *((intOrPtr*)(_t315 + 0x14));
								 *((intOrPtr*)(_t317 - 0x64)) =  *((intOrPtr*)(_t315 + 0x18));
								 *(_t315 + 0x60) =  *( *[fs:0x18] + 0x24);
								_t224 =  *((intOrPtr*)(_t317 - 0x38)) + 0x28;
								 *(_t317 - 0x94) = _t224;
								_t291 = _t224;
								 *(_t317 - 0x28) = _t291;
								 *(_t317 - 0x90) = _t291;
								E6DF5FFB0(_t272, _t307, _t224);
								_t292 = _t307;
								 *(_t317 - 0x54) = _t292;
								_t226 = _t307;
								 *(_t317 - 0x50) = _t226;
								 *(_t317 - 0x44) = _t226;
								__eflags =  *(_t315 + 0x28);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t229 = 0;
									_t230 = _t229 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t317 - 0x50) = _t230;
									 *(_t317 - 0x44) = _t230;
									__eflags = _t230;
									if(_t230 != 0) {
										goto L17;
									}
									__eflags =  *((intOrPtr*)(_t317 + 8)) - 1;
									if( *((intOrPtr*)(_t317 + 8)) == 1) {
										E6DF62280( *(_t315 + 0x28) + 0x10,  *(_t315 + 0x28) + 0x10);
										_t230 = 1;
										 *(_t317 - 0x50) = 1;
										 *(_t317 - 0x44) = 1;
										goto L17;
									}
									_t233 = _t230 + 1;
									L35:
									 *( *((intOrPtr*)(_t317 - 0x70)) + 0x58) = _t233;
									__eflags = _t292;
									if(_t292 == 0) {
										E6DF62280(_t233,  *(_t317 - 0x28));
									}
									 *(_t315 + 0x60) = _t307;
									goto L37;
								}
								L17:
								__eflags =  *(_t315 + 0x34) - _t307;
								if( *(_t315 + 0x34) != _t307) {
									L26:
									__eflags =  *(_t317 - 0x50);
									if( *(_t317 - 0x50) != 0) {
										_t230 = E6DF5FFB0(_t272, _t307,  *(_t315 + 0x28) + 0x10);
									}
									__eflags =  *(_t317 - 0x30);
									if( *(_t317 - 0x30) == 0) {
										L71:
										_t292 =  *(_t317 - 0x54);
										L34:
										_t233 = _t307;
										goto L35;
									}
									E6DF62280(_t230,  *(_t317 - 0x94));
									_t292 = 1;
									 *(_t317 - 0x54) = 1;
									__eflags =  *(_t317 - 0x24) - 0xc000022d;
									if( *(_t317 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) == 0) {
											goto L34;
										}
										_t272 = 1;
										__eflags = 1;
										 *(_t317 - 0x60) = 1;
										E6DFD30AE(_t315,  *(_t317 - 0x24),  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10));
										goto L71;
									}
									__eflags =  *(_t317 - 0x24) - 0xc0000017;
									if( *(_t317 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t315 + 0x1c);
									if( *(_t315 + 0x1c) != 0) {
										_t238 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c);
										if( *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) != 0) {
											__eflags =  *(_t315 + 0x50) - _t307;
											if( *(_t315 + 0x50) > _t307) {
												 *(_t315 + 0x40) = _t307;
												 *(_t315 + 0x54) = _t307;
												 *(_t315 + 0x48) = _t307;
												 *(_t315 + 0x4c) = _t307;
												 *(_t315 + 0x50) = _t307;
												 *(_t315 + 0x5c) = _t307;
											}
										}
										goto L34;
									}
									L31:
									 *(_t315 + 0x1c) =  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10);
									goto L32;
								}
								 *(_t317 - 0x30) = 1;
								 *((intOrPtr*)(_t317 - 0x80)) = 1;
								 *((intOrPtr*)(_t317 - 0x64)) = E6DF43E80( *((intOrPtr*)(_t317 - 0x64)));
								 *(_t317 - 4) = _t307;
								__eflags =  *(_t317 - 0x5c);
								if( *(_t317 - 0x5c) != 0) {
									_t257 =  *((intOrPtr*)(_t317 - 0x20));
									 *0x6e03b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t257 + 0x10)),  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)),  *((intOrPtr*)(_t317 - 0x68)),  *((intOrPtr*)(_t257 + 0x14)));
									 *(_t317 - 0x24) =  *((intOrPtr*)(_t317 - 0x2c))();
								}
								_t246 =  *(_t317 - 0x40);
								__eflags = _t246 & 0x00000010;
								if((_t246 & 0x00000010) != 0) {
									__eflags =  *(_t315 + 0x34) - _t307;
									if( *(_t315 + 0x34) != _t307) {
										goto L21;
									}
									__eflags =  *(_t317 - 0x24);
									if( *(_t317 - 0x24) >= 0) {
										L64:
										 *0x6e03b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)), _t307,  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)), _t307, _t307);
										 *((intOrPtr*)(_t317 - 0x2c))();
										 *(_t317 - 0x24) = _t307;
										_t246 =  *(_t317 - 0x40);
										goto L21;
									}
									__eflags =  *(_t315 + 0x20) & 0x00000004;
									if(( *(_t315 + 0x20) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t246 & 0xffffffee;
									if((_t246 & 0xffffffee) != 0) {
										 *(_t317 - 0x24) = _t307;
										 *0x6e03b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t317 - 0x3c)), _t246);
										 *((intOrPtr*)(_t317 - 0x2c))();
									}
									_t249 = E6DF67D50();
									__eflags = _t249;
									if(_t249 != 0) {
										_t252 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t252 = 0x7ffe038e;
									}
									__eflags =  *_t252;
									if( *_t252 != 0) {
										_t252 = E6DFD2E14( *( *((intOrPtr*)(_t317 - 0x20)) + 0x10), _t315,  *((intOrPtr*)(_t317 - 0x38)),  *((intOrPtr*)(_t317 - 0x2c)),  *(_t317 - 0x40),  *(_t317 - 0x24),  *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)));
									}
									 *(_t317 - 4) = 0xfffffffe;
									E6DF43E6B(_t252);
									_t230 = E6DF43E80( *((intOrPtr*)(_t317 - 0x64)));
									goto L26;
								}
							}
						}
						__eflags = _t286 & 0x00000010;
						if((_t286 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t315 + 0x1c);
					if( *(_t315 + 0x1c) != 0) {
						__eflags =  *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c);
						if( *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x6df43aca
0x6df43acf
0x6df43ad4
0x6df43ad9
0x6df43adb
0x6df43ae0
0x6df43ae3
0x6df43ae5
0x6df43ae8
0x6df43aeb
0x6df43aed
0x6df43af5
0x6df43af8
0x6df43afb
0x6df43afe
0x6df43b05
0x6df43b0a
0x6df43b0d
0x00000000
0x6df43b10
0x6df43b15
0x6df43b1a
0x6df43b21
0x6df43b30
0x6df43b30
0x6df43b33
0x6df43b33
0x6df43b36
0x6df43b39
0x6df43b3f
0x6df43b47
0x6df43b4a
0x6df43b4a
0x6df43b4f
0x6df43b4f
0x6df43b4f
0x6df43b4f
0x6df43b4f
0x6df43b54
0x6df43b5c
0x6df43b61
0x6df43b67
0x6df43b6f
0x6df43b6f
0x6df43b71
0x6df43b75
0x6df43b77
0x00000000
0x00000000
0x6df43e6c
0x6df43e6c
0x6df43b7d
0x6df43b7d
0x6df43b82
0x6df43b84
0x6df43b87
0x6df43b8a
0x6df43b8d
0x6df43b90
0x6df43b90
0x6df43b97
0x6df43b97
0x6df43ba7
0x6df43baa
0x6df43bad
0x6df43bad
0x6df43bb7
0x6df43bb7
0x6df43bbc
0x6df43bbf
0x6df43bc1
0x6df43bc7
0x6df43bcd
0x6df43bd5
0x6df43bd8
0x6df43bda
0x6df43be1
0x6df43be4
0x6df43be7
0x6df43bea
0x6df43bed
0x6df43d97
0x6df43d9c
0x6df43da8
0x6df43dad
0x6df43db0
0x6df43db2
0x6df43db5
0x6dfa020b
0x6dfa0211
0x6dfa0213
0x6dfa0213
0x6df43dbb
0x00000000
0x6df43dbb
0x6df43bf3
0x6df43bf5
0x00000000
0x00000000
0x6df43bfb
0x6df43bfe
0x6df43bfe
0x6df43bfe
0x6df43c02
0x6df43dd1
0x6df43dd1
0x6df43dd7
0x6dfa00c1
0x6dfa00c4
0x6df43c11
0x6df43c11
0x6df43c14
0x6dfa00cf
0x6dfa00d2
0x00000000
0x00000000
0x6dfa00d8
0x6dfa00e6
0x6dfa00e9
0x6dfa00ec
0x6dfa00ef
0x00000000
0x00000000
0x00000000
0x6dfa00f5
0x6dfa00dd
0x6dfa00e0
0x00000000
0x00000000
0x00000000
0x6dfa00e0
0x6df43c1a
0x6df43c1a
0x6df43c1d
0x6df43e20
0x6df43e23
0x00000000
0x00000000
0x00000000
0x6df43e29
0x6df43c23
0x6df43c23
0x6df43c26
0x6df43c2c
0x6df43c2f
0x6df43c35
0x6df43c3b
0x6df43c41
0x6df43c47
0x6df43c4d
0x6df43c59
0x6df43c5f
0x6df43c62
0x6df43c68
0x6df43c6a
0x6df43c6d
0x6df43c74
0x6df43c79
0x6df43c7b
0x6df43c7e
0x6df43c80
0x6df43c83
0x6df43c89
0x6df43c8b
0x6df43dea
0x6df43df1
0x6df43df2
0x6df43df5
0x6df43df8
0x6df43dfb
0x6df43dfd
0x00000000
0x00000000
0x6df43e03
0x6df43e07
0x6df43e42
0x6df43e49
0x6df43e4a
0x6df43e4d
0x00000000
0x6df43e4d
0x6df43e09
0x6df43d86
0x6df43d89
0x6df43d8c
0x6df43d8e
0x6df43e31
0x6df43e31
0x6df43d94
0x00000000
0x6df43d94
0x6df43c91
0x6df43c91
0x6df43c94
0x6df43d23
0x6df43d23
0x6df43d27
0x6df43e16
0x6df43e16
0x6df43d2d
0x6df43d31
0x6dfa01fe
0x6dfa01fe
0x6df43d84
0x6df43d84
0x00000000
0x6df43d84
0x6df43d3d
0x6df43d44
0x6df43d45
0x6df43d48
0x6df43d4f
0x6dfa01de
0x6dfa01de
0x6dfa01e2
0x00000000
0x00000000
0x6dfa01ea
0x6dfa01ea
0x6dfa01eb
0x6dfa01f9
0x00000000
0x6dfa01f9
0x6df43d55
0x6df43d5c
0x00000000
0x00000000
0x6df43d62
0x6df43d66
0x6df43e55
0x6df43e5e
0x6df43e60
0x00000000
0x00000000
0x6df43d75
0x6df43d75
0x6df43d79
0x6df43d7b
0x6df43d7e
0x6dfa01c7
0x6dfa01ca
0x6dfa01cd
0x6dfa01d0
0x6dfa01d3
0x6dfa01d6
0x6dfa01d6
0x6df43d7e
0x00000000
0x6df43d79
0x6df43d6c
0x6df43d72
0x00000000
0x6df43d72
0x6df43c9d
0x6df43ca0
0x6df43cab
0x6df43cae
0x6df43cb1
0x6df43cb5
0x6df43cb7
0x6df43cd2
0x6df43cdb
0x6df43cdb
0x6df43cde
0x6df43ce1
0x6df43ce3
0x6dfa00fa
0x6dfa00fd
0x00000000
0x00000000
0x6dfa0103
0x6dfa0107
0x6dfa0113
0x6dfa0125
0x6dfa012b
0x6dfa012e
0x6dfa0131
0x00000000
0x6dfa0131
0x6dfa0109
0x6dfa010d
0x00000000
0x00000000
0x00000000
0x6df43ce9
0x6df43ce9
0x6df43ce9
0x6df43cee
0x6dfa0139
0x6dfa0149
0x6dfa014f
0x6dfa014f
0x6df43cf4
0x6df43cf9
0x6df43cfb
0x6dfa0160
0x6df43d01
0x6df43d01
0x6df43d01
0x6df43d06
0x6df43d09
0x6dfa0184
0x6dfa0184
0x6df43d0f
0x6df43d16
0x6df43d1e
0x00000000
0x6df43d1e
0x6df43ce3
0x6dfa00ca
0x6df43ddd
0x6df43de0
0x00000000
0x00000000
0x00000000
0x6df43de2
0x6df43c08
0x6df43c0b
0x6df43dc9
0x6df43dcb
0x00000000
0x00000000
0x00000000
0x6df43dcb
0x00000000
0x6df43c0b

APIs

RtlAcquireSRWLockExclusive.9419(00000000,6E01F4D0,00000084,6DF43A18,00000000,?,?), ref: 6DF43B05
RtlReleaseSRWLockExclusive.9419(?,?,00000000,6E01F4D0,00000084,6DF43A18,00000000,?,?), ref: 6DF43B1A
RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,?,00000000,6E01F4D0,00000084,6DF43A18,00000000,?,?), ref: 6DF43C74

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: a703b50f8da5b7957b0939975c974f48bbaf9192a993e0f2d11b53dfcacff0a6
Instruction ID: 14c00ea83ab41c2ea8638cbfc1b8d56e289bb7f7d01f78b0eeaa4273e3f3cc26
Opcode Fuzzy Hash: a703b50f8da5b7957b0939975c974f48bbaf9192a993e0f2d11b53dfcacff0a6
Instruction Fuzzy Hash: 89E11E71E44609DFCB25CFADC980A9DFBF1BF48304F24852AE956A7666D731A840CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6DF7AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x9
					E6DF9D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0x6e038a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1018
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x21
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E6DF896E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E6DFF3C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E6DF896E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E6DF4B150();
							} else {
								E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E6DF4B150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E6E0014FB(_t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E6DF67D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E6E001411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E6DF67D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E6E001411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x6df7ac85
0x6df7ac88
0x6df7ac8a
0x6df7ac8d
0x6df7ac91
0x6df7ac99
0x6df7ac9c
0x6dfb9f57
0x6dfb9f5b
0x6dfb9f60
0x6dfb9f60
0x6df7aca8
0x6df7acae
0x6df7acda
0x6df7acde
0x6df7ace8
0x6df7aceb
0x6df7acee
0x00000000
0x6df7acee
0x6df7acf6
0x6df7acb0
0x6df7acb0
0x6df7acbb
0x6df7acbd
0x6df7acc0
0x6df7acc5
0x6df7adae
0x6df7adb4
0x6df7adb4
0x6df7acd4
0x6df7acd8
0x6df7acf9
0x6df7acff
0x6df7ad04
0x6df7ad08
0x6df7ad09
0x6df7ad10
0x6df7ad12
0x6df7ad18
0x6dfb9f6f
0x6dfb9f74
0x6dfb9f76
0x6dfb9f7c
0x6dfb9f84
0x6dfb9f88
0x6dfb9f89
0x6dfb9f90
0x6dfb9f90
0x6dfb9f76
0x6df7ad1e
0x6df7ad24
0x6df7ad26
0x6dfba097
0x6dfba09b
0x6dfba0ba
0x6dfba0bf
0x6dfba09d
0x6dfba0b2
0x6dfba0b7
0x6dfba0c5
0x6dfba0c8
0x6dfba0cb
0x6dfba0d2
0x00000000
0x6df7ad2c
0x6df7ad2c
0x6df7ad2f
0x6df7ad34
0x6df7ad36
0x6dfb9f97
0x6dfb9f9a
0x00000000
0x00000000
0x6dfb9fa9
0x6df7ad3e
0x6df7ad3e
0x6df7ad41
0x6dfb9fb3
0x6dfb9fb9
0x6dfb9fc0
0x6dfb9fd0
0x6dfb9fd0
0x6dfb9fc0
0x6df7ad4a
0x6df7ad50
0x6df7ad5c
0x6df7ad62
0x6df7ad68
0x6df7ad6b
0x6df7ad6d
0x6dfb9fda
0x6dfb9fdd
0x00000000
0x00000000
0x6dfb9fec
0x00000000
0x6df7ad73
0x6df7ad73
0x6df7ad73
0x6df7ad75
0x6df7ad75
0x6df7ad78
0x6dfb9ff6
0x6dfb9ffc
0x6dfba003
0x6dfba00e
0x6dfba010
0x6dfba01b
0x6dfba01b
0x6dfba01b
0x6dfba038
0x6dfba038
0x6dfba003
0x6df7ad84
0x6df7ad89
0x6df7ad8c
0x6df7ad8e
0x6dfba042
0x6dfba045
0x00000000
0x00000000
0x6dfba054
0x00000000
0x6df7ad94
0x6df7ad94
0x6df7ad94
0x6df7ad96
0x6df7ad96
0x6df7ad99
0x6dfba063
0x6dfba065
0x6dfba070
0x6dfba070
0x6dfba070
0x6dfba08d
0x6dfba08d
0x6df7ada4
0x6df7ada6
0x00000000
0x6df7ada6
0x6df7ad8e
0x6df7ad6d
0x6df7ad3c
0x6df7ad3c
0x00000000
0x6df7ad3c
0x00000000
0x00000000
0x00000000
0x6df7acd8

APIs

ZwFreeVirtualMemory.9419(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6DF7AD0B
RtlFillMemoryUlong.9419(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6DFB9F5B

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6DFBA0CD
HEAP: , xrefs: 6DFBA0BA
HEAP[%wZ]: , xrefs: 6DFBA0AD

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: a0fbae11148a7303bc46f522c58015d61b1953ab0ede25b89f563467ff9e620f
Instruction ID: a084aaa8098476760313f3893f8294d6b95c1b5f0a5fab007f3676e9763a2976
Opcode Fuzzy Hash: a0fbae11148a7303bc46f522c58015d61b1953ab0ede25b89f563467ff9e620f
Instruction Fuzzy Hash: 4B811632244685EFE722CBACD884FA9BBF8FF05314F0545A6E5558B792D774E940CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7D7CA, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DF7D7CA(signed int __ecx, intOrPtr* __edx, char _a4, long* _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				char _v24;
				signed int _v28;
				long _v32;
				char _v36;
				long _v40;
				long _v44;
				void* _v48;
				signed int _v52;
				long _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char* _v76;
				signed int _v80;
				char _v84;
				void* _t70;
				signed int _t77;
				signed int _t83;
				intOrPtr _t97;
				signed int _t99;
				signed int _t100;
				void* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t108;
				long* _t109;
				long _t113;
				void* _t114;
				intOrPtr* _t115;
				signed int _t116;

				_t115 = __edx;
				_t113 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v24 = 0;
				if(__ecx == 0 || __edx == 0 || _a12 == 0) {
					return 0xc000000d;
				} else {
					_t70 = __ecx & 0xfffffffc;
					RtlImageNtHeader(_t70);
					if(_t70 == 0) {
						_t116 = 0xc000007b;
						L27:
						if(_v8 != 0) {
							_push(_v8);
							E6DF895D0();
							_v8 = _t113;
						}
						if(_v16 != 0) {
							_push(_v16);
							_push(0xffffffff);
							E6DF897A0();
						}
						L25:
						return _t116;
					}
					_t104 = 6;
					asm("sbb ebx, ebx");
					_t105 = 2;
					_t102 = (_t100 & _t104) + _t105;
					if(_a4 != 0) {
						_v36 =  *_t115;
						_v32 =  *((intOrPtr*)(_t115 + 4));
						_v20 = 0;
						_v84 = 0x18;
						L33:
						_v80 = _v80 & 0x00000000;
						L10:
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						_v72 = 0x40;
						_v76 =  &_v36;
						_t77 = E6DF7D976( &_v8,  &_v84, _v28);
						_t116 = _t77;
						if(_t113 == 0) {
							_t113 = 0;
							L14:
							if(_t116 < 0) {
								goto L27;
							}
							_push(_v8);
							_push(0x8000000);
							_push(_t102);
							_push(_t113);
							_push(_t113);
							_push(0xf0005);
							_push( &_v12);
							_t116 = E6DF899A0();
							if(_t116 < 0) {
								goto L27;
							}
							_push(_t102);
							_push(_t113);
							_push(1);
							_v44 = _t113;
							_push( &_v24);
							_v40 = _t113;
							_push( &_v44);
							_push(_t113);
							_push(_t113);
							_push( &_v16);
							_push(0xffffffff);
							_push(_v12);
							_t83 = E6DF89780();
							_t116 = _t83;
							if(_v12 != 0) {
								_push(_v12);
								_t83 = E6DF895D0();
								_v12 = _t113;
							}
							if(_t116 < 0) {
								goto L27;
							} else {
								RtlImageNtHeader(_v16);
								if(_t83 == 0) {
									_t116 = 0xc000007b;
								}
								if(_t116 < 0) {
									goto L27;
								} else {
									 *_a12 = _v16;
									_t108 = _a16;
									if(_t108 != 0) {
										 *_t108 = _v24;
									}
									_t109 = _a8;
									if(_t109 == 0) {
										if(_v8 != 0) {
											_push(_v8);
											E6DF895D0();
										}
									} else {
										 *_t109 = _v8;
									}
									goto L25;
								}
							}
						}
						_t114 = _v48;
						if(_t114 != 0) {
							asm("lock xadd [edi], eax");
							if((_t77 | 0xffffffff) != 0) {
								goto L12;
							}
							_push( *((intOrPtr*)(_t114 + 4)));
							E6DF895D0();
							_t113 = 0;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t114);
							L13:
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t113, _v20);
							goto L14;
						}
						L12:
						_t113 = 0;
						goto L13;
					}
					_t116 = E6DF565BA(_t105,  *((intOrPtr*)(_t115 + 4)),  &_v36, 0,  &_v60);
					if(_t116 < 0) {
						goto L27;
					}
					_t97 = _v60;
					_t113 = _v32;
					_v20 = _t113;
					if(_t97 != 0) {
						_v36 = _t97;
						_v32 = _v56;
						_t99 = _v52;
					} else {
						_t99 = 0;
					}
					_v84 = 0x18;
					if(_t113 == 0) {
						goto L33;
					} else {
						_v80 = _t99;
						goto L10;
					}
				}
			}

0x6df7d7d6
0x6df7d7d9
0x6df7d7db
0x6df7d7de
0x6df7d7e1
0x6df7d7e4
0x6df7d7e7
0x6df7d7ec
0x00000000
0x6df7d803
0x6df7d803
0x6df7d807
0x6df7d80e
0x6dfbb180
0x6df7d95a
0x6df7d95e
0x6dfbb203
0x6dfbb206
0x6dfbb20b
0x6dfbb20b
0x6df7d968
0x6dfbb213
0x6dfbb216
0x6dfbb218
0x6dfbb218
0x6df7d94f
0x00000000
0x6df7d94f
0x6df7d816
0x6df7d81d
0x6df7d821
0x6df7d822
0x6df7d828
0x6dfbb18c
0x6dfbb192
0x6dfbb195
0x6dfbb198
0x6dfbb19f
0x6dfbb19f
0x6df7d86f
0x6df7d872
0x6df7d879
0x6df7d883
0x6df7d88a
0x6df7d88d
0x6df7d892
0x6df7d896
0x6dfbb1e5
0x6df7d8bb
0x6df7d8bd
0x00000000
0x00000000
0x6df7d8c3
0x6df7d8c9
0x6df7d8ce
0x6df7d8cf
0x6df7d8d0
0x6df7d8d1
0x6df7d8d6
0x6df7d8dc
0x6df7d8e0
0x00000000
0x00000000
0x6df7d8e2
0x6df7d8e3
0x6df7d8e4
0x6df7d8e9
0x6df7d8ec
0x6df7d8f0
0x6df7d8f3
0x6df7d8f4
0x6df7d8f5
0x6df7d8f9
0x6df7d8fa
0x6df7d8fc
0x6df7d8ff
0x6df7d908
0x6df7d90a
0x6df7d90c
0x6df7d90f
0x6df7d914
0x6df7d914
0x6df7d919
0x00000000
0x6df7d91b
0x6df7d91e
0x6df7d925
0x6df7d96f
0x6df7d96f
0x6df7d929
0x00000000
0x6df7d92b
0x6df7d931
0x6df7d933
0x6df7d938
0x6df7d93d
0x6df7d93d
0x6df7d93f
0x6df7d944
0x6dfbb1f0
0x6dfbb1f6
0x6dfbb1f9
0x6dfbb1f9
0x6df7d94a
0x6df7d94d
0x6df7d94d
0x00000000
0x6df7d944
0x6df7d929
0x6df7d919
0x6df7d89c
0x6df7d8a1
0x6dfbb1bc
0x6dfbb1c0
0x00000000
0x00000000
0x6dfbb1c6
0x6dfbb1c9
0x6dfbb1d5
0x6dfbb1db
0x6df7d8a9
0x6df7d8b6
0x00000000
0x6df7d8b6
0x6df7d8a7
0x6df7d8a7
0x00000000
0x6df7d8a7
0x6df7d83f
0x6df7d843
0x00000000
0x00000000
0x6df7d849
0x6df7d84c
0x6df7d84f
0x6df7d855
0x6dfbb1a8
0x6dfbb1ae
0x6dfbb1b1
0x6df7d85b
0x6df7d85b
0x6df7d85b
0x6df7d85d
0x6df7d866
0x00000000
0x6df7d86c
0x6df7d86c
0x00000000
0x6df7d86c
0x6df7d866

APIs

RtlImageNtHeader.9419(?,00000000,?,02BE0000), ref: 6DF7D807

Part of subcall function 6DF5B060: RtlImageNtHeaderEx.9419(00000001,?,00000000,00000000,?,?,?,6DF7381C,?,6E01FF48,00000050,6DF73E98,?,6DF6F900,00000000,00000000), ref: 6DF5B076

Part of subcall function 6DF565BA: RtlInitUnicodeStringEx.9419(?,?,?), ref: 6DF565CA

RtlFreeHeap.9419(?,00000000,?,?,6DF7D77E,00000000,?,?,00000000,?,02BE0000), ref: 6DF7D8B6
ZwCreateSection.9419(00000000,000F0005,00000000,00000000,02BE0000,08000000,00000000,6DF7D77E,00000000,?,?,00000000,?,02BE0000), ref: 6DF7D8D7
ZwMapViewOfSection.9419(00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000,08000000), ref: 6DF7D8FF
ZwClose.9419(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6DF7D90F
RtlImageNtHeader.9419(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6DF7D91E
ZwClose.9419(00000000,?,6DF7D77E,00000000,?,?,00000000,?,02BE0000), ref: 6DFBB1C9
RtlFreeHeap.9419(?,00000000,?,00000000,?,6DF7D77E,00000000,?,?,00000000,?,02BE0000), ref: 6DFBB1DB

Part of subcall function 6DF7D976: ZwCreateFile.9419(00000000,80100080,00000018,?,00000000,00000000,00000005,00000001,00000000,00000000,00000000,?,02BE0000,00000000,00000000), ref: 6DF7D999

ZwClose.9419(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000), ref: 6DFBB1F9
ZwUnmapViewOfSection.9419(000000FF,00000000,6DF7D77E,00000000,?,?,00000000,?,02BE0000), ref: 6DFBB218

Strings

@, xrefs: 6DF7D883

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHeaderImageSection$CreateFreeHeapView$FileInitStringUnicodeUnmap
String ID: @
API String ID: 3014096824-2766056989
Opcode ID: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction ID: 58ee4694450edfc0377fd77cf03e8d1a056a1eed1d7767da8dcd1f259f8cd795
Opcode Fuzzy Hash: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction Fuzzy Hash: E9615C71D0421AEBDB21CFADDC40BEEBBB5FF85714F11416AE924A7290D7749A01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4395E, Relevance: 19.7, APIs: 13, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DF4395E(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t67;
				void* _t77;
				intOrPtr* _t81;
				signed int _t93;
				void* _t94;
				intOrPtr* _t97;
				intOrPtr* _t104;
				void* _t112;
				long _t113;
				signed int _t114;
				void* _t123;

				_v8 =  *0x6e03d360 ^ _t114;
				_v16 = __edx;
				_t93 = 0;
				_t112 = __ecx;
				_v12 = _v12 & 0;
				E6DF6FAD0( *0x6e0384cc + 4);
				_t110 =  *0x6e0384cc + 8;
				_t97 =  *_t110;
				while(_t97 != _t110) {
					_t113 = _t97 - 0x1c;
					_t67 =  *((intOrPtr*)(_t112 + 0xc));
					if( *((intOrPtr*)(_t113 + 0x10)) !=  *((intOrPtr*)(_t112 + 8)) ||  *((intOrPtr*)(_t113 + 0x14)) != _t67 ||  *((intOrPtr*)(_t113 + 8)) !=  *_t112) {
						L21:
						_t97 =  *_t97;
						continue;
					} else {
						_t69 =  *((intOrPtr*)(_t113 + 0xc));
						if( *((intOrPtr*)(_t113 + 0xc)) !=  *((intOrPtr*)(_t112 + 4))) {
							goto L21;
						}
						_t94 = _t113 + 0x28;
						E6DF62280(_t69, _t94);
						if( *(_t113 + 0x5c) == 2) {
							__eflags = _v16;
							if(_v16 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t113 + 0x58));
								 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
								 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & 0x00000000;
								L8:
								asm("lock inc dword [esi+0x50]");
								 *(_t113 + 0x5c) = 1;
								E6DF5FFB0(_t94, _t112, _t94);
								_t123 =  *0x6e0384cc + 4;
								E6DF6FA00(_t94, _t97, _t112,  *0x6e0384cc + 4);
								while(1) {
									_t95 = 0;
									_t77 = E6DF43ACA(0, _t112, _t113, _t112, _t113, _t123, 0);
									_t124 = _t77 - 0xc000022d;
									if(_t77 == 0xc000022d) {
										_t95 = 0xc000022d;
									}
									_t110 = _t113;
									if(E6DF43ACA(_t95, _t112, _t113, _t112, _t113, _t124, 1) == 0xc000022d) {
										_t93 = 0xc000022d;
									}
									E6DF62280(_t113 + 0x28, _t113 + 0x28);
									_v12 = _v12 + 1;
									_t104 = _t113 + 0x2c;
									_t81 =  *_t104;
									while(_t81 != _t104) {
										 *(_t81 + 0x60) =  *(_t81 + 0x60) & 0x00000000;
										_t81 =  *_t81;
									}
									if( *(_t113 + 0x58) != 0) {
										_t112 =  *(_t113 + 0x58);
										 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
										E6DF5FFB0(_t93, _t112, _t113 + 0x28);
										continue;
									}
									if(_t93 != 0) {
										__eflags = _t93 - 0xc000022d;
										if(_t93 == 0xc000022d) {
											 *(_t113 + 0x58) = _t112;
											 *(_t113 + 0x5c) = 2;
											E6DFD2DA1(_t113);
										}
										L17:
										E6DF5FFB0(_t93, _t112, _t113 + 0x28);
										E6DF7DE9E(_t113);
										L18:
										if(_v12 > 1) {
											_t113 = 0;
											_t49 = _t112 + 8; // 0x8
											_push(0);
											_push(0);
											_push(_t93);
											_push( *((intOrPtr*)(_t112 + 0x18)));
											_push(_t112);
											E6DF8A3A0();
											__eflags = _t93;
											if(_t93 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t112);
											}
											_t93 = 0x80;
										}
										return E6DF8B640(_t93, _t93, _v8 ^ _t114, _t110, _t112, _t113);
									}
									 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & _t93;
									if( *((intOrPtr*)(_t113 + 0x18)) != _t93) {
										__eflags =  *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18));
										if( *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18)) > 0) {
											goto L16;
										}
										goto L17;
									}
									L16:
									 *((intOrPtr*)(_t113 + 0x18)) =  *((intOrPtr*)(_t112 + 0x10));
									goto L17;
								}
							}
							_push(_t94);
							L27:
							E6DF5FFB0(_t94, _t112);
							_t93 = 0x80;
							break;
						}
						if( *(_t113 + 0x5c) == 1) {
							__eflags = _v16;
							_push(_t94);
							if(_v16 != 0) {
								goto L27;
							}
							 *(_t113 + 0x58) = _t112;
							E6DF5FFB0(_t94, _t112);
							_t93 = 0x103;
							break;
						}
						goto L8;
					}
				}
				E6DF6FA00(_t93, _t97, _t112,  *0x6e0384cc + 4);
				goto L18;
			}

0x6df4396d
0x6df4397b
0x6df4397e
0x6df43980
0x6df43982
0x6df43986
0x6df43991
0x6df43994
0x6df43996
0x6df439a1
0x6df439a7
0x6df439aa
0x6df43aa7
0x6df43aa7
0x00000000
0x6df439c4
0x6df439c4
0x6df439ca
0x00000000
0x00000000
0x6df439d0
0x6df439d4
0x6df439dd
0x6df9fffc
0x6dfa0000
0x6dfa0020
0x6dfa0025
0x6dfa0029
0x6df439ed
0x6df439ed
0x6df439f2
0x6df439f9
0x6df43a03
0x6df43a07
0x6df43a0c
0x6df43a0c
0x6df43a13
0x6df43a1d
0x6df43a1f
0x6dfa004b
0x6dfa004b
0x6df43a27
0x6df43a37
0x6dfa0052
0x6dfa0052
0x6df43a41
0x6df43a46
0x6df43a49
0x6df43a4c
0x6df43a4e
0x6df43a9f
0x6df43aa3
0x6df43aa3
0x6df43a56
0x6dfa0059
0x6dfa005f
0x6dfa0064
0x00000000
0x6dfa0064
0x6df43a5e
0x6dfa0073
0x6dfa0075
0x6dfa007d
0x6dfa0080
0x6dfa0087
0x6dfa0087
0x6df43a72
0x6df43a76
0x6df43a7d
0x6df43a82
0x6df43a86
0x6dfa0091
0x6dfa0093
0x6dfa0096
0x6dfa0097
0x6dfa0098
0x6dfa0099
0x6dfa009c
0x6dfa009e
0x6dfa00a3
0x6dfa00a5
0x6dfa00b2
0x6dfa00b2
0x6dfa00b7
0x6dfa00b7
0x6df43a9e
0x6df43a9e
0x6df43a64
0x6df43a6a
0x6df43ac4
0x6df43ac6
0x00000000
0x00000000
0x00000000
0x6df43ac8
0x6df43a6c
0x6df43a6f
0x00000000
0x6df43a6f
0x6df43a0c
0x6dfa0002
0x6dfa0003
0x6dfa0003
0x6dfa0008
0x00000000
0x6dfa0008
0x6df439e7
0x6dfa0032
0x6dfa0036
0x6dfa0037
0x00000000
0x00000000
0x6dfa0039
0x6dfa003c
0x6dfa0041
0x00000000
0x6dfa0041
0x00000000
0x6df439e7
0x6df439aa
0x6df43ab7
0x00000000

APIs

RtlAcquireSRWLockShared.9419(?,00000000,00000000,00000000), ref: 6DF43986
RtlAcquireSRWLockExclusive.9419(?,?,00000000,00000000,00000000), ref: 6DF439D4
RtlReleaseSRWLockExclusive.9419(?), ref: 6DF439F9
RtlReleaseSRWLockShared.9419(?,?), ref: 6DF43A07
RtlAcquireSRWLockExclusive.9419(?,00000001,00000000,?,?), ref: 6DF43A41
RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,00000001,00000000,?,?), ref: 6DF43A76
RtlReleaseSRWLockShared.9419(?,?,00000000,00000000,00000000), ref: 6DF43AB7

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 858fea4f33271858b29b1061879d4a220672f024af0e85a954fc17266060954d
Instruction ID: 876dc08a147b79b218997339bf961a2d3f29034451b051ac8d403de7c0725d95
Opcode Fuzzy Hash: 858fea4f33271858b29b1061879d4a220672f024af0e85a954fc17266060954d
Instruction Fuzzy Hash: 7F517B766857429FD720EF5EC884A6AB7F8FF4531DF00C929E1028BA52C7B4E845CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E6DF6A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x6e038748 - 1;
					if( *0x6e038748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E6DF4B150();
									_t260 = _t257 + 4;
								} else {
									E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E6DF4B150();
								_t257 = _t260 + 4;
								__eflags =  *0x6e037bc8;
								if(__eflags == 0) {
									E6E002073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E6E00A80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E6DF9D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E6DF6AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E6E00A80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E6E00A80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x6e038748 - 1;
					if( *0x6e038748 >= 1) {
						_t131 = _t256 + 0x00000fff & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E6DF4B150();
							} else {
								E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E6DF4B150();
							__eflags =  *0x6e037bc8;
							if(__eflags == 0) {
								_t131 = E6E002073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x6df6a83a
0x6df6a83c
0x6df6a83e
0x6df6a841
0x6df6a844
0x6df6a84a
0x6df6aa53
0x6df6aa59
0x6df6aa59
0x6df6a858
0x6df6a85e
0x6df6aaf5
0x6df6aafc
0x6dfb229e
0x6dfb22a2
0x6dfb22a8
0x6dfb22b3
0x6dfb22b5
0x6dfb22bb
0x6dfb22c1
0x6dfb22c5
0x6dfb22e6
0x6dfb22eb
0x6dfb22f0
0x6dfb22c7
0x6dfb22dc
0x6dfb22e1
0x6dfb22e1
0x6dfb22f3
0x6dfb22f8
0x6dfb22fd
0x6dfb2300
0x6dfb2307
0x6dfb230e
0x6dfb230e
0x6dfb2313
0x6dfb2313
0x6dfb22b5
0x6dfb22a2
0x6df6aafc
0x6df6a864
0x6df6a869
0x6df6aa5c
0x6df6aa5e
0x6df6a86f
0x6df6a87f
0x6df6a885
0x6df6a885
0x6df6a88b
0x6df6a890
0x6df6a896
0x6df6ab0c
0x6df6ab0f
0x6df6ab15
0x6dfb2320
0x6dfb2320
0x6df6ab1b
0x6df6a89c
0x6df6a89f
0x6df6a8a2
0x6df6a8a2
0x6df6a8a5
0x6df6a8af
0x6df6a8b3
0x6df6a8b8
0x6df6aa66
0x6df6a8be
0x6df6a8c5
0x6df6a8c6
0x6df6a8ce
0x6dfb2328
0x6dfb2332
0x6dfb2337
0x6dfb2337
0x6df6a8ce
0x6df6a8d4
0x6df6a8d8
0x6df6a8db
0x6df6a8de
0x6df6a8e1
0x6df6a8e5
0x6df6a8e8
0x6df6a8f0
0x6df6a8f3
0x6dfb234c
0x6dfb2350
0x6dfb2355
0x6dfb2359
0x6dfb2359
0x6df6a8f9
0x6df6a901
0x6df6aae4
0x6df6aae4
0x6df6aaea
0x00000000
0x6df6a907
0x6df6a90a
0x6df6a91d
0x6df6a91d
0x00000000
0x6df6a910
0x6df6a910
0x6df6a910
0x6df6a914
0x6df6a924
0x6df6a924
0x6df6a924
0x6df6a924
0x6df6a916
0x6df6a91b
0x00000000
0x00000000
0x00000000
0x6df6a91b
0x6df6a925
0x6df6a925
0x6df6a932
0x6df6a936
0x6df6a93c
0x6df6a93c
0x6df6a93c
0x6df6ab22
0x6df6ab24
0x6df6ab27
0x6df6ab27
0x6df6a942
0x6df6a944
0x6df6aaba
0x6df6aabd
0x6df6aac0
0x6df6aac0
0x6df6aac2
0x6df6ab2f
0x6df6aac4
0x6df6aac4
0x6df6aac7
0x6df6aaca
0x6df6aacc
0x6df6aace
0x6df6aace
0x6df6aace
0x6df6aad1
0x6df6aad1
0x6df6aad7
0x6df6aad9
0x00000000
0x00000000
0x6dfb2361
0x6dfb2369
0x6dfb236b
0x00000000
0x6dfb2371
0x00000000
0x6dfb2371
0x00000000
0x6dfb236b
0x6df6aac0
0x6df6a94a
0x6df6a94a
0x6df6a94d
0x6df6a94d
0x6df6a950
0x6df6a954
0x6dfb2376
0x6dfb2380
0x6df6a95a
0x6df6a95a
0x6df6a95c
0x6df6a95f
0x6df6a961
0x6df6a961
0x6df6a967
0x6df6a96a
0x6df6a972
0x6df6aa02
0x6df6aa06
0x6df6aa10
0x6df6aa16
0x6df6aa16
0x6df6aa1b
0x6df6aa21
0x6df6aa24
0x6df6aa27
0x6df6aa29
0x6df6aa2c
0x6df6aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6a978
0x6df6a978
0x6df6a97b
0x6df6a981
0x6df6a996
0x6df6a998
0x6df6a99f
0x6df6a9a2
0x6dfb238a
0x6df6a9a8
0x6df6a9a8
0x6df6a9a8
0x6df6a9aa
0x6df6a9ad
0x6df6a9b0
0x6df6a9bb
0x6df6a9be
0x6df6a9c7
0x6df6a9c9
0x6df6a9c9
0x6df6a9cc
0x6df6a9d1
0x6df6aa6d
0x6df6aa70
0x6df6aa73
0x6df6aa75
0x6df6aa79
0x6df6aa7e
0x6df6aa82
0x6df6aa8f
0x6df6aa94
0x6df6aa96
0x6dfb2392
0x6dfb23a1
0x6dfb23a1
0x6df6aa9c
0x6df6aa9f
0x6df6aaa2
0x6df6aaa2
0x6df6aaa8
0x6df6aaab
0x6df6aaaf
0x00000000
0x6df6aab5
0x00000000
0x6df6aab5
0x6df6a9d7
0x6df6a9d7
0x6df6a9da
0x6df6a9e0
0x6df6a9e3
0x6df6a9e6
0x6df6a9e9
0x6df6a9eb
0x6df6a9fd
0x6df6a9fd
0x00000000
0x6df6a9eb
0x00000000
0x00000000
0x00000000
0x6df6a983
0x6df6a983
0x6df6a983
0x6df6a987
0x6df6a995
0x6df6a995
0x6df6a995
0x6df6a995
0x6df6a989
0x6df6a98e
0x00000000
0x6df6a990
0x00000000
0x6df6a990
0x6df6a98e
0x00000000
0x6df6a983
0x6df6a972
0x6df6a90a
0x6df6aa34
0x6df6aa34
0x6df6aa40
0x6df6aa43
0x6df6aa46
0x6df6aa4d
0x6dfb23ab
0x6dfb23b2
0x6dfb23be
0x6dfb23c3
0x6dfb23c5
0x6dfb23cb
0x6dfb23d1
0x6dfb23d5
0x6dfb23f6
0x6dfb23fb
0x6dfb23d7
0x6dfb23ec
0x6dfb23f1
0x6dfb2403
0x6dfb2408
0x6dfb2410
0x6dfb2417
0x6dfb2422
0x6dfb2422
0x6dfb2417
0x6dfb23c5
0x6dfb23b2
0x00000000

APIs

DbgPrint.9419(HEAP[%wZ]: ,-0000002C,-00000018,?,?,?,?,?,?,?,?,?,6DF6A3D0,?,?,-00000018), ref: 6DFB22DC
DbgPrint.9419(((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)),?,?,?,?,?,?,?,?,6DF6A3D0,?,?,-00000018,?), ref: 6DFB22F8

Strings

((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 6DFB22F3
HEAP: , xrefs: 6DFB22E6, 6DFB23F6
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 6DFB2403
HEAP[%wZ]: , xrefs: 6DFB22D7, 6DFB23E7

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 3558298466-1657114761
Opcode ID: 6d2afdd63aad2e1addd16bf2f41e2df0a678fed39f40c1aa087851cc5f122a63
Instruction ID: 8d01c1434798e6cb85fc0b8e85b3a01992e3ff89c0442f9456781af6f69cf4ef
Opcode Fuzzy Hash: 6d2afdd63aad2e1addd16bf2f41e2df0a678fed39f40c1aa087851cc5f122a63
Instruction Fuzzy Hash: 71D1CD30A04296CFDB15CF6CC490BAAB7F1FF49304F25C569E8999BB46E331A941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7C707, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 251
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6DF7C707(signed char __ecx, void __edx, intOrPtr _a4, signed int* _a8, signed int* _a12, void** _a16) {
				signed int _v8;
				char _v532;
				void* _v536;
				signed int _v540;
				void* _v544;
				short _v546;
				void* _v548;
				long _v552;
				signed int* _v556;
				signed int* _v560;
				void** _v564;
				void* _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t97;
				intOrPtr _t98;
				void _t105;
				signed int _t106;
				void** _t108;
				signed int _t109;
				void* _t114;
				void _t120;
				intOrPtr _t121;
				void* _t122;
				void* _t129;
				void* _t130;
				void* _t132;
				signed short _t140;
				void* _t143;
				void* _t148;
				int _t150;
				signed int _t155;

				_t142 = __edx;
				_v8 =  *0x6e03d360 ^ _t155;
				_v556 = _a12;
				_t129 =  &_v532;
				_v560 = _a8;
				_t148 = 0;
				_v564 = _a16;
				_t143 = 0;
				_v540 = __ecx;
				_t132 = 0;
				_v532 = 0;
				_v548 = _v548 & 0;
				_v548 = 0;
				_t97 = 2;
				_v546 = _t97;
				_t98 = _a4;
				_v536 = 0;
				_v552 = 0;
				_v544 = _t129;
				if(_t98 == 0x6df2127c) {
					E6DFD5720(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t149 = 0xc000000d;
					L21:
					return E6DF8B640(_t149, _t129, _v8 ^ _t155, _t142, _t143, _t149);
				}
				if(_v560 != 0) {
					 *_v560 =  *_v560 & 0;
					_t148 = 0;
				}
				if(_v556 != _t132) {
					 *_v556 =  *_v556 & _t132;
					_t148 = _t132;
				}
				if(_v564 != _t132) {
					 *_v564 =  *_v564 & _t143;
					_t132 = _t143;
				}
				if((_v540 & 0xfffffffc) != 0 || _t142 == 0 || _v560 == _t143 || _v556 == _t143) {
					_push(_v556);
					_push(_v560);
					_push(_t142);
					_push(_v540);
					E6DFD5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags                : 0x%lx\nSXS:    Peb                  : %p\nSXS:    ActivationContextData: %p\nSXS:    AssemblyStorageMap   : %p\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t149 = 0xc000000d;
					goto L19;
				} else {
					if(_t98 == 0) {
						L22:
						if(_t98 == 0xfffffffc || (_v540 & 0x00000002) != 0) {
							L24:
							_t43 = _t142 + 0x200; // 0x230
							_t132 = _t43;
							_t105 =  *_t132;
							_t44 = _t142 + 0x204; // 0x234
							_t148 = _t44;
							_v536 = _t132;
							_v552 = _t148;
							if(_t105 == 0) {
								goto L33;
							}
							_t143 =  *((intOrPtr*)(_t105 + 0x18)) + _t105;
							goto L26;
						} else {
							if(_t98 != 0) {
								if((_v540 & 0x00000001) == 0) {
									L26:
									_t142 = 0;
									if( *_t132 == 0 ||  *_t148 != 0) {
										L33:
										_t106 =  *_t148;
										L16:
										_t142 = _v556;
										 *_v556 = _t106;
										 *_v560 =  *_t132;
										_t108 = _v564;
										if(_t108 != 0) {
											 *_t108 = _t143;
										}
										_t149 = 0;
										goto L19;
									} else {
										_t109 =  *(_t143 + 8);
										if(_t109 > 0x3ffffffc) {
											_t149 = 0xc0000095;
											L19:
											if(_t129 != 0 && _t129 !=  &_v532) {
												RtlFreeUnicodeString( &_v548);
											}
											goto L21;
										}
										_t130 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0xc + _t109 * 4);
										if(_t130 == 0) {
											_t149 = 0xc0000017;
											L51:
											_t129 = _v544;
											goto L19;
										}
										_t142 =  *(_t143 + 8);
										_t53 = _t130 + 0xc; // 0xc
										_t114 = E6DF7D4B0(_t130,  *(_t143 + 8), _t53);
										_t149 = _t114;
										if(_t114 < 0) {
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t130);
											goto L51;
										}
										_t148 = _v552;
										asm("lock cmpxchg [esi], ecx");
										if(0 != 0) {
											E6DF470C0(_t130);
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t130);
										}
										_t132 = _v536;
										_t129 = _v544;
										goto L33;
									}
								}
							}
							_t57 = _t142 + 0x1f8; // 0x228
							_t132 = _t57;
							_t120 =  *_t132;
							_t58 = _t142 + 0x1fc; // 0x22c
							_t148 = _t58;
							_v536 = _t132;
							_v552 = _t148;
							if(_t120 == 0) {
								goto L33;
							}
							_t143 =  *((intOrPtr*)(_t120 + 0x18)) + _t120;
							_v568 = _t143;
							if( *_t148 != 0) {
								goto L26;
							}
							_t121 =  *((intOrPtr*)(_t142 + 0x10));
							_t142 = 0x208;
							_t140 =  *(_t121 + 0x38);
							_t143 =  *(_t121 + 0x3c);
							_t150 = _t140 & 0x0000ffff;
							_v540 = _t140;
							_t67 = _t150 + 0xe; // 0x23a
							_t122 = _t67;
							if(_t122 > 0x208) {
								if(_t122 <= 0xfffe) {
									_t81 = _t140 + 0xe; // 0x6df56175
									_v546 = _t81;
									_t129 = E6DF63A1C(_t81 & 0x0000ffff);
									_v544 = _t129;
									if(_t129 != 0) {
										L39:
										memcpy(_t129, _t143, _t150);
										_t132 = _v536;
										_v548 = _v540 + 0xc;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsw");
										_t143 = _v568;
										_t148 = _v552;
										goto L26;
									}
									_t149 = 0xc0000017;
									goto L21;
								}
								_t149 = 0xc0000106;
								goto L21;
							}
							_t129 =  &_v532;
							_v546 = 0x208;
							_v544 = _t129;
							goto L39;
						}
					}
					if(_t98 == 0xfffffffc) {
						goto L24;
					}
					if((_v540 & 0x00000003) != 0) {
						goto L22;
					}
					_t33 = _t98 + 0x10; // 0x10
					_t132 = _t33;
					_t142 =  *_t132;
					if(_t142 == 0) {
						_t149 = 0xc00000e5;
						goto L21;
					}
					_t143 =  *((intOrPtr*)(_t142 + 0x18)) + _t142;
					_t106 = _t98 + 0x5c;
					goto L16;
				}
			}

0x6df7c707
0x6df7c719
0x6df7c720
0x6df7c726
0x6df7c730
0x6df7c736
0x6df7c73c
0x6df7c742
0x6df7c746
0x6df7c74c
0x6df7c74e
0x6df7c755
0x6df7c75b
0x6df7c764
0x6df7c765
0x6df7c76c
0x6df7c76f
0x6df7c775
0x6df7c77b
0x6df7c786
0x6dfba7ef
0x6dfba7f7
0x6df7c84b
0x6df7c85d
0x6df7c85d
0x6df7c792
0x6df7c79a
0x6df7c79c
0x6df7c79c
0x6df7c7a4
0x6df7c7ac
0x6df7c7ae
0x6df7c7ae
0x6df7c7b6
0x6df7c7be
0x6df7c7c0
0x6df7c7c0
0x6df7c7cc
0x6dfba8a6
0x6dfba8ac
0x6dfba8b2
0x6dfba8b3
0x6dfba8c7
0x6dfba8cf
0x00000000
0x6df7c7f2
0x6df7c7f4
0x6df7c860
0x6df7c863
0x6df7c872
0x6df7c872
0x6df7c872
0x6df7c878
0x6df7c87a
0x6df7c87a
0x6df7c880
0x6df7c886
0x6df7c88e
0x00000000
0x00000000
0x6df7c893
0x00000000
0x6df7c90f
0x6df7c911
0x6dfba812
0x6df7c895
0x6df7c895
0x6df7c899
0x6df7c908
0x6df7c908
0x6df7c819
0x6df7c819
0x6df7c81f
0x6df7c829
0x6df7c82b
0x6df7c833
0x6df7c835
0x6df7c835
0x6df7c837
0x00000000
0x6df7c89f
0x6df7c89f
0x6df7c8a7
0x6dfba85b
0x6df7c839
0x6df7c83b
0x6dfba8e0
0x6dfba8e0
0x00000000
0x6df7c83b
0x6df7c8c4
0x6df7c8c8
0x6dfba865
0x6dfba87e
0x6dfba87e
0x00000000
0x6dfba87e
0x6df7c8ce
0x6df7c8d1
0x6df7c8d7
0x6df7c8dc
0x6df7c8e0
0x6dfba879
0x00000000
0x6dfba879
0x6df7c8e6
0x6df7c8f0
0x6df7c8f6
0x6dfba88b
0x6dfba89c
0x6dfba89c
0x6df7c8fc
0x6df7c902
0x00000000
0x6df7c902
0x6df7c899
0x6dfba818
0x6df7c917
0x6df7c917
0x6df7c91d
0x6df7c91f
0x6df7c91f
0x6df7c925
0x6df7c92b
0x6df7c933
0x00000000
0x00000000
0x6df7c938
0x6df7c93d
0x6df7c943
0x00000000
0x00000000
0x6df7c949
0x6df7c94c
0x6df7c951
0x6df7c954
0x6df7c957
0x6df7c95a
0x6df7c960
0x6df7c960
0x6df7c965
0x6dfba822
0x6dfba82e
0x6dfba831
0x6dfba841
0x6dfba843
0x6dfba84b
0x6df7c97e
0x6df7c981
0x6df7c994
0x6df7c99a
0x6df7c9a9
0x6df7c9aa
0x6df7c9ab
0x6df7c9ac
0x6df7c9ae
0x6df7c9b4
0x00000000
0x6df7c9b4
0x6dfba851
0x00000000
0x6dfba851
0x6dfba824
0x00000000
0x6dfba824
0x6df7c96b
0x6df7c971
0x6df7c978
0x00000000
0x6df7c978
0x6df7c863
0x6df7c7f9
0x00000000
0x00000000
0x6df7c802
0x00000000
0x00000000
0x6df7c804
0x6df7c804
0x6df7c807
0x6df7c80b
0x6dfba801
0x00000000
0x6dfba801
0x6df7c814
0x6df7c816
0x00000000
0x6df7c816

APIs

RtlAllocateHeap.9419(?,00000000,?,?,?,00000002), ref: 6DF7C8BF
memcpy.9419(00000000,?,0000022C,E850CF8B,?,?,00000002), ref: 6DF7C981
DbgPrintEx.9419(00000033,00000000,SXS: %s() passed the empty activation context,RtlpGetActivationContextDataStorageMapAndRosterHeader,?,?,00000002), ref: 6DFBA7EF

Strings

RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 6DFBA7E1, 6DFBA8B9
.Local, xrefs: 6DF7C9A4
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 6DFBA8BE
SXS: %s() passed the empty activation context, xrefs: 6DFBA7E6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrintmemcpy
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 3847278171-1239276146
Opcode ID: 9d52c0e202adde929cb58b9bf82fbb3585d09aac275324acc406dc704d1e77f8
Instruction ID: 612dc0c0e2e663502ed5340e0133b927b8d13ac3bcc8a8921b110b448e633e5c
Opcode Fuzzy Hash: 9d52c0e202adde929cb58b9bf82fbb3585d09aac275324acc406dc704d1e77f8
Instruction Fuzzy Hash: 0DA19C3194122A9BDB21CF5DE884BE9B3B1BF59318F1181EAD818A7251D770DE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF80F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DF80F48(signed short* __ecx, long* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed short* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed short _v36;
				signed int _v40;
				long* _v48;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				intOrPtr _v60;
				void* _v64;
				void* _t60;
				void* _t66;
				void* _t69;
				void* _t72;
				intOrPtr _t87;
				char _t93;
				signed int* _t95;
				intOrPtr _t97;
				signed int _t101;
				intOrPtr _t104;
				signed int _t107;
				signed short _t109;
				char _t110;
				intOrPtr _t111;
				intOrPtr* _t114;
				intOrPtr _t116;
				void* _t117;
				signed int _t118;
				void* _t120;

				_t120 = (_t118 & 0xfffffff8) - 0x3c;
				_v48 = __edx;
				_t87 = _a4;
				 *_a8 = 0;
				_t107 =  *__ecx & 0x0000ffff;
				_v52 = 0;
				_v56 = 0;
				_v57 = 0;
				_t101 = _t107;
				_t114 = __ecx[2] + _t101;
				_v40 = __ecx;
				if(_t87 != 0) {
					if(_t101 + 2 > (__ecx[1] & 0x0000ffff)) {
						L28:
						_t60 = 0xc000000d;
						goto L16;
					}
					_t93 = 0;
					if( *_t114 == 0) {
						goto L2;
					}
					goto L28;
				} else {
					_t93 = 0;
					L2:
					if(_t101 == 0) {
						L7:
						_t109 = _t107 - _t101;
						_v32 = _t114;
						_v36 = _t109;
						if((_t109 & 0x0000ffff) != _t109) {
							_t60 = 0xc0000023;
							L16:
							return _t60;
						}
						if(_t87 != 0) {
							_t116 = _v48;
							_v58 = 1;
							_t60 = E6DF810D7( &_v52, _t116, _t87);
						} else {
							_v58 = _t93;
							_t60 = E6DF8108B( &_v52);
							_t116 = _v48;
						}
						if(_t60 < 0) {
							goto L16;
						} else {
							_t110 = _v52;
							_v20 =  &_v36;
							_v28 = 0x18;
							_v24 = _t110;
							_v16 = 0x240;
							_v12 = 0;
							_v8 = 0;
							if(_t87 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6DF896D0();
							} else {
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6DF89600();
							}
							_t117 = _t66;
							if(_v58 != 0) {
								_push(_t110);
								E6DF895D0();
							}
							if(_t117 >= 0) {
								_t95 =  &_v52;
								_v52 = _v56;
								_t69 = E6DF48239(_t95, _v48, _v40);
								_t111 = _v56;
								_t117 = _t69;
								if(_t117 < 0) {
									L24:
									if(_t111 != 0) {
										_push(_t111);
										E6DF895D0();
									}
									goto L15;
								}
								_t104 = _v56;
								if(_v57 != 0 && _t111 == _t104 && _t87 != 0) {
									_push(_t95);
									_v52 = 0;
									_t72 = E6DFD8372( &_v52, _t104, _v48);
									_t111 = _v60;
									_t117 = _t72;
									if(_t117 >= 0) {
										_t117 = E6DF56D30( &_v52, L"FilterFullPath");
										if(_t117 >= 0) {
											_t97 =  *((intOrPtr*)(_t120 + 0x24));
											_push( *(_t97 + 2) & 0x0000ffff);
											_push( *((intOrPtr*)(_t97 + 4)));
											_push(1);
											_push(0);
											_push( &_v52);
											_push(_t111);
											_t117 = E6DF89B00();
											if(_t117 >= 0) {
												 *((intOrPtr*)(_t120 + 0x28)) = 1;
												_t117 = E6DF56D30( &_v52, L"UseFilter");
												if(_t117 >= 0) {
													_push(4);
													_push(_t120 + 0x28);
													_push(4);
													_push(0);
													_push( &_v52);
													_push(_v60);
													_t117 = E6DF89B00();
												}
											}
										}
									}
									_push(_v60);
									E6DF895D0();
								}
								if(_t117 < 0) {
									goto L24;
								} else {
									 *_a8 = _t111;
									goto L15;
								}
							} else {
								L15:
								_t60 = _t117;
								goto L16;
							}
						}
					}
					L3:
					L3:
					if( *((short*)(_t114 - 2)) == 0x5c) {
						_v57 = 1;
					} else {
						goto L4;
					}
					goto L7;
					L4:
					_t114 = _t114 + 0xfffffffe;
					_t101 = _t101;
					if(_t101 != 0) {
						goto L3;
					} else {
						goto L7;
					}
				}
			}

0x6df80f50
0x6df80f55
0x6df80f5f
0x6df80f63
0x6df80f69
0x6df80f6c
0x6df80f70
0x6df80f74
0x6df80f78
0x6df80f7a
0x6df80f7c
0x6df80f82
0x6dfbcc82
0x6dfbcc8f
0x6dfbcc8f
0x00000000
0x6dfbcc8f
0x6dfbcc84
0x6dfbcc89
0x00000000
0x00000000
0x00000000
0x6df80f88
0x6df80f88
0x6df80f8a
0x6df80f8c
0x6df80fa5
0x6df80fa5
0x6df80fa7
0x6df80fae
0x6df80fb5
0x6dfbcc99
0x6df81029
0x6df8102f
0x6df8102f
0x6df80fbd
0x6dfbcca3
0x6dfbccae
0x6dfbccb3
0x6df80fc3
0x6df80fc3
0x6df80fcb
0x6df80fd0
0x6df80fd0
0x6df80fd6
0x00000000
0x6df80fd8
0x6df80fd8
0x6df80fe0
0x6df80fe6
0x6df80fee
0x6df80ff2
0x6df80ffa
0x6df80ffe
0x6df81004
0x6dfbccbd
0x6dfbccbe
0x6dfbccbf
0x6dfbccc0
0x6dfbccc5
0x6dfbccc6
0x6dfbcccb
0x6dfbcccc
0x6df8100a
0x6df8100e
0x6df8100f
0x6df81014
0x6df81015
0x6df81015
0x6df8101f
0x6df81021
0x6df81077
0x6df81078
0x6df81078
0x6df81025
0x6df81036
0x6df81042
0x6df81046
0x6df8104b
0x6df8104f
0x6df81053
0x6df8107f
0x6df81081
0x6df81083
0x6df81084
0x6df81084
0x00000000
0x6df81081
0x6df8105a
0x6df8105e
0x6dfbccd6
0x6dfbcce1
0x6dfbcce5
0x6dfbccea
0x6dfbccee
0x6dfbccf2
0x6dfbcd03
0x6dfbcd07
0x6dfbcd09
0x6dfbcd11
0x6dfbcd12
0x6dfbcd19
0x6dfbcd1b
0x6dfbcd1c
0x6dfbcd1d
0x6dfbcd23
0x6dfbcd27
0x6dfbcd32
0x6dfbcd40
0x6dfbcd44
0x6dfbcd46
0x6dfbcd4c
0x6dfbcd4d
0x6dfbcd4f
0x6dfbcd54
0x6dfbcd55
0x6dfbcd5e
0x6dfbcd5e
0x6dfbcd44
0x6dfbcd27
0x6dfbcd07
0x6dfbcd60
0x6dfbcd64
0x6dfbcd64
0x6df8106e
0x00000000
0x6df81070
0x6df81073
0x00000000
0x6df81073
0x6df81027
0x6df81027
0x6df81027
0x00000000
0x6df81027
0x6df81025
0x6df80fd6
0x00000000
0x6df80f8e
0x6df80f93
0x6df80fa0
0x00000000
0x00000000
0x00000000
0x00000000
0x6df80f95
0x6df80f95
0x6df80f99
0x6df80f9c
0x00000000
0x6df80f9e
0x00000000
0x6df80f9e
0x6df80f9c

APIs

ZwOpenKey.9419(?,?,00000018), ref: 6DF81015
ZwClose.9419(?,?,?,00000018), ref: 6DF81078
ZwClose.9419(?,?,?,?,?,00000018), ref: 6DF81084

Strings

FilterFullPath, xrefs: 6DFBCCF4
UseFilter, xrefs: 6DFBCD29

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: fa97e1f963f2621d1aa2868da9e755996ff2b70fb1608251eef5306a39a7b5b5
Instruction ID: e285ff7087cc880093d29d8b3c798ca413ae5b6b1c89d376b0a956ebc3fd1257
Opcode Fuzzy Hash: fa97e1f963f2621d1aa2868da9e755996ff2b70fb1608251eef5306a39a7b5b5
Instruction Fuzzy Hash: B861B1725083929BD311CF2DC840A6BBBF8BFC9718F054A2DF99497252E771D9098B93

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF64FB, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 125
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DFF64FB(intOrPtr* __ecx) {
				signed int _v8;
				char _v32;
				short _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char* _v52;
				short _v54;
				void* _v56;
				char* _v60;
				char _v64;
				char* _v68;
				short _v70;
				char _v72;
				char* _v76;
				short _v78;
				void* _v80;
				char* _v84;
				short _v86;
				void* _v88;
				char* _v92;
				short _v94;
				void* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char* _v112;
				intOrPtr _v116;
				char _v120;
				char _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t48;
				short _t49;
				void* _t50;
				short _t51;
				void* _t55;
				void* _t62;
				void* _t77;
				short _t81;
				short _t82;
				intOrPtr* _t83;
				signed int _t85;

				_v8 =  *0x6e03d360 ^ _t85;
				_t48 = 0x16;
				_t82 = 0x18;
				_t83 = __ecx;
				_v72 = _t48;
				_t77 = 0x10;
				_t49 = 0x12;
				_v86 = _t49;
				_v94 = _t49;
				_t50 = 0xa;
				_v80 = _t50;
				_t51 = 0xc;
				_v78 = _t51;
				_v112 =  &_v64;
				_push( &_v120);
				_v88 = _t77;
				_v96 = _t77;
				_push(1);
				_push( &_v48);
				_v64 = 0x840082;
				_v60 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions";
				_v70 = _t82;
				_v68 = L"ProductType";
				_v84 = L"LanmanNt";
				_v92 = L"ServerNt";
				_v76 = L"WinNt";
				_v48 = 0;
				_v120 = _t82;
				_v116 = 0;
				_v108 = 0x240;
				_v104 = 0;
				_v100 = 0;
				_t55 = E6DF89600();
				_t84 = _t55;
				if(_t55 >= 0) {
					_push( &_v124);
					_push(0x24);
					_push( &_v44);
					_push(2);
					_push( &_v72);
					_push(_v48);
					_t62 = E6DF89650();
					_t84 = _t62;
					if(_t62 >= 0) {
						if(_v40 != 1) {
							L10:
							_t84 = 0xc000090b;
						} else {
							_t81 = _v36;
							if(_t81 < 2) {
								goto L10;
							} else {
								_v54 = _t81;
								_v52 =  &_v32;
								_t35 = _t81 - 2; // 0x6dfb6635
								_v56 = _t35;
								if(RtlEqualUnicodeString( &_v56,  &_v80, 1) == 0) {
									if(RtlEqualUnicodeString( &_v56,  &_v88, 1) == 0) {
										if(RtlEqualUnicodeString( &_v56,  &_v96, 1) == 0) {
											goto L10;
										} else {
											 *_t83 = 3;
										}
									} else {
										 *_t83 = 2;
									}
								} else {
									 *_t83 = 1;
								}
							}
						}
					}
				}
				if(_v48 != 0) {
					_push(_v48);
					E6DF895D0();
				}
				return E6DF8B640(_t84, 1, _v8 ^ _t85, _t82, _t83, _t84);
			}

0x6dff650a
0x6dff6512
0x6dff6515
0x6dff6518
0x6dff651a
0x6dff651e
0x6dff6521
0x6dff6524
0x6dff652a
0x6dff652f
0x6dff6532
0x6dff6536
0x6dff6537
0x6dff653e
0x6dff6544
0x6dff6545
0x6dff654c
0x6dff6552
0x6dff6553
0x6dff6554
0x6dff655b
0x6dff6562
0x6dff6566
0x6dff656d
0x6dff6574
0x6dff657b
0x6dff6582
0x6dff6585
0x6dff6588
0x6dff658b
0x6dff6592
0x6dff6595
0x6dff6598
0x6dff659d
0x6dff65a1
0x6dff65aa
0x6dff65ab
0x6dff65b0
0x6dff65b1
0x6dff65b6
0x6dff65b7
0x6dff65ba
0x6dff65bf
0x6dff65c3
0x6dff65c8
0x6dff662d
0x6dff662d
0x6dff65ca
0x6dff65ca
0x6dff65d0
0x00000000
0x6dff65d2
0x6dff65d5
0x6dff65d9
0x6dff65dc
0x6dff65df
0x6dff65f3
0x6dff6609
0x6dff6623
0x00000000
0x6dff6625
0x6dff6625
0x6dff6625
0x6dff660b
0x6dff660b
0x6dff660b
0x6dff65f5
0x6dff65f5
0x6dff65f5
0x6dff65f3
0x6dff65d0
0x6dff65c8
0x6dff65c3
0x6dff6636
0x6dff6638
0x6dff663b
0x6dff663b
0x6dff6652

APIs

ZwOpenKey.9419(?,00000001,?,00000124,00000000,00000000), ref: 6DFF6598

Part of subcall function 6DF89600: LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

ZwQueryValueKey.9419(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6DFF65BA
RtlEqualUnicodeString.9419(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6DFF65EC
RtlEqualUnicodeString.9419(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6DFF6602
ZwClose.9419(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6DFF663B

Strings

ProductType, xrefs: 6DFF6566
LanmanNt, xrefs: 6DFF656D
ServerNt, xrefs: 6DFF6574
WinNt, xrefs: 6DFF657B
\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6DFF655B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-2051245877
Opcode ID: 44e7c6c82c75e15524f8f4fb6a9a427e69d12d9536631ba20325df3dae3750d0
Instruction ID: 56a1259a533f9b154ec89ce750d47b1bfff5e8ba62998d5828e380a75fee10fb
Opcode Fuzzy Hash: 44e7c6c82c75e15524f8f4fb6a9a427e69d12d9536631ba20325df3dae3750d0
Instruction Fuzzy Hash: 38414D72D0424CAADF10CFE8D985ADEB7B8FF44304F11412AE615BB250EB719D05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6DF62D50, Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 397
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E6DF62D50(signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20) {
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int _v48;
				intOrPtr _v52;
				char _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				char _v89;
				void* _v96;
				void* _v100;
				void* _v113;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t131;
				signed int _t134;
				intOrPtr _t139;
				void* _t140;
				signed int _t150;
				signed int _t156;
				intOrPtr* _t167;
				intOrPtr _t168;
				signed int _t169;
				void* _t174;
				intOrPtr _t175;
				signed int _t176;
				void* _t177;
				intOrPtr _t179;
				signed int _t180;
				signed int _t184;
				intOrPtr _t189;
				void* _t200;
				intOrPtr* _t201;
				intOrPtr _t210;
				signed int _t211;
				void* _t212;
				void* _t224;
				intOrPtr _t226;
				signed int _t227;
				void* _t228;
				void* _t230;
				signed int _t231;
				signed int _t232;
				void* _t233;
				signed int _t237;
				signed int _t239;

				_t239 = (_t237 & 0xfffffff8) - 0x44;
				_v8 =  *0x6e03d360 ^ _t239;
				_t184 =  *[fs:0x18];
				_t131 =  *((intOrPtr*)(_t184 + 0x30));
				if( *((intOrPtr*)(_t131 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t131 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t184 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t132 = 0xc0150001;
						goto L33;
					}
				} else {
					L1:
					_v48 = 0;
					_v12 = 0xffffffff;
					_v16 = 0;
					if(_a16 == 0) {
						L81:
						_t132 = 0xc000000d;
						goto L33;
					} else {
						_t222 = _a4;
						if((_t222 & 0xfffffff8) != 0) {
							goto L81;
						} else {
							_t134 = _a20;
							if((_t222 & 0x00000007) == 0) {
								if(_t134 != 0) {
									goto L5;
								} else {
									goto L6;
								}
							} else {
								if(_t134 == 0) {
									goto L81;
								} else {
									L5:
									if( *_t134 < 0x24) {
										goto L81;
									} else {
										L6:
										if((_t222 & 0x00000002) == 0) {
											L9:
											if((_t222 & 0x00000004) != 0) {
												if(_t134 + 0x40 <=  *_t134 + _t134) {
													goto L10;
												} else {
													_push(0xc000000d);
													_push("RtlpFindActivationContextSection_CheckParameters");
													_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
													goto L80;
												}
											} else {
												L10:
												_t231 = _a8;
												_v36 = _t222;
												_t222 =  *[fs:0x18];
												_v28 = _a12;
												_v24 = 0;
												_t175 = _v24;
												_t189 =  *((intOrPtr*)(_t222 + 0x30));
												_v40 = 0x18;
												_v20 = 0;
												_v32 = _t231;
												_v64 = 0;
												_v60 = _t222;
												_v52 = _t189;
												while(1) {
													_t139 = _t175;
													if(_t139 != 0) {
														goto L34;
													}
													_t167 =  *((intOrPtr*)(_t222 + 0x1a8));
													if(_t167 == 0) {
														L14:
														_t226 =  *((intOrPtr*)(_t189 + 0x1f8));
														_v64 = 0;
														if(_t226 == 0) {
															L36:
															_t226 =  *((intOrPtr*)(_t189 + 0x200));
															_v64 = 0xfffffffc;
															if(_t226 == 0) {
																L86:
																if(_t175 <= 3) {
																	goto L16;
																} else {
																	_t132 = 0xc00000e5;
																	goto L89;
																}
															} else {
																_t175 = 3;
																_v24 = 3;
																goto L16;
															}
														} else {
															_t175 = 2;
															_v24 = 2;
															goto L16;
														}
													} else {
														_t168 =  *_t167;
														if(_t168 != 0) {
															_t169 =  *((intOrPtr*)(_t168 + 4));
															_v64 = _t169;
															if(_t169 == 0) {
																L58:
																if(_t226 == 0) {
																	goto L14;
																} else {
																	goto L59;
																}
															} else {
																if(_t169 == 0xfffffffc) {
																	_t226 =  *((intOrPtr*)(_t189 + 0x200));
																	goto L58;
																} else {
																	if(_t169 == 0xfffffffd) {
																		_t226 = "Actx ";
																		L59:
																		_t175 = 1;
																		_v24 = 1;
																		L16:
																		if(_t226 == 0) {
																			_t132 = 0xc0150001;
																			L89:
																			_t232 = 0;
																			goto L90;
																		} else {
																			_t222 = _t231;
																			_t132 = E6DF631F0(_t226, _t231, _a12,  &_v56,  &_v48);
																			if(_t132 < 0) {
																				_t232 = 0;
																				if(_t132 != 0xc0150001 || _t175 == 3) {
																					goto L19;
																				} else {
																					_t189 = _v52;
																					_t222 = _v60;
																					_t231 = _a8;
																					continue;
																				}
																			} else {
																				_t222 = _v64;
																				_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																				asm("sbb esi, esi");
																				_t232 =  ~(_t222 - 0xfffffffc) & _t222;
																				_t132 = 0;
																				L19:
																				if(_t132 < 0) {
																					L90:
																					if(_t132 < 0) {
																						goto L33;
																					} else {
																						goto L20;
																					}
																				} else {
																					L20:
																					_t176 = _v48;
																					if(_t176 < 0x2c) {
																						L104:
																						_t142 = _v56;
																						goto L105;
																					} else {
																						_t227 = _a20;
																						while(1) {
																							L22:
																							_t142 = _v56;
																							if( *_v56 != 0x64487353) {
																								break;
																							}
																							_t239 = _t239 - 8;
																							_t222 = _t176;
																							_push( &_v16);
																							_push( &_v12);
																							_push(_t227);
																							_push(_a16);
																							_t132 = E6DF63360(_t142, _t176);
																							if(_t132 >= 0) {
																								_t85 = _t232 - 1; // -1
																								if((_t85 | 0x00000007) != 0xffffffff) {
																									_t150 =  *(_t232 + 0x14);
																									 *(_t239 + 0x28) = _t150;
																									if(_t150 != 0 && (( *(_t232 + 0x1c) & 0x00000008) == 0 || ( *(_t232 + 0x3c) & 0x00000008) == 0)) {
																										 *((char*)(_t239 + 0x13)) = 0;
																										 *0x6e03b1e0(3, _t232,  *((intOrPtr*)(_t232 + 0x10)),  *((intOrPtr*)(_t232 + 0x18)), 0, _t239 + 0x13);
																										 *((intOrPtr*)(_t239 + 0x40))();
																										 *(_t232 + 0x1c) =  *(_t232 + 0x1c) | 0x00000008;
																										if(_v89 != 0) {
																											 *(_t232 + 0x3c) =  *(_t232 + 0x3c) | 0x00000008;
																										}
																									}
																								}
																								if(_t227 == 0) {
																									L66:
																									_pop(_t228);
																									_pop(_t233);
																									_pop(_t177);
																									return E6DF8B640(0, _t177, _v8 ^ _t239, _t222, _t228, _t233);
																								} else {
																									_t148 = _v56;
																									_t222 = _t227;
																									if(E6DF6FD1F(_a4, _t227, _t232,  &_v40, _v56,  *((intOrPtr*)(_v56 + 0x24)),  *((intOrPtr*)(_t148 + 0x28)), _t176) < 0) {
																										goto L33;
																									} else {
																										goto L66;
																									}
																								}
																							} else {
																								if(_t132 != 0xc0150008) {
																									L33:
																									_pop(_t224);
																									_pop(_t230);
																									_pop(_t174);
																									return E6DF8B640(_t132, _t174, _v8 ^ _t239, _t222, _t224, _t230);
																								} else {
																									_t222 =  *[fs:0x18];
																									_t232 = 0;
																									_v64 = 0;
																									 *(_t239 + 0x28) = _t222;
																									_v60 = 0;
																									_v52 =  *((intOrPtr*)(_t222 + 0x30));
																									_t179 = _v24;
																									L26:
																									while(1) {
																										if(_t179 <= 2) {
																											_t200 = _t179 - _t232;
																											if(_t200 == 0) {
																												_t201 =  *((intOrPtr*)(_t222 + 0x1a8));
																												if(_t201 == 0) {
																													goto L67;
																												} else {
																													_t210 =  *_t201;
																													if(_t210 == 0) {
																														goto L67;
																													} else {
																														_t211 =  *((intOrPtr*)(_t210 + 4));
																														_v60 = _t211;
																														if(_t211 == 0) {
																															L101:
																															if(_t156 == 0) {
																																goto L67;
																															} else {
																																goto L102;
																															}
																														} else {
																															if(_t211 != 0xfffffffc) {
																																if(_t211 != 0xfffffffd) {
																																	_t156 =  *(_t211 + 0x10);
																																	goto L100;
																																} else {
																																	_t156 = "Actx ";
																																	_v64 = _t156;
																																	L102:
																																	_t179 = 1;
																																	_v24 = 1;
																																	goto L28;
																																}
																															} else {
																																_t156 =  *(_v52 + 0x200);
																																L100:
																																_v64 = _t156;
																																goto L101;
																															}
																														}
																													}
																												}
																											} else {
																												_t212 = _t200 - 1;
																												if(_t212 == 0) {
																													L67:
																													_v60 = 0;
																													_t156 =  *(_v52 + 0x1f8);
																													_v64 = _t156;
																													if(_t156 == 0) {
																														goto L44;
																													} else {
																														_t179 = 2;
																														_v24 = 2;
																														goto L28;
																													}
																												} else {
																													if(_t212 != 1) {
																														goto L27;
																													} else {
																														L44:
																														_v60 = 0xfffffffc;
																														_t156 =  *(_v52 + 0x200);
																														_v64 = _t156;
																														if(_t156 == 0) {
																															goto L27;
																														} else {
																															_t179 = 3;
																															_v24 = 3;
																															goto L28;
																														}
																													}
																												}
																											}
																										} else {
																											L27:
																											if(_t179 > 3) {
																												_t132 = 0xc00000e5;
																												goto L30;
																											} else {
																												L28:
																												if(_t156 != 0) {
																													_t222 = _a8;
																													_t132 = E6DF631F0(_t156, _a8, _a12,  &_v56,  &_v48);
																													if(_t132 < 0) {
																														if(_t132 != 0xc0150001 || _t179 == 3) {
																															_t180 = 0;
																															goto L48;
																														} else {
																															_t156 = _v64;
																															_t222 =  *(_t239 + 0x28);
																															continue;
																														}
																													} else {
																														_t222 = _v60;
																														_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																														asm("sbb ebx, ebx");
																														_t180 =  ~(_t222 - 0xfffffffc) & _t222;
																														_t132 = 0;
																														L48:
																														if(_t132 < 0) {
																															goto L31;
																														} else {
																															E6DF6F830(_t132, _t180);
																															_t232 = _t180;
																															goto L50;
																														}
																													}
																												} else {
																													_t132 = 0xc0150001;
																													L30:
																													if(_t132 >= 0) {
																														L50:
																														_t176 = _v48;
																														if(_t176 >= 0x2c) {
																															goto L22;
																														} else {
																															goto L104;
																														}
																													} else {
																														L31:
																														if(_t132 == 0xc0150001) {
																															_t132 = 0xc0150008;
																														}
																														goto L33;
																													}
																												}
																											}
																										}
																										goto L106;
																									}
																								}
																							}
																							goto L106;
																						}
																						L105:
																						_push(_t176);
																						E6DFD5720(0x33, 0, "RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section\n", _t142);
																						_t239 = _t239 + 0x14;
																						_t132 = 0xc0150003;
																						goto L33;
																					}
																				}
																			}
																		}
																	} else {
																		_t226 =  *((intOrPtr*)(_t169 + 0x10));
																		goto L58;
																	}
																}
															}
														} else {
															goto L14;
														}
													}
													goto L106;
													L34:
													_t140 = _t139 - 1;
													if(_t140 == 0) {
														goto L14;
													} else {
														if(_t140 != 1) {
															goto L86;
														} else {
															goto L36;
														}
													}
													goto L106;
												}
											}
										} else {
											if(_t134 + 0x2c >  *_t134 + _t134) {
												_push(0xc000000d);
												_push("RtlpFindActivationContextSection_CheckParameters");
												_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
												L80:
												_push(0);
												_push(0x33);
												E6DFD5720();
												_t239 = _t239 + 0x14;
												goto L81;
											} else {
												_t134 = _a20;
												goto L9;
											}
										}
									}
								}
							}
						}
					}
				}
				L106:
			}

0x6df62d58
0x6df62d62
0x6df62d66
0x6df62d70
0x6df62d7a
0x6df630ad
0x00000000
0x6dfad710
0x6dfad710
0x00000000
0x6dfad710
0x6df62d80
0x6df62d80
0x6df62d84
0x6df62d8c
0x6df62d94
0x6df62d9c
0x6dfad735
0x6dfad735
0x00000000
0x6df62da2
0x6df62da2
0x6df62dab
0x00000000
0x6df62db1
0x6df62db1
0x6df62db7
0x6df631d4
0x00000000
0x6df631da
0x00000000
0x6df631da
0x6df62dbd
0x6df62dbf
0x00000000
0x6df62dc5
0x6df62dc5
0x6df62dc8
0x00000000
0x6df62dce
0x6df62dce
0x6df62dd1
0x6df62de5
0x6df62de8
0x6dfad748
0x00000000
0x6dfad74e
0x6dfad74e
0x6dfad753
0x6dfad758
0x00000000
0x6dfad758
0x6df62dee
0x6df62dee
0x6df62df3
0x6df62df6
0x6df62dfa
0x6df62e01
0x6df62e07
0x6df62e0f
0x6df62e13
0x6df62e16
0x6df62e1e
0x6df62e26
0x6df62e2a
0x6df62e2e
0x6df62e32
0x6df62e40
0x6df62e42
0x6df62e45
0x00000000
0x00000000
0x6df62e4b
0x6df62e53
0x6df62e5f
0x6df62e5f
0x6df62e67
0x6df62e6d
0x6df62fa9
0x6df62fa9
0x6df62faf
0x6df62fb9
0x6dfad774
0x6dfad777
0x00000000
0x6dfad77d
0x6dfad77d
0x00000000
0x6dfad77d
0x6df62fbf
0x6df62fbf
0x6df62fc4
0x00000000
0x6df62fc4
0x6df62e73
0x6df62e73
0x6df62e78
0x00000000
0x6df62e78
0x6df62e55
0x6df62e55
0x6df62e59
0x6df630b8
0x6df630bb
0x6df630c1
0x6df630d8
0x6df630da
0x00000000
0x00000000
0x00000000
0x00000000
0x6df630c3
0x6df630c6
0x6dfad75f
0x00000000
0x6df630cc
0x6df630cf
0x6dfad76a
0x6df630e0
0x6df630e0
0x6df630e5
0x6df62e7c
0x6df62e7e
0x6dfad784
0x6dfad789
0x6dfad789
0x00000000
0x6df62e84
0x6df62e88
0x6df62e95
0x6df62e9c
0x6df62fcd
0x6df62fd4
0x00000000
0x6df62fe3
0x6df62fe3
0x6df62fe7
0x6df62feb
0x00000000
0x6df62feb
0x6df62ea2
0x6df62ea2
0x6df62ec2
0x6df62ec6
0x6df62ec8
0x6df62eca
0x6df62ecc
0x6df62ece
0x6dfad78b
0x6dfad78d
0x00000000
0x6dfad793
0x00000000
0x6dfad793
0x6df62ed4
0x6df62ed4
0x6df62ed4
0x6df62edb
0x6dfad803
0x6dfad803
0x00000000
0x6df62ee1
0x6df62ee1
0x6df62ef0
0x6df62ef0
0x6df62ef0
0x6df62efa
0x00000000
0x00000000
0x6df62f00
0x6df62f07
0x6df62f09
0x6df62f0e
0x6df62f0f
0x6df62f10
0x6df62f15
0x6df62f1c
0x6df630ee
0x6df630f7
0x6df630f9
0x6df630fc
0x6df63102
0x6df6319d
0x6df631b0
0x6df631b6
0x6df631ba
0x6df631c3
0x6df631c9
0x6df631c9
0x6df631c3
0x6df63102
0x6df6311a
0x6df63140
0x6df63146
0x6df63147
0x6df63148
0x6df63153
0x6df6311c
0x6df6311c
0x6df63120
0x6df6313a
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6313a
0x6df62f22
0x6df62f27
0x6df62f83
0x6df62f83
0x6df62f84
0x6df62f85
0x6df62f94
0x6df62f29
0x6df62f29
0x6df62f32
0x6df62f34
0x6df62f3a
0x6df62f3e
0x6df62f45
0x6df62f49
0x00000000
0x6df62f50
0x6df62f53
0x6df62ff5
0x6df62ff7
0x6dfad798
0x6dfad7a0
0x00000000
0x6dfad7a6
0x6dfad7a6
0x6dfad7aa
0x00000000
0x6dfad7b0
0x6dfad7b0
0x6dfad7b3
0x6dfad7b9
0x6dfad7e3
0x6dfad7e5
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfad7bb
0x6dfad7be
0x6dfad7cf
0x6dfad7dc
0x00000000
0x6dfad7d1
0x6dfad7d1
0x6dfad7d6
0x6dfad7eb
0x6dfad7eb
0x6dfad7f0
0x00000000
0x6dfad7f0
0x6dfad7c0
0x6dfad7c4
0x6dfad7df
0x6dfad7df
0x00000000
0x6dfad7df
0x6dfad7be
0x6dfad7b9
0x6dfad7aa
0x6df62ffd
0x6df62ffd
0x6df63000
0x6df63156
0x6df63158
0x6df63160
0x6df63166
0x6df6316c
0x00000000
0x6df63172
0x6df63172
0x6df63177
0x00000000
0x6df63177
0x6df63006
0x6df63009
0x00000000
0x6df6300f
0x6df6300f
0x6df63013
0x6df6301b
0x6df63021
0x6df63027
0x00000000
0x6df6302d
0x6df6302d
0x6df63032
0x00000000
0x6df63032
0x6df63027
0x6df63009
0x6df63000
0x6df62f59
0x6df62f59
0x6df62f5c
0x6dfad7f9
0x00000000
0x6df62f62
0x6df62f62
0x6df62f64
0x6df6303b
0x6df6304d
0x6df63054
0x6df63185
0x6df631df
0x00000000
0x6df6318c
0x6df6318c
0x6df63190
0x00000000
0x6df63190
0x6df6305a
0x6df6305a
0x6df6307a
0x6df6307e
0x6df63080
0x6df63082
0x6df63084
0x6df63086
0x00000000
0x6df6308c
0x6df6308d
0x6df63092
0x00000000
0x6df63092
0x6df63086
0x6df62f6a
0x6df62f6a
0x6df62f6f
0x6df62f71
0x6df63094
0x6df63094
0x6df6309b
0x00000000
0x6df630a1
0x00000000
0x6df630a1
0x6df62f77
0x6df62f77
0x6df62f7c
0x6df62f7e
0x6df62f7e
0x00000000
0x6df62f7c
0x6df62f71
0x6df62f64
0x6df62f5c
0x00000000
0x6df62f53
0x6df62f50
0x6df62f27
0x00000000
0x6df62f1c
0x6dfad807
0x6dfad807
0x6dfad812
0x6dfad817
0x6dfad81a
0x00000000
0x6dfad81a
0x6df62edb
0x6df62ece
0x6df62e9c
0x6df630d5
0x6df630d5
0x00000000
0x6df630d5
0x6df630cf
0x6df630c6
0x00000000
0x00000000
0x00000000
0x6df62e59
0x00000000
0x6df62f97
0x6df62f97
0x6df62f9a
0x00000000
0x6df62fa0
0x6df62fa3
0x00000000
0x00000000
0x00000000
0x00000000
0x6df62fa3
0x00000000
0x6df62f9a
0x6df62e40
0x6df62dd3
0x6df62ddc
0x6dfad71a
0x6dfad71f
0x6dfad724
0x6dfad729
0x6dfad729
0x6dfad72b
0x6dfad72d
0x6dfad732
0x00000000
0x6df62de2
0x6df62de2
0x00000000
0x6df62de2
0x6df62ddc
0x6df62dd1
0x6df62dc8
0x6df62dbf
0x6df62db7
0x6df62dab
0x6df62d9c
0x00000000

APIs

DbgPrintEx.9419(00000033,00000000,SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.,RtlpFindActivationContextSection_CheckParameters,C000000D), ref: 6DFAD72D

Strings

Actx , xrefs: 6DFAD76A, 6DFAD7D1
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6DFAD758
SsHd, xrefs: 6DF62EF4
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 6DFAD809
RtlpFindActivationContextSection_CheckParameters, xrefs: 6DFAD71F, 6DFAD753
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6DFAD724

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 3558298466-1988757188
Opcode ID: b95a15888a7ef8624897caa94e48b7330f4c19dc9b11e0811a969ccaf0f5b1f8
Instruction ID: 1c13433911bc597e8c0dcd4697d205739f3c594147980188286b9590bb5f8f3f
Opcode Fuzzy Hash: b95a15888a7ef8624897caa94e48b7330f4c19dc9b11e0811a969ccaf0f5b1f8
Instruction Fuzzy Hash: 24E1BF71608382DFD715CF2CC890B6AB7F5BB89318F18462DF8658B690D732D945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7C63D, Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6DF7C63D(signed int __ecx, intOrPtr __edx, signed int _a4, intOrPtr* _a8, intOrPtr _a16) {
				void* _v8;
				void* _v12;
				char _v16;
				void _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr* _t34;
				signed int _t35;
				intOrPtr _t38;
				signed int _t41;
				void* _t43;

				_t38 = __edx;
				_t35 = __ecx;
				_t21 =  *[fs:0x30];
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				if(__edx == 0x6df2127c) {
					E6DFD5720(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlGetAssemblyStorageRoot");
					goto L23;
				} else {
					_t34 = _a8;
					if(_t34 != 0) {
						 *_t34 = 0;
					}
					_t41 = _a4;
					if((_t35 & 0xfffffffc) != 0 || _t41 < 1 || _t34 == 0) {
						_push(E6DF7CCC0);
						_push(_t34);
						_push(_t41);
						_push(_t35);
						E6DFD5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags              : 0x%lx\nSXS:    AssemblyRosterIndex: 0x%lx\nSXS:    AssemblyStorageRoot: %p\nSXS:    Callback           : %p\n", "RtlGetAssemblyStorageRoot");
						goto L23;
					} else {
						_t43 = E6DF7C707(_t35 & 0x00000003, _t21, _t38,  &_v12,  &_v8,  &_v16);
						if(_t43 < 0) {
							_push(_t43);
							_push("SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header.  Status = 0x%08lx\n");
							goto L20;
						} else {
							_t40 = _v12;
							if(_v12 == 0) {
								L14:
								_t43 = 0;
							} else {
								_t27 = _v16;
								if(_t27 == 0) {
									L16:
									_t43 = 0xc00000e5;
								} else {
									_t37 = _v8;
									if(_v8 == 0) {
										goto L16;
									} else {
										if(_t41 >=  *((intOrPtr*)(_t27 + 8))) {
											_push( *((intOrPtr*)(_t27 + 8)));
											_push(_t41);
											E6DFD5720(0x33, 0, "SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx\n", "RtlGetAssemblyStorageRoot");
											L23:
											_t43 = 0xc000000d;
										} else {
											_t43 = E6DF7C9BF(_t37, _t40, _t41, _t37, _a16);
											if(_t43 < 0) {
												_push(_t43);
												_push("SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry.  Status = 0x%08lx\n");
												L20:
												_push(0);
												_push(0x33);
												E6DFD5720();
											} else {
												_t32 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + _t41 * 4));
												if(_t32 == 0) {
													goto L16;
												} else {
													 *_t34 = _t32 + 4;
													goto L14;
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return _t43;
			}

0x6df7c63d
0x6df7c63d
0x6df7c645
0x6df7c64f
0x6df7c652
0x6df7c655
0x6df7c65f
0x6dfba775
0x00000000
0x6df7c665
0x6df7c665
0x6df7c66a
0x6df7c66c
0x6df7c66c
0x6df7c66e
0x6df7c677
0x6dfba7ba
0x6dfba7bf
0x6dfba7c0
0x6dfba7c1
0x6dfba7cf
0x00000000
0x6df7c68e
0x6df7c6a5
0x6df7c6a9
0x6dfba77f
0x6dfba780
0x00000000
0x6df7c6af
0x6df7c6af
0x6df7c6b4
0x6df7c6f3
0x6df7c6f3
0x6df7c6b6
0x6df7c6b6
0x6df7c6bb
0x6df7c700
0x6df7c700
0x6df7c6bd
0x6df7c6bd
0x6df7c6c2
0x00000000
0x6df7c6c4
0x6df7c6c7
0x6dfba79e
0x6dfba7a1
0x6dfba7b0
0x6dfba7d7
0x6dfba7d7
0x6df7c6cd
0x6df7c6d7
0x6df7c6db
0x6dfba787
0x6dfba788
0x6dfba78d
0x6dfba78d
0x6dfba78f
0x6dfba791
0x6df7c6e1
0x6df7c6e7
0x6df7c6ec
0x00000000
0x6df7c6ee
0x6df7c6f1
0x00000000
0x6df7c6f1
0x6df7c6ec
0x6df7c6db
0x6df7c6c7
0x6df7c6c2
0x6df7c6bb
0x6df7c6b4
0x6df7c6a9
0x6df7c677
0x6df7c6fd

APIs

DbgPrintEx.9419(00000033,00000000,SXS: %s() passed the empty activation context,RtlGetAssemblyStorageRoot,?,00000000,?,00000002,?,00000040,?,00000000,?), ref: 6DFBA775

Strings

SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 6DFBA7A7
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 6DFBA7C7
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 6DFBA788
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 6DFBA780
SXS: %s() passed the empty activation context, xrefs: 6DFBA76D
RtlGetAssemblyStorageRoot, xrefs: 6DFBA768, 6DFBA7A2, 6DFBA7C2

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 3558298466-861424205
Opcode ID: a239fad94400711e789d6fd764fedea039a9f3bdc132605423a81c8869c020d4
Instruction ID: b56449686e28daefa9c63e93cae150bc9a67ada887aec796c6d1e54a29261ed2
Opcode Fuzzy Hash: a239fad94400711e789d6fd764fedea039a9f3bdc132605423a81c8869c020d4
Instruction Fuzzy Hash: AE315532A04125BBE7308A8EFC80FBA76B9EF02759F124056FD04B7241C6719E0087E1

Uniqueness

Uniqueness Score: -1.00%

Function 6E01F019, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E6E01F019(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				void* _t39;
				intOrPtr _t55;
				long _t56;
				intOrPtr* _t63;
				intOrPtr _t64;
				void* _t65;

				_v12 = _v12 & 0x00000000;
				_t55 = __edx;
				_t64 = __ecx;
				_v20 = __edx;
				_v24 = __ecx;
				RtlInitUnicodeString( &_v40, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\");
				_t63 = _a8;
				_t56 = E6E01F13B(_t64, _t55,  &_v40, _t63,  &_v12);
				if(_t56 >= 0 && _v12 == 2) {
					_t56 = 0;
					_v16 = 0;
					_v8 = 0;
					RtlInitUnicodeString( &_v32, L"RedirectedKey");
					_t39 =  *0x6df26cc8( *_t63,  &_v32, 2, 0, 0,  &_v8);
					if(_v8 > 0 && (_t39 == 0xc0000023 || _t39 == 0x80000005)) {
						_t65 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v8);
						if(_t65 != 0) {
							_push( &_v8);
							_push(_v8);
							_push(_t65);
							_push(2);
							_push( &_v32);
							_push( *_t63);
							if( *0x6df26cc8() >= 0 &&  *((intOrPtr*)(_t65 + 4)) == 1) {
								_t22 = _t65 + 0xc; // 0xc
								RtlInitUnicodeString( &_v48, _t22);
								if(E6E01F13B(_v24, _v20,  &_v48,  &_v16,  &_v12) >= 0) {
									 *0x6df26cc4( *_t63);
									 *_t63 = _v16;
								}
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t65);
						}
					}
				}
				return _t56;
			}

0x6e01f021
0x6e01f030
0x6e01f032
0x6e01f035
0x6e01f038
0x6e01f03b
0x6e01f041
0x6e01f056
0x6e01f05a
0x6e01f072
0x6e01f075
0x6e01f078
0x6e01f07b
0x6e01f08f
0x6e01f098
0x6e01f0c3
0x6e01f0c7
0x6e01f0cc
0x6e01f0cd
0x6e01f0d3
0x6e01f0d4
0x6e01f0d6
0x6e01f0d7
0x6e01f0e1
0x6e01f0e9
0x6e01f0f1
0x6e01f110
0x6e01f114
0x6e01f11d
0x6e01f11d
0x6e01f110
0x6e01f12b
0x6e01f12b
0x6e01f0c7
0x6e01f098
0x6e01f138

APIs

RtlInitUnicodeString.9419(?,\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\,02000000,?,00000000), ref: 6E01F03B

Part of subcall function 6E01F13B: ZwOpenKey.9419(?,02000000,?,?,02000000,00000000), ref: 6E01F182
Part of subcall function 6E01F13B: ZwCreateKey.9419(?,02000000,00000018,00000000,00000000,00000000,6E01F056), ref: 6E01F19F

RtlInitUnicodeString.9419(?,RedirectedKey,?,?,00000000), ref: 6E01F07B
ZwQueryValueKey.9419(?,?,00000002,00000000,00000000,?), ref: 6E01F08F
RtlAllocateHeap.9419(?,00000008,?), ref: 6E01F0BE
ZwQueryValueKey.9419(?,?,00000002,00000000,?,?,?), ref: 6E01F0D9
RtlInitUnicodeString.9419(?,0000000C), ref: 6E01F0F1
ZwClose.9419(?,?,?,00000002), ref: 6E01F114
RtlFreeHeap.9419(?,00000000,00000000), ref: 6E01F12B

Strings

RedirectedKey, xrefs: 6E01F06A
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 6E01F02B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$HeapQueryValue$AllocateCloseCreateFreeOpen
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 1683559675-1388552009
Opcode ID: 81d6a6f4981ed70fd0594ac2f78761a8bedaa9a249ee8e97a25f7624f51cbcf8
Instruction ID: cc5f2c48da53aca297cfe557ddcfe54cc91c184ab617dbac2bfa8537bdfa060a
Opcode Fuzzy Hash: 81d6a6f4981ed70fd0594ac2f78761a8bedaa9a249ee8e97a25f7624f51cbcf8
Instruction Fuzzy Hash: FE31E775A5510AAFDB11DFD4C984FEEBBBCFF08355F204066E605E6210DB319A05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFE5100, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 85
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DFE5100(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v732;
				char _v736;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t17;
				char _t23;
				void* _t24;
				void* _t26;
				void* _t29;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				signed int _t37;
				void* _t38;
				void* _t43;
				void* _t44;

				_v8 =  *0x6e03d360 ^ _t37;
				_t30 = _a8;
				_t36 = _a16;
				_t35 = _a4;
				_push( &_v732);
				E6DF9DDD0( &_v732, __ecx, _t34, _t35, _t36);
				while(1) {
					_t17 = _t36;
					if(_t36 == 0) {
						_t17 = 0x6df248a4;
					}
					_push(_a12);
					_push(_t30);
					_push(_t35);
					E6DFD5720(0x65, 0, "\n*** Assertion failed: %s%s\n***   Source File: %s, line %ld\n\n", _t17);
					_t38 = _t38 + 0x1c;
					if(E6DFF8D47() == 0) {
						break;
					}
					if(E6DFD5780("Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ",  &_v736, 2) == 0) {
						asm("int3");
						L19:
						_push(0xc0000001);
						_push(0xffffffff);
						_t19 = E6DF897C0();
						break;
					}
					_t23 = _v736;
					_t43 = _t23 - 0x62;
					if(_t43 > 0) {
						_t19 = _t23 - 0x69;
						L10:
						if(_t44 == 0) {
							break;
						}
						_t24 = _t19 - 6;
						if(_t24 == 0) {
							L15:
							_t19 = E6DFD5720(0x65, 0, "Execute \'.cxr %p\' to dump context\n",  &_v732);
							_t38 = _t38 + 0x10;
							asm("int3");
							if(_v736 == 0x6f) {
								break;
							}
							if(_v736 != 0x4f) {
								continue;
							}
							break;
						}
						_t26 = _t24 - 1;
						if(_t26 == 0) {
							goto L19;
						}
						if(_t26 == 4) {
							_push(0xc0000001);
							_push(0xfffffffe);
							E6DF89A30();
						}
						continue;
					}
					if(_t43 == 0) {
						goto L15;
					}
					_t29 = _t23 - 0x42;
					_t44 = _t29;
					if(_t44 == 0) {
						goto L15;
					}
					_t19 = _t29 - 7;
					goto L10;
				}
				return E6DF8B640(_t19, _t30, _v8 ^ _t37, _t34, _t35, _t36);
			}

0x6dfe5112
0x6dfe5116
0x6dfe5120
0x6dfe5124
0x6dfe5127
0x6dfe5128
0x6dfe512d
0x6dfe512d
0x6dfe5131
0x6dfe5133
0x6dfe5133
0x6dfe5138
0x6dfe513b
0x6dfe513c
0x6dfe5147
0x6dfe514c
0x6dfe5156
0x00000000
0x00000000
0x6dfe5171
0x6dfe51de
0x6dfe51df
0x6dfe51df
0x6dfe51e4
0x6dfe51e6
0x00000000
0x6dfe51e6
0x6dfe5173
0x6dfe517a
0x6dfe517d
0x6dfe518b
0x6dfe518e
0x6dfe518e
0x00000000
0x00000000
0x6dfe5190
0x6dfe5193
0x6dfe51ad
0x6dfe51bd
0x6dfe51c2
0x6dfe51c5
0x6dfe51cd
0x00000000
0x00000000
0x6dfe51d6
0x00000000
0x00000000
0x00000000
0x6dfe51dc
0x6dfe5195
0x6dfe5198
0x00000000
0x00000000
0x6dfe519d
0x6dfe519f
0x6dfe51a4
0x6dfe51a6
0x6dfe51a6
0x00000000
0x6dfe519d
0x6dfe517f
0x00000000
0x00000000
0x6dfe5181
0x6dfe5181
0x6dfe5184
0x00000000
0x00000000
0x6dfe5186
0x00000000
0x6dfe5186
0x6dfe51fb

APIs

RtlCaptureContext.9419(?,00000000,00000000,?), ref: 6DFE5128
DbgPrintEx.9419(00000065,00000000,*** Assertion failed: %s%s*** Source File: %s, line %ld,6DFAD3E5,000001B2,?,?,?,00000000,00000000,?), ref: 6DFE5147
DbgPrompt.9419(Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6DFE516A
ZwTerminateThread.9419(000000FE,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6DFE51A6
DbgPrintEx.9419(00000065,00000000,Execute '.cxr %p' to dump context,?,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6DFE51BD
ZwTerminateProcess.9419(000000FF,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6DFE51E6

Strings

O, xrefs: 6DFE51CF
Execute '.cxr %p' to dump context, xrefs: 6DFE51B4
Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? , xrefs: 6DFE5165
*** Assertion failed: %s%s*** Source File: %s, line %ld, xrefs: 6DFE513E

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintTerminate$CaptureContextProcessPromptThread
String ID: *** Assertion failed: %s%s*** Source File: %s, line %ld$Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$O
API String ID: 3567286327-2386179708
Opcode ID: 546749be0e7c76d2d4b1780cd50d9b1a90f198710db7e405072c8f82e756c209
Instruction ID: f5673d1a7a555bc8cabc245d0d08c8130bfb9a943b939bb2ec9f5ea652c09460
Opcode Fuzzy Hash: 546749be0e7c76d2d4b1780cd50d9b1a90f198710db7e405072c8f82e756c209
Instruction Fuzzy Hash: 66213E7290815F7AEB11C9BC8C44FBD3768DB46394F214553FA25FA381D625DE01C761

Uniqueness

Uniqueness Score: -1.00%

Function 6DF440E1, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E6DF440E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6DF4B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E6DF4B150(", passed to %s", _t29);
					}
					_push("\n");
					E6DF4B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6e036378 = 1;
						asm("int3");
						 *0x6e036378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x6df440e6
0x6df440e8
0x6df440f1
0x6dfa042d
0x6dfa044c
0x6dfa0451
0x6dfa042f
0x6dfa0444
0x6dfa0449
0x6dfa045d
0x6dfa0466
0x6dfa046e
0x6dfa0474
0x6dfa0475
0x6dfa047a
0x6dfa048a
0x6dfa048c
0x6dfa0493
0x6dfa0494
0x6dfa0494
0x00000000
0x6dfa049b
0x00000000

APIs

DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,6E0038D6), ref: 6DFA0444
DbgPrint.9419(Invalid heap signature for heap at %p,?,?,?,?,?,?,?,6E0038D6), ref: 6DFA045D
DbgPrint.9419(, passed to %s,RtlGetUserInfoHeap,?,?,?,?,?,?,6E0038D6), ref: 6DFA046E
DbgPrint.9419(6DF26B94,?,?,?,?,?,?,6E0038D6), ref: 6DFA047A

Strings

Invalid heap signature for heap at %p, xrefs: 6DFA0458
RtlGetUserInfoHeap, xrefs: 6DFA0468
HEAP: , xrefs: 6DFA044C
HEAP[%wZ]: , xrefs: 6DFA043F
, passed to %s, xrefs: 6DFA0469

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlGetUserInfoHeap
API String ID: 3558298466-609737958
Opcode ID: 1d1fd198b0e5865742290d40363621126840af070838c3950c27ec14ad67dbb2
Instruction ID: e8a3a7dc0cac11675881fd3253d9d37f82ca763efece161bbb9d72851d847749
Opcode Fuzzy Hash: 1d1fd198b0e5865742290d40363621126840af070838c3950c27ec14ad67dbb2
Instruction Fuzzy Hash: B001FC3201D542EEE3158FBDF80DF667BA4EB41734F19C469F5084B653CBE69840C591

Uniqueness

Uniqueness Score: -1.00%

Function 6DF46800, Relevance: 16.9, APIs: 11, Instructions: 373
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E6DF46800(void* __ebx, void* __edi, void* __esi, void** _a4, signed short* _a8, intOrPtr _a12, signed short* _a16, signed short* _a20, void* _a24, intOrPtr* _a28, intOrPtr* _a32, intOrPtr* _a36, intOrPtr* _a40, signed char _a44) {
				char _v5;
				void* _v12;
				void _v16;
				int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;
				void* _t131;
				intOrPtr* _t132;
				int _t153;
				long _t154;
				void* _t158;
				void _t162;
				void* _t194;
				int _t196;
				void* _t205;
				void* _t206;
				signed short* _t207;
				void* _t209;
				signed int _t211;
				intOrPtr* _t212;
				signed short* _t213;
				signed int _t215;
				signed short* _t217;
				void* _t219;
				void _t228;
				void _t229;
				signed int _t238;
				intOrPtr _t256;
				void* _t262;
				short _t268;
				intOrPtr _t269;
				signed int _t271;
				void* _t272;
				intOrPtr* _t273;
				void* _t275;
				intOrPtr* _t276;
				long _t278;
				void* _t279;

				_t275 = __esi;
				_t272 = __edi;
				_t205 = __ebx;
				if((_a44 & 0xfffffffe) != 0) {
					L61:
					return 0xc000000d;
				}
				_v24 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				if(E6DF46BF3(_a8) < 0) {
					goto L61;
				}
				_t256 = _a12;
				_t215 = 0;
				if(_t256 != 0) {
					_t124 = E6DF46BF3(_t256);
					_t215 = 0;
				} else {
					_t124 = 0;
				}
				if(_t124 < 0) {
					goto L61;
				} else {
					_push(_t205);
					_v5 = _t215;
					_v32 = _t215;
					_t217 = _a16;
					_t206 = 0x5c;
					if(_t217 == 0) {
						L12:
						_t207 = _a20;
						if(_t207 == 0) {
							_t125 = 0;
						} else {
							_t125 = E6DF46BF3(_t207);
						}
						if(_t125 < 0) {
							L65:
							_t126 = 0xc000000d;
							goto L53;
						} else {
							_t218 = _a28;
							if(_a28 == 0) {
								_t219 = 0;
								_t127 = 0;
							} else {
								_t127 = E6DF46BF3(_t218);
								_t219 = 0;
							}
							if(_t127 < 0) {
								goto L65;
							} else {
								_t128 = _a32;
								if(_a32 == 0) {
									_t129 = _t219;
								} else {
									_t129 = E6DF46BF3(_t128);
									_t219 = 0;
								}
								if(_t129 < 0) {
									goto L65;
								} else {
									_push(_t275);
									_t276 = _a36;
									if(_t276 == 0) {
										_t130 = _t219;
									} else {
										_t130 = E6DF46BF3(_t276);
										_t219 = 0;
									}
									if(_t130 < 0) {
										_t126 = 0xc000000d;
										goto L52;
									} else {
										_push(_t272);
										_t273 = _a40;
										if(_t273 == 0) {
											_t131 = _t219;
										} else {
											_t131 = E6DF46BF3(_t273);
										}
										if(_t131 < 0) {
											_t126 = 0xc000000d;
											goto L51;
										} else {
											if(_t207 == 0) {
												_t207 = _a8;
												_a20 = _t207;
											}
											_t132 = _a28;
											if(_t132 == 0) {
												_t132 = 0x6df21ab0;
												_a28 = 0x6df21ab0;
											}
											if(_a32 == 0) {
												_a32 = 0x6df21ab0;
											}
											if(_t276 == 0) {
												_t276 = 0x6df21ab0;
												_a36 = 0x6df21ab0;
											}
											if(_t273 == 0) {
												_t273 = 0x6df21ab0;
											}
											_t209 = 3;
											_t278 = 0;
											_t228 = (( *_t207 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_t132 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + (( *_a8 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_a32 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + 0x4ac + (( *(_t276 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
											_v16 = _t228;
											if( *_t273 != 0) {
												_t228 = _t228 + (( *(_t273 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t228;
											}
											if(_t256 != 0) {
												_t229 = _t228 + (( *(_t256 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t229;
											}
											if(_a24 != _t278) {
												_t153 = E6DF7585B(_a24, 1);
												_t229 = _v16;
											} else {
												_t153 =  *((intOrPtr*)(_v24 + 0x290));
											}
											_v20 = _t153;
											_t211 = _t153 + 0x00000003 & 0xfffffffc;
											if(_t211 < _t153) {
												L77:
												_t126 = 0xc0000095;
												goto L51;
											} else {
												while(1) {
													_t154 = _t211 + _t229;
													if(_t154 < _t229) {
														goto L77;
													}
													_t279 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t278, _t154);
													if(_t279 == 0) {
														_t126 = 0xc000009a;
														L51:
														L52:
														L53:
														return _t126;
													}
													_t158 = _t279 + _v16;
													_v12 = _t158;
													if(_a24 != 0) {
														memcpy(_t158, _a24, _v20);
														L42:
														memset(_t279, 0, 0x2a4);
														_t162 = _v16;
														 *_t279 = _t162;
														 *(_t279 + 4) = _t162;
														 *(_t279 + 0x290) = _t211;
														 *((intOrPtr*)(_t279 + 0xc)) = 0;
														_t53 = _t279 + 0x24; // 0x24
														_t212 = _t53;
														 *((intOrPtr*)(_t279 + 0x2c)) = 0;
														 *((intOrPtr*)(_t279 + 0x48)) = _v12;
														_t57 = _t279 + 0x2a4; // 0x2a4
														_v12 = _t57;
														 *((intOrPtr*)(_t279 + 8)) = 1;
														 *(_t279 + 0x14) =  *(_v24 + 0x14) & 1;
														_t169 = _a16;
														if(_a16 == 0) {
															L6DF5EEF0(0x6e0379a0);
															E6DF46C14( &_v12, _t212, _v24 + 0x24, 0x208);
															E6DF5EB70( &_v12, 0x6e0379a0);
														} else {
															E6DF46C14( &_v12, _t212, _t169, 0x208);
															if(_v5 != 0) {
																_t268 = 0x5c;
																 *((short*)( *((intOrPtr*)(_t279 + 0x28)) + _v32 * 2)) = _t268;
																_t194 = 2;
																 *_t212 =  *_t212 + _t194;
															}
														}
														_t234 = _a12;
														if(_a12 != 0) {
															_t104 = _t279 + 0x30; // 0x30
															E6DF46C14( &_v12, _t104, _t234,  *(_t234 + 2) & 0x0000ffff);
														}
														_t72 = _t279 + 0x38; // 0x38
														E6DF46C14( &_v12, _t72, _a8, ( *_a8 & 0x0000ffff) + 2);
														_t213 = _a20;
														_t75 = _t279 + 0x40; // 0x40
														_t262 = _t75;
														_t238 =  *_t213 & 0x0000ffff;
														_t180 = _t213[1] & 0x0000ffff;
														if(_t238 != (_t213[1] & 0x0000ffff)) {
															_t180 = _t238 + 2;
														}
														E6DF46C14( &_v12, _t262, _t213, _t180);
														_t80 = _t279 + 0x70; // 0x70
														E6DF46C14( &_v12, _t80, _a28,  *(_a28 + 2) & 0x0000ffff);
														_t84 = _t279 + 0x78; // 0x78
														E6DF46C14( &_v12, _t84, _a32,  *(_a32 + 2) & 0x0000ffff);
														_t88 = _t279 + 0x80; // 0x80
														E6DF46C14( &_v12, _t88, _a36,  *(_a36 + 2) & 0x0000ffff);
														if( *_t273 != 0) {
															_t118 = _t279 + 0x88; // 0x88
															E6DF46C14( &_v12, _t118, _t273,  *(_t273 + 2) & 0x0000ffff);
														}
														if((_a44 & 0x00000001) == 0) {
															_t279 = E6DFCBCB0(_t279);
														}
														_t126 = 0;
														 *_a4 = _t279;
														goto L51;
													}
													L6DF5EEF0(0x6e0379a0);
													_t269 = _v24;
													_t196 =  *(_t269 + 0x290);
													_v20 = _t196;
													_t251 = _t196 + 0x00000003 & 0xfffffffc;
													_v28 = _t196 + 0x00000003 & 0xfffffffc;
													if(_t196 > _t211) {
														E6DF5EB70(_t251, 0x6e0379a0);
														_t278 = 0;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t279);
														_t211 = _v28;
														_t229 = _v16;
														if(_t211 >= _v20) {
															continue;
														}
														goto L77;
													}
													memcpy(_v12,  *(_t269 + 0x48), _t196);
													E6DF5EB70(_t251, 0x6e0379a0);
													_t211 = _v28;
													goto L42;
												}
												goto L77;
											}
										}
									}
								}
							}
						}
					}
					_t271 = ( *_t217 & 0x0000ffff) >> 1;
					_v32 = _t271;
					if(E6DF46BF3(_t217) < 0 || _t271 == 0) {
						goto L65;
					} else {
						if( *((intOrPtr*)(_t217[2] + _t271 * 2 - 2)) == _t206) {
							L11:
							_t256 = _a12;
							goto L12;
						}
						if(_t271 > 0x103) {
							goto L65;
						}
						_v5 = 1;
						goto L11;
					}
				}
			}

0x6df46800
0x6df46800
0x6df46800
0x6df4680f
0x6dfa1b26
0x00000000
0x6dfa1b26
0x6df46821
0x6df4682b
0x00000000
0x00000000
0x6df46831
0x6df46834
0x6df46838
0x6df46b68
0x6df46b6d
0x6df4683e
0x6df4683e
0x6df4683e
0x6df46842
0x00000000
0x6df46848
0x6df46848
0x6df46849
0x6df4684c
0x6df4684f
0x6df46854
0x6df46857
0x6df46893
0x6df46893
0x6df46898
0x6dfa1b30
0x6df4689e
0x6df468a0
0x6df468a0
0x6df468a7
0x6dfa1b47
0x6dfa1b47
0x00000000
0x6df468ad
0x6df468ad
0x6df468b2
0x6dfa1b37
0x6dfa1b39
0x6df468b8
0x6df468b8
0x6df468bd
0x6df468bd
0x6df468c1
0x00000000
0x6df468c7
0x6df468c7
0x6df468cc
0x6dfa1b40
0x6df468d2
0x6df468d4
0x6df468d9
0x6df468d9
0x6df468dd
0x00000000
0x6df468e3
0x6df468e3
0x6df468e4
0x6df468e9
0x6dfa1b51
0x6df468ef
0x6df468f1
0x6df468f6
0x6df468f6
0x6df468fa
0x6dfa1b58
0x00000000
0x6df46900
0x6df46900
0x6df46901
0x6df46906
0x6dfa1b62
0x6df4690c
0x6df4690e
0x6df4690e
0x6df46915
0x6dfa1b69
0x00000000
0x6df4691b
0x6df4691d
0x6dfa1b73
0x6dfa1b76
0x6dfa1b76
0x6df46923
0x6df4692d
0x6dfa1b7e
0x6dfa1b80
0x6dfa1b80
0x6df46937
0x6dfa1b88
0x6dfa1b88
0x6df4693f
0x6dfa1b90
0x6dfa1b92
0x6dfa1b92
0x6df46947
0x6dfa1b9a
0x6dfa1b9a
0x6df46959
0x6df4698f
0x6df46991
0x6df46993
0x6df46999
0x6dfa1baa
0x6dfa1bac
0x6dfa1bac
0x6df469a1
0x6df46b7d
0x6df46b7f
0x6df46b7f
0x6df469aa
0x6df46b8d
0x6df46b92
0x6df469b0
0x6df469b3
0x6df469b3
0x6df469bc
0x6df469bf
0x6df469c4
0x6dfa1bdf
0x6dfa1bdf
0x00000000
0x6df469ca
0x6df469ca
0x6df469ca
0x6df469cf
0x00000000
0x00000000
0x6df469e5
0x6df469e9
0x6dfa1c0f
0x6df46b5d
0x6df46b5e
0x6df46b5f
0x00000000
0x6df46b5f
0x6df469f2
0x6df469f8
0x6df469fb
0x6df46ba1
0x6df46a44
0x6df46a4d
0x6df46a52
0x6df46a57
0x6df46a5a
0x6df46a62
0x6df46a68
0x6df46a6b
0x6df46a6b
0x6df46a6e
0x6df46a74
0x6df46a77
0x6df46a7d
0x6df46a83
0x6df46a8b
0x6df46a8e
0x6df46a93
0x6df46bb3
0x6df46bc9
0x6df46bd3
0x6df46a99
0x6df46aa4
0x6df46aad
0x6df46ab7
0x6df46aba
0x6df46abe
0x6df46abf
0x6df46abf
0x6df46aad
0x6df46ac2
0x6df46ac7
0x6df46be1
0x6df46be9
0x6df46be9
0x6df46ad0
0x6df46ade
0x6df46ae3
0x6df46ae6
0x6df46ae6
0x6df46ae9
0x6df46aec
0x6df46af3
0x6df46af5
0x6df46af5
0x6df46afd
0x6df46b05
0x6df46b11
0x6df46b19
0x6df46b25
0x6df46b2d
0x6df46b3c
0x6df46b46
0x6dfa1bed
0x6dfa1bf8
0x6dfa1bf8
0x6df46b50
0x6dfa1c08
0x6dfa1c08
0x6df46b59
0x6df46b5b
0x00000000
0x6df46b5b
0x6df46a06
0x6df46a0b
0x6df46a0e
0x6df46a14
0x6df46a1a
0x6df46a1d
0x6df46a22
0x6dfa1bb9
0x6dfa1bc5
0x6dfa1bcb
0x6dfa1bd0
0x6dfa1bd3
0x6dfa1bd9
0x00000000
0x00000000
0x00000000
0x6dfa1bd9
0x6df46a2f
0x6df46a3c
0x6df46a41
0x00000000
0x6df46a41
0x00000000
0x6df469ca
0x6df469c4
0x6df46915
0x6df468fa
0x6df468dd
0x6df468c1
0x6df468a7
0x6df4685c
0x6df4685e
0x6df46868
0x00000000
0x6df46876
0x6df4687e
0x6df46890
0x6df46890
0x00000000
0x6df46890
0x6df46886
0x00000000
0x00000000
0x6df4688c
0x00000000
0x6df4688c
0x6df46868

APIs

RtlAllocateHeap.9419(?,00000000,?), ref: 6DF469E0
RtlEnterCriticalSection.9419(6E0379A0,?,00000000,?), ref: 6DF46A06
memcpy.9419(?,?,?,6E0379A0,?,00000000,?), ref: 6DF46A2F
RtlLeaveCriticalSection.9419(6E0379A0), ref: 6DF46A3C
memset.9419(00000000,00000000,000002A4,6E0379A0), ref: 6DF46A4D

Part of subcall function 6DF46C14: memcpy.9419(?,?,?,?,00000000,00000024,?,?,6DF46BCE,?,00000208,6E0379A0,?,?,6E0379A0), ref: 6DF46C39
Part of subcall function 6DF46C14: memset.9419(00000208,00000000,00000208,?,00000000,00000024,?,?,6DF46BCE,?,00000208,6E0379A0,?,?,6E0379A0), ref: 6DF46C71

RtlDeNormalizeProcessParams.9419(00000000,?,?,00000000,?,?,?,?,?,?,-00000002,?,00000208), ref: 6DFA1C03

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemcpymemset$AllocateEnterHeapLeaveNormalizeParamsProcess
String ID:
API String ID: 2315816726-0
Opcode ID: d53a7d4110b3422cc4ec97fa16ed67e1e272f4a2856cefed7a186b206b207b75
Instruction ID: caed97bc32e1d319a41db408017d7eb71b168b23f96f763079db1a4e69f90d34
Opcode Fuzzy Hash: d53a7d4110b3422cc4ec97fa16ed67e1e272f4a2856cefed7a186b206b207b75
Instruction Fuzzy Hash: 70D1A071A04216DBDB05CF6CC890AFA7BB4BF05318F06C12AF969DB291E734D945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFC51BE, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DFC51BE(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t101;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t108;
				signed int _t110;
				void* _t113;
				int _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x6e0205f0);
				E6DF9D0E8(__ebx, __edi, __esi);
				 *(_t118 - 0x80) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					L6DF5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *(_t118 - 0x80);
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E6DFC53CA(0);
						return E6DF9D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					memcpy(_t108, _t101, _t115);
					 *((short*)( *(_t118 - 0x80) + _t115)) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E6DF63690(1, _t117, 0x6df21810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *(_t118 - 0x70) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E6DF8AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *(_t118 - 0x70));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *(_t118 - 0x70));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E6DF8AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E6DFC500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t101 >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E6DF89860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x6dfc51be
0x6dfc51c3
0x6dfc51c8
0x6dfc51cd
0x6dfc51d0
0x6dfc51d3
0x6dfc51d8
0x6dfc51db
0x6dfc51de
0x6dfc51e0
0x6dfc51e3
0x6dfc51e6
0x6dfc51e8
0x6dfc5342
0x6dfc5351
0x6dfc5356
0x6dfc535a
0x6dfc5360
0x6dfc5363
0x6dfc5366
0x6dfc5369
0x6dfc5369
0x6dfc536b
0x6dfc536b
0x6dfc5370
0x6dfc53a3
0x6dfc53a4
0x6dfc53a6
0x6dfc53ab
0x6dfc53ab
0x6dfc53ae
0x6dfc53ae
0x6dfc53b5
0x6dfc53bf
0x6dfc53bf
0x6dfc5375
0x6dfc5396
0x6dfc53a0
0x6dfc53a0
0x00000000
0x6dfc5396
0x6dfc5377
0x6dfc5379
0x6dfc537f
0x6dfc538c
0x6dfc5390
0x00000000
0x6dfc5390
0x6dfc51ee
0x6dfc51f1
0x6dfc5301
0x6dfc5310
0x6dfc5315
0x6dfc5318
0x6dfc531b
0x6dfc5320
0x6dfc532e
0x6dfc5331
0x00000000
0x6dfc5331
0x6dfc5328
0x6dfc5329
0x00000000
0x6dfc5329
0x6dfc51fa
0x6dfc5235
0x6dfc5236
0x6dfc5239
0x6dfc523f
0x6dfc5240
0x6dfc5241
0x6dfc5242
0x6dfc5246
0x6dfc5247
0x6dfc524e
0x6dfc5251
0x6dfc5267
0x6dfc5269
0x6dfc526e
0x6dfc527d
0x6dfc527e
0x6dfc5281
0x6dfc5282
0x6dfc5287
0x6dfc5288
0x6dfc528a
0x6dfc528f
0x6dfc5294
0x00000000
0x00000000
0x6dfc529a
0x6dfc529c
0x6dfc529e
0x6dfc529e
0x6dfc52a4
0x6dfc52b0
0x00000000
0x00000000
0x6dfc52ba
0x6dfc52bc
0x6dfc52bc
0x6dfc52d4
0x6dfc52d9
0x6dfc52dc
0x6dfc52e1
0x00000000
0x00000000
0x6dfc52e7
0x6dfc52f4
0x00000000
0x6dfc52f4
0x6dfc5270
0x00000000
0x6dfc5270
0x6dfc51fc
0x6dfc51fd
0x6dfc5202
0x6dfc5203
0x6dfc5205
0x6dfc520a
0x6dfc520f
0x00000000
0x00000000
0x6dfc521b
0x6dfc5226
0x6dfc522b
0x6dfc521d
0x6dfc521d
0x6dfc5222
0x6dfc5222
0x6dfc522d
0x00000000

APIs

ZwQuerySystemInformation.9419(0000005A,?,00000020,00000000,6E0205F0,00000080,6DFB5CA1,?,?,00000000,0000000E,00000000), ref: 6DFC5205

Part of subcall function 6DF89860: LdrInitializeThunk.NTDLL(6DFD15BB,00000073,?,00000008,00000000,?,00000568), ref: 6DF8986A

ZwQuerySystemInformationEx.9419(0000006B,?,00000004,00000000,00000000,?,6E0205F0,00000080,6DFB5CA1,?,?,00000000,0000000E,00000000), ref: 6DFC5249
RtlAllocateHeap.9419(?,00000008,?,0000006B,?,00000004,00000000,00000000,?,6E0205F0,00000080,6DFB5CA1,?,?,00000000,0000000E), ref: 6DFC5262
ZwQuerySystemInformationEx.9419(0000006B,?,00000004,00000000,?,?,?,0000006B,?,00000004,00000000,00000000,?,6E0205F0,00000080,6DFB5CA1), ref: 6DFC528A
RtlFindCharInUnicodeString.9419(00000001,?,6DF21810,?,6E0205F0,00000080,6DFB5CA1,?,?,00000000,0000000E,00000000), ref: 6DFC5310
RtlEnterCriticalSection.9419(?,6E0205F0,00000080,6DFB5CA1,?,?,00000000,0000000E,00000000), ref: 6DFC5351
memcpy.9419(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,6E0205F0,00000080), ref: 6DFC537F

Strings

Legacy, xrefs: 6DFC5226
UEFI, xrefs: 6DFC521D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQuerySystem$AllocateCharCriticalEnterFindHeapInitializeSectionStringThunkUnicodememcpy
String ID: Legacy$UEFI
API String ID: 3324348579-634100481
Opcode ID: 537a86470089db27318fb065432ca637a0f0972f00e1152250fef50e389892ae
Instruction ID: b34f1909fe6f283ccec99f6460b069dc0879c1e39c5e8f8eec01d2bb5f8959d7
Opcode Fuzzy Hash: 537a86470089db27318fb065432ca637a0f0972f00e1152250fef50e389892ae
Instruction Fuzzy Hash: D4516C72A0460A9FDB11CFAC8880BBEB7F9FB48304F15842DE619EB391DB719950CB11

Uniqueness

Uniqueness Score: -1.00%

Function 6DFC3C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6DFC3C93(intOrPtr __ecx, wchar_t* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				wchar_t* _v32;
				intOrPtr _v36;
				short _v38;
				void* _v40;
				void* _v48;
				void* _v56;
				void* __ebp;
				wchar_t* _t40;
				long _t43;
				long _t67;
				signed int _t72;
				intOrPtr _t75;
				signed short _t76;
				short _t78;
				intOrPtr _t79;
				void* _t80;
				signed short* _t81;
				intOrPtr _t84;
				void* _t85;
				void* _t89;

				_v12 = _v12 & 0x00000000;
				_t81 = __edx;
				_t79 = __ecx;
				_v24 = __ecx;
				_t40 = wcschr(__edx, 0x3d);
				if(_t40 == 0) {
					L25:
					__eflags = 0;
					return 0;
				}
				 *_t40 = 0;
				_t72 =  *_t81 & 0x0000ffff;
				_t87 = _t72 - 0x53;
				if(_t72 != 0x53) {
					__eflags = _t72 - 0x4f;
					if(_t72 != 0x4f) {
						goto L25;
					}
					_t43 = wcstoul( &(_t40[0]),  &_v32, 0x10);
					_t85 = _t85 + 0xc;
					_v12 = _t43;
					__eflags = _t43;
					if(__eflags == 0) {
						goto L25;
					}
					_t67 = 1;
					L6:
					_t80 = E6DFC3E74(_t79, _t87);
					if(_t80 == 0) {
						goto L25;
					}
					_t75 = 0;
					_t84 = ( *(_t80 + 0x14) & 0x0000ffff) + 0x18 + _t80;
					_t89 = 0 -  *(_t80 + 6);
					while(1) {
						_v8 = _t75;
						if(_t89 >= 0) {
							break;
						}
						_t78 = 8;
						if( *((intOrPtr*)(_t84 + 0xc)) == 0 ||  *((intOrPtr*)(_t84 + 8)) == 0) {
							L23:
							_t75 = _t75 + 1;
							_t84 = _t84 + 0x28;
							_t89 = _t75 - ( *(_t80 + 6) & 0x0000ffff);
							continue;
						} else {
							if(_t67 != 0) {
								_t21 = _t75 + 1; // 0x2
								__eflags = _v12 - _t21;
								if(_v12 != _t21) {
									L21:
									__eflags = _t67;
									if(_t67 != 0) {
										goto L23;
									}
									L22:
									RtlFreeUnicodeString( &_v48);
									_t75 = _v8;
									goto L23;
								}
								L19:
								_v16 =  *((intOrPtr*)(_t84 + 8));
								_v20 =  *((intOrPtr*)(_t84 + 0xc)) + _v24;
								_push( &_v28);
								_push(_a4);
								_push( &_v16);
								_push( &_v20);
								_push(0xffffffff);
								E6DF89A00();
								_push(_v28);
								_push(_v16);
								_push(_v20);
								E6DFD5720(0x55, 3, "Set 0x%X protection for %p section for %d bytes, old protection 0x%X\n", _a4);
								_t85 = _t85 + 0x1c;
								__eflags = _t67;
								if(_t67 != 0) {
									break;
								}
								_t75 = _v8;
								goto L21;
							}
							_t76 = 0;
							_v36 = _t84;
							_v38 = _t78;
							_v40 = 0;
							while( *((char*)((_t76 & 0x0000ffff) + _t84)) != 0) {
								_t76 = _t76 + 1;
								_v40 = _t76;
								if(_t76 < _t78) {
									continue;
								}
								break;
							}
							if(RtlAnsiStringToUnicodeString( &_v48,  &_v40, 1) < 0) {
								goto L25;
							}
							if(RtlCompareUnicodeString( &_v56,  &_v48, 1) == 0) {
								goto L19;
							}
							goto L22;
						}
					}
					return 1;
				}
				RtlInitUnicodeString( &_v56,  &(_t40[0]));
				_t67 = 0;
				goto L6;
			}

0x6dfc3c9b
0x6dfc3ca2
0x6dfc3ca4
0x6dfc3ca9
0x6dfc3cac
0x6dfc3cb5
0x6dfc3e08
0x6dfc3e08
0x00000000
0x6dfc3e08
0x6dfc3cbd
0x6dfc3cc0
0x6dfc3cc3
0x6dfc3cc6
0x6dfc3cd9
0x6dfc3cdc
0x00000000
0x00000000
0x6dfc3cec
0x6dfc3cf1
0x6dfc3cf4
0x6dfc3cf7
0x6dfc3cf9
0x00000000
0x00000000
0x6dfc3cff
0x6dfc3d01
0x6dfc3d08
0x6dfc3d0c
0x00000000
0x00000000
0x6dfc3d1b
0x6dfc3d1d
0x6dfc3d1f
0x6dfc3d23
0x6dfc3d23
0x6dfc3d26
0x00000000
0x00000000
0x6dfc3d32
0x6dfc3d33
0x6dfc3df5
0x6dfc3df9
0x6dfc3dfa
0x6dfc3dfd
0x00000000
0x6dfc3d43
0x6dfc3d45
0x6dfc3d94
0x6dfc3d97
0x6dfc3d9a
0x6dfc3de5
0x6dfc3de5
0x6dfc3de7
0x00000000
0x00000000
0x6dfc3de9
0x6dfc3ded
0x6dfc3df2
0x00000000
0x6dfc3df2
0x6dfc3d9c
0x6dfc3d9f
0x6dfc3da8
0x6dfc3dae
0x6dfc3daf
0x6dfc3db5
0x6dfc3db9
0x6dfc3dba
0x6dfc3dbc
0x6dfc3dc1
0x6dfc3dc4
0x6dfc3dc7
0x6dfc3dd6
0x6dfc3ddb
0x6dfc3dde
0x6dfc3de0
0x00000000
0x00000000
0x6dfc3de2
0x00000000
0x6dfc3de2
0x6dfc3d47
0x6dfc3d49
0x6dfc3d4c
0x6dfc3d50
0x6dfc3d54
0x6dfc3d5d
0x6dfc3d5f
0x6dfc3d66
0x00000000
0x00000000
0x00000000
0x6dfc3d66
0x6dfc3d79
0x00000000
0x00000000
0x6dfc3d90
0x00000000
0x00000000
0x00000000
0x6dfc3d92
0x6dfc3d33
0x00000000
0x6dfc3e04
0x6dfc3cd0
0x6dfc3cd5
0x00000000

APIs

wcschr.9419(?,0000003D,00000000,?), ref: 6DFC3CAC
RtlInitUnicodeString.9419(?,-00000002,00000000,?), ref: 6DFC3CD0
wcstoul.9419(-00000002,?,00000010,00000000,?), ref: 6DFC3CEC
RtlAnsiStringToUnicodeString.9419(?,?,00000001,00000000,?), ref: 6DFC3D72
RtlCompareUnicodeString.9419(?,?,00000001,?,?,00000001,00000000,?), ref: 6DFC3D89
ZwProtectVirtualMemory.9419(000000FF,?,?,00000000,?,00000000,?), ref: 6DFC3DBC
DbgPrintEx.9419(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6DFC3DD6
RtlFreeUnicodeString.9419(?,00000000,?), ref: 6DFC3DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6DFC3DCD

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: abf0253e9d8f3f268998cc6214ae3f6c92bed66e4f0208fc1e3b85d59b8aaf24
Instruction ID: c21456d75efd36e3bbca7cf7b3e23b12e4958231c58f20f3451391f426712726
Opcode Fuzzy Hash: abf0253e9d8f3f268998cc6214ae3f6c92bed66e4f0208fc1e3b85d59b8aaf24
Instruction Fuzzy Hash: 7041B472D0420FAADB00CBA8D841BFFB7F8AF09350F10402AE555A7140FB32DA55DB62

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7F0BF, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6DF7F0BF(signed short* __ecx, signed short __edx, void* __eflags, void** _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				void* _t51;
				signed short _t82;
				short _t84;
				signed int _t91;
				void* _t97;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				void* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = L6DF64120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t108 = E6DF89830();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v44);
						_push( &_v52);
						_push(_v68);
						_t108 = E6DF89990();
						if(_t108 < 0) {
							L10:
							_push(_v68);
							E6DF895D0();
							goto L11;
						} else {
							_t109 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								_t97 = _t21;
								 *((intOrPtr*)(_t109 + 4)) = _v76;
								 *_t109 = 1;
								 *(_t109 + 0x10) = _t97;
								 *(_t109 + 0xe) = _t82;
								 *(_t109 + 8) = _v72;
								 *((intOrPtr*)(_t109 + 0x14)) = _v48;
								memcpy(_t97, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *(_t109 + 0x10) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v76);
										E6DF895D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)( *(_t109 + 0x10) + _t100)) = _t84;
										 *((short*)( *(_t109 + 0x10) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x6df7f0d3
0x6df7f0d9
0x6df7f0e0
0x6df7f0e7
0x6df7f0f2
0x6df7f0f4
0x6df7f0f8
0x6df7f100
0x6df7f108
0x6df7f10d
0x6df7f115
0x6df7f116
0x6df7f11f
0x6df7f123
0x6df7f124
0x6df7f12c
0x6df7f130
0x6df7f144
0x6df7f14b
0x6df7f152
0x6dfbbab0
0x6dfbbab0
0x6df7f158
0x6df7f158
0x6df7f15a
0x6df7f160
0x6df7f165
0x6df7f166
0x6df7f16f
0x6df7f173
0x6dfbbaa7
0x6dfbbaa7
0x6dfbbaab
0x00000000
0x6df7f179
0x6df7f18d
0x6df7f191
0x6dfbbaa2
0x00000000
0x6df7f197
0x6df7f19b
0x6df7f19b
0x6df7f1a2
0x6df7f1a9
0x6df7f1af
0x6df7f1b2
0x6df7f1b6
0x6df7f1b9
0x6df7f1c4
0x6df7f1d8
0x6df7f1df
0x6df7f1e3
0x6df7f1eb
0x6df7f1ee
0x6df7f1f4
0x6df7f20f
0x6dfbbab7
0x6dfbbabb
0x6dfbbacc
0x6dfbbad1
0x6df7f215
0x6df7f218
0x6df7f226
0x6df7f22b
0x00000000
0x6df7f22b
0x6df7f1f6
0x6df7f1f6
0x6df7f1f9
0x6df7f1fb
0x6df7f1fb
0x6df7f1f4
0x6df7f191
0x6df7f173
0x6df7f152
0x6df7f203

APIs

ZwOpenFile.9419(?,?,?,00000021,00100020,?), ref: 6DF7F134
RtlFreeHeap.9419(?,00000000,?,?,?,?,00000021,00100020,?), ref: 6DF7F14B
ZwQueryVolumeInformationFile.9419(00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6DF7F16A
RtlAllocateHeap.9419(?,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6DF7F188
memcpy.9419(00000018,?,00000000,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021), ref: 6DF7F1C4
ZwClose.9419(00000000,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6DFBBAAB
ZwClose.9419(?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6E0379A0,6E0379A0), ref: 6DFBBABB
RtlFreeHeap.9419(?,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6DFBBACC

Strings

@, xrefs: 6DF7F124

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseFileFree$AllocateInformationOpenQueryVolumememcpy
String ID: @
API String ID: 3376599671-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 726144fb1ea146dc7a37d1fad5eacb70f401842b7d4557070d3bfa69b0eb5249
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 94518D71504711AFC321CF19C840A6BB7F8FF48714F01892EFA9597690E7B4E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF576FE, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 116
nativeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6DF576FE(WCHAR* __ecx, unsigned int* __edx, short* _a4) {
				signed int _v12;
				char _v528;
				signed int _v532;
				intOrPtr _v536;
				WCHAR* _v540;
				char* _v544;
				void* _v548;
				signed int _v552;
				signed int _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				signed int _v568;
				char _v572;
				void* _v580;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t39;
				long _t56;
				unsigned int _t58;
				unsigned int* _t60;
				intOrPtr _t66;
				short* _t68;
				long _t69;
				signed int _t70;

				_t67 = __edx;
				_v12 =  *0x6e03d360 ^ _t70;
				_t60 = __edx;
				_v540 = __ecx;
				_t68 = _a4;
				if(__edx == 0 || __ecx == 0) {
					_t39 = 0xc000000d;
					goto L8;
				} else {
					_v532 = _v532 & 0x00000000;
					_v536 =  *((intOrPtr*)(__edx));
					RtlInitUnicodeString( &_v580, L"Latest");
					_v548 = 0x2000000;
					_v544 =  &_v528;
					_t69 = RtlAppendUnicodeToString( &_v548, L"\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages");
					if(_t69 < 0) {
						L6:
						if(_v532 != 0) {
							 *0x6df26cb8(_v532);
						}
						_t39 = _t69;
						L8:
						return E6DF8B640(_t39, _t60, _v12 ^ _t70, _t67, _t68, _t69);
					}
					_t69 = RtlAppendUnicodeToString( &_v548, 0x6df25000);
					if(_t69 < 0) {
						goto L6;
					}
					_t69 = RtlAppendUnicodeToString( &_v548, _v540);
					if(_t69 < 0) {
						goto L6;
					}
					_v572 = 0x18;
					_v564 =  &_v548;
					_v532 = 0;
					_v568 = 0;
					_v560 = 0x40;
					_v556 = 0;
					_v552 = 0;
					_t69 =  *0x6df26cd8( &_v532, 0x20019,  &_v572);
					if(_t69 >= 0) {
						_t67 =  &_v580;
						_t56 = E6E01F1B5(_v532,  &_v580,  &_v540, _t68, _t60);
						_t66 = _v536;
						_t69 = _t56;
						if(_t69 < 0) {
							L16:
							if(_t68 != 0 && _t66 >= 2) {
								 *_t68 = 0;
							}
							goto L6;
						}
						if(_v540 == 1) {
							_t58 =  *_t60;
							if(_t58 > _t66) {
								_t69 = 0xc0000023;
							} else {
								_t67 = 0;
								 *((short*)(_t68 + (_t58 >> 1) * 2 - 2)) = 0;
							}
							if(_t69 >= 0) {
								goto L6;
							} else {
								goto L16;
							}
						}
						_t69 = 0xc000015c;
						goto L16;
					}
					goto L6;
				}
			}

0x6df576fe
0x6df57710
0x6df57715
0x6df57719
0x6df57720
0x6df57725
0x6dfa9609
0x00000000
0x6df57733
0x6df57735
0x6df5773c
0x6df5774e
0x6df5775a
0x6df57764
0x6df5777b
0x6df5777f
0x6df57811
0x6df57818
0x6dfa95fe
0x6dfa95fe
0x6df5781e
0x6df57820
0x6df57830
0x6df57830
0x6df57796
0x6df5779a
0x00000000
0x00000000
0x6df577ae
0x6df577b2
0x00000000
0x00000000
0x6df577ba
0x6df577c4
0x6df577d2
0x6df577e4
0x6df577eb
0x6df577f5
0x6df577fb
0x6df57807
0x6df5780b
0x6dfa9598
0x6dfa959e
0x6dfa95a3
0x6dfa95a9
0x6dfa95ad
0x6dfa95dd
0x6dfa95df
0x6dfa95f0
0x6dfa95f0
0x00000000
0x6dfa95df
0x6dfa95b6
0x6dfa95bf
0x6dfa95c3
0x6dfa95d0
0x6dfa95c5
0x6dfa95c7
0x6dfa95c9
0x6dfa95c9
0x6dfa95d7
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfa95d7
0x6dfa95b8
0x00000000
0x6dfa95b8
0x00000000
0x6df5780b

APIs

RtlInitUnicodeString.9419(?,Latest,00000000,02BDFFFE,?), ref: 6DF5774E
RtlAppendUnicodeToString.9419(02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6DF57776

Part of subcall function 6DF5A990: memmove.9419(00000000,00000050,00000052,?,?,00000000,?,?,6DF5A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6DF5A9E2

RtlAppendUnicodeToString.9419(02000000,6DF25000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6DF57791
RtlAppendUnicodeToString.9419(02000000,?,02000000,6DF25000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6DF577A9
ZwOpenKey.9419(00000000,00020019,00000018,02000000,?,02000000,6DF25000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6DF57801

Strings

\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages, xrefs: 6DF57770
Latest, xrefs: 6DF57748
@, xrefs: 6DF577EB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Append$InitOpenmemmove
String ID: @$Latest$\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages
API String ID: 1239783430-1383699509
Opcode ID: 83650ec54a428f4b774b8903883c5e5cb14588615f33ac7dc695b560fc848b3a
Instruction ID: 33d916d10b72d5584880068beb08c2b238797136413c9d55c400fb6f1599516e
Opcode Fuzzy Hash: 83650ec54a428f4b774b8903883c5e5cb14588615f33ac7dc695b560fc848b3a
Instruction Fuzzy Hash: 31416D71D5022D9BCB21CB58CCC8BEAB7B8BB15311F1585EAE808A7200DB719E84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF6369, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113
nativefileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6DFF6369(char* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr* _a4) {
				signed int _v12;
				short _v536;
				char _v540;
				char _v544;
				char _v548;
				intOrPtr _v556;
				char _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				char _v584;
				void* _v592;
				char _v600;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t33;
				char* _t50;
				intOrPtr* _t52;
				intOrPtr* _t63;
				signed int _t65;

				_v12 =  *0x6e03d360 ^ _t65;
				_t52 = _a4;
				_t63 = __edx;
				_t64 = __ecx;
				_t62 = 0x100;
				if(E6DFDCD55( &_v536, 0x100, L"\\SystemRoot\\Globalization\\") < 0) {
					L11:
					_t33 = 0xc0000001;
					L12:
					return E6DF8B640(_t33, _t52, _v12 ^ _t65, _t62, _t63, _t64);
				}
				_t64 = 0x100;
				_t62 = 0x100;
				if(E6DFE83B1( &_v536, 0x100, __ecx) < 0) {
					goto L11;
				}
				_t62 = 0x100;
				if(E6DFE83B1( &_v536, 0x100, L".nlp") < 0) {
					goto L11;
				}
				RtlInitUnicodeString( &_v592,  &_v536);
				_v584 = 0x18;
				_push(0);
				_v580 = 0;
				_v576 =  &_v592;
				_push(1);
				_push( &_v600);
				_v572 = 0x40;
				_push( &_v584);
				_push(0x80100000);
				_v568 = 0;
				_push( &_v540);
				_v564 = 0;
				_t64 = E6DF89830();
				if(_t64 >= 0) {
					_t62 =  &_v560;
					if(E6DFF60A2(_v540,  &_v560) < 0 || _v556 != 0) {
						_t64 = 0xc0000001;
					} else {
						_push(_v540);
						_push(0x8000000);
						_push(2);
						 *_t52 = _v560;
						_t52 = 0;
						_push(0);
						_push(0);
						_push(0xf0005);
						_push( &_v544);
						_t64 = E6DF899A0();
						if(_t64 >= 0) {
							_push(2);
							_push(0);
							_push(1);
							 *_t63 = 0;
							_push( &_v548);
							_push(0);
							_push(0);
							_push(0);
							_push(_t63);
							_push(0xffffffff);
							_push(_v544);
							_v548 = 0;
							_t50 = E6DF89780();
							_push(_v544);
							_t64 = _t50;
							E6DF895D0();
						}
					}
					_push(_v540);
					E6DF895D0();
				}
				_t33 = _t64;
				goto L12;
			}

0x6dff637b
0x6dff637f
0x6dff6384
0x6dff6386
0x6dff638d
0x6dff639f
0x6dff64e3
0x6dff64e3
0x6dff64e8
0x6dff64f8
0x6dff64f8
0x6dff63a6
0x6dff63b1
0x6dff63ba
0x00000000
0x00000000
0x6dff63c5
0x6dff63d4
0x00000000
0x00000000
0x6dff63e8
0x6dff63ef
0x6dff63f9
0x6dff6400
0x6dff6406
0x6dff6412
0x6dff6414
0x6dff641b
0x6dff6425
0x6dff6426
0x6dff6431
0x6dff6437
0x6dff6438
0x6dff6443
0x6dff6447
0x6dff6453
0x6dff6460
0x6dff64cf
0x6dff646b
0x6dff646b
0x6dff6477
0x6dff647c
0x6dff647e
0x6dff6480
0x6dff6482
0x6dff6483
0x6dff6484
0x6dff648f
0x6dff6495
0x6dff6499
0x6dff649b
0x6dff649d
0x6dff649e
0x6dff64a6
0x6dff64a8
0x6dff64a9
0x6dff64aa
0x6dff64ab
0x6dff64ac
0x6dff64ad
0x6dff64af
0x6dff64b5
0x6dff64bb
0x6dff64c0
0x6dff64c6
0x6dff64c8
0x6dff64c8
0x6dff6499
0x6dff64d4
0x6dff64da
0x6dff64da
0x6dff64df
0x00000000

APIs

RtlInitUnicodeString.9419(?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6DFF63E8
ZwOpenFile.9419(?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6DFF643E

Part of subcall function 6DFF60A2: ZwQueryInformationFile.9419(?,00000001,?,00000018,00000005,00000000,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000), ref: 6DFF60C4

ZwCreateSection.9419(?,000F0005,00000000,00000000,00000002,08000000,?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp), ref: 6DFF6490

Part of subcall function 6DF899A0: LdrInitializeThunk.NTDLL(6DFD1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6DF899AA

ZwMapViewOfSection.9419(?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002,08000000), ref: 6DFF64BB

Part of subcall function 6DF89780: LdrInitializeThunk.NTDLL(6DFD1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6DF8978A

ZwClose.9419(?,?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002), ref: 6DFF64C8
ZwClose.9419(?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6DFF64DA

Strings

\SystemRoot\Globalization\, xrefs: 6DFF6388
.nlp, xrefs: 6DFF63C0
@, xrefs: 6DFF641B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileInitializeSectionThunk$CreateInformationInitOpenQueryStringUnicodeView
String ID: .nlp$@$\SystemRoot\Globalization\
API String ID: 4284092774-2934557456
Opcode ID: 6849b58b1bd36b1951edeac674a0614113836557902ae9ca6d1fca791600a0cd
Instruction ID: 19d5a5394e9a4b37c1ca3b33376b04d1c8783eae42be6cb3b43811911a7c3bcc
Opcode Fuzzy Hash: 6849b58b1bd36b1951edeac674a0614113836557902ae9ca6d1fca791600a0cd
Instruction Fuzzy Hash: 2A418F7194122D6BDB219B18CC88FDAB7B8EB44318F0141E5B909A7291DF709E84CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF737EB, Relevance: 15.3, APIs: 10, Instructions: 269
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DF737EB(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t98;
				intOrPtr _t102;
				char* _t113;
				signed short _t123;
				signed int _t124;
				signed int _t129;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t139;
				intOrPtr* _t141;
				long _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t157;
				signed int _t160;
				signed short _t163;
				signed short _t164;
				signed int _t173;
				intOrPtr* _t176;
				short _t178;
				intOrPtr _t179;
				intOrPtr* _t181;
				intOrPtr _t182;
				void* _t183;

				_push(0x50);
				_push(0x6e01ff48);
				E6DF9D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t183 - 0x44)) = __ecx;
				 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000001;
				 *((intOrPtr*)(_t183 - 0x24)) = 0;
				 *((intOrPtr*)(__ecx)) = 0;
				 *(_t183 - 0x2c) = __edx & 0x00000001;
				_t98 =  *[fs:0x30];
				RtlImageNtHeader( *(_t98 + 8));
				if(_t98 == 0) {
					_t178 = 0xc000007b;
					L28:
					return E6DF9D0D1(_t178);
				}
				 *((intOrPtr*)(_t183 - 0x38)) =  *((intOrPtr*)(_t98 + 0x60));
				_t179 =  *((intOrPtr*)(_t98 + 0x64));
				 *((intOrPtr*)(_t183 - 0x30)) = _t179;
				_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x208));
				if(_t102 != 0) {
					if(_t179 < _t102) {
						 *((intOrPtr*)(_t183 - 0x30)) = _t102;
					}
				}
				_t181 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0x000c0000 | 0x00000008, 0x120);
				 *((intOrPtr*)(_t183 - 0x20)) = _t181;
				 *((intOrPtr*)(_t183 - 4)) = 0;
				 *((intOrPtr*)(_t183 - 0x40)) = 1;
				if(_t181 == 0) {
					L36:
					_t178 = 0xc0000017;
					 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
					goto L24;
				} else {
					_t152 =  *0x6e0384c4 + 0xc0000;
					 *(_t183 - 0x48) = _t152;
					_t153 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t152,  *0x6e0384c0 * 0x24);
					 *((intOrPtr*)(_t183 - 0x24)) = _t153;
					if(_t153 == 0) {
						_t178 = 0xc0000017;
						 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
						_t181 =  *((intOrPtr*)(_t183 - 0x20));
						L24:
						 *((intOrPtr*)(_t183 - 4)) = 0xfffffffe;
						 *((intOrPtr*)(_t183 - 0x40)) = 0;
						E6DF73B5A(_t107, 0, _t178, _t181);
						if(_t178 < 0) {
							goto L28;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t183 - 0x44)))) = _t181;
						if(E6DF67D50() != 0) {
							_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							_t178 =  *((intOrPtr*)(_t183 - 0x1c));
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
						} else {
							_t113 = 0x7ffe0386;
						}
						if( *_t113 != 0) {
							L32:
							E6E018BB6(_t181);
						}
						goto L28;
					}
					_t154 = 0;
					 *(_t183 - 0x28) = 0;
					_t182 =  *((intOrPtr*)(_t183 - 0x20));
					_t173 =  *0x6e0384c0;
					while(_t154 < 3) {
						 *((intOrPtr*)(_t182 + 0x10 + _t154 * 4)) = _t173 * _t154 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						_t154 = _t154 + 1;
						 *(_t183 - 0x28) = _t154;
					}
					_t155 = 0;
					while(1) {
						 *(_t183 - 0x28) = _t155;
						if(_t155 >= _t173 * 3) {
							break;
						}
						_t141 = _t155 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						 *((intOrPtr*)(_t141 + 8)) = 0;
						 *((intOrPtr*)(_t141 + 4)) = _t141;
						 *_t141 = _t141;
						_t155 = _t155 + 1;
					}
					_t157 =  *0x6e0384c4 + 0xc0000;
					 *(_t183 - 0x4c) = _t157;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t157 | 0x00000008, _t173 << 2);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x1c) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t160 =  *0x6e0384c4 + 0xc0000;
					 *(_t183 - 0x50) = _t160;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t160 | 0x00000008,  *0x6e0384c0 * 0xc);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x20) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t123 =  *0x7ffe03c0;
					 *(_t183 - 0x34) = _t123;
					 *(_t183 - 0x54) = _t123;
					 *(_t181 + 0x100) = _t123;
					_t178 = E6DF73B7A(_t181);
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					}
					 *((intOrPtr*)(_t181 + 0x104)) = 0xfffffffe;
					 *(_t183 - 0x60) = 0;
					 *((intOrPtr*)(_t183 - 0x5c)) = 0;
					_t163 =  *(_t183 - 0x34);
					_t124 = _t163 & 0x0000ffff;
					 *(_t183 - 0x60) = _t124;
					 *(_t181 + 8) = _t124;
					 *((intOrPtr*)(_t181 + 0xc)) = 0;
					 *_t181 = 1;
					if(_t163 < 4) {
						_t164 = 4;
					} else {
						_t164 = _t163 + 1;
					}
					 *(_t183 - 0x34) = _t164;
					_t49 = _t181 + 0x28; // 0x28
					_push(_t164);
					_push(0);
					_push(0x1f0003);
					_t178 = E6DF89F70();
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					} else {
						 *((intOrPtr*)(_t183 - 4)) = 1;
						 *((intOrPtr*)(_t183 - 0x3c)) = 1;
						_t129 =  *0x7ffe03c0 << 2;
						if(_t129 < 0x200) {
							_t129 = 0x200;
						}
						_t53 = _t181 + 0x24; // 0x24
						_push( *((intOrPtr*)(_t183 - 0x30)));
						_push( *((intOrPtr*)(_t183 - 0x38)));
						_push(_t129);
						_push(_t181);
						_push(0x6df6c740);
						_push(0xffffffff);
						_push( *((intOrPtr*)(_t181 + 0x28)));
						_push(0);
						_push(0xf00ff);
						_t178 = E6DF8A160();
						 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
						if(_t178 < 0) {
							L23:
							 *((intOrPtr*)(_t183 - 4)) = 0;
							 *((intOrPtr*)(_t183 - 0x3c)) = 0;
							_t107 = E6DF73B48(_t130, 0, _t178, _t181);
							goto L24;
						} else {
							if( *(_t183 - 0x2c) != 0) {
								_push(4);
								_push(_t183 - 0x2c);
								_push(0xd);
								_push( *((intOrPtr*)(_t181 + 0x24)));
								_t178 = E6DF8AE70();
								 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
								if(_t178 < 0) {
									goto L23;
								}
								 *((short*)(_t181 + 0xe6)) =  *(_t183 - 0x2c);
							}
							 *((intOrPtr*)(_t181 + 0x2c)) = 0;
							 *((intOrPtr*)(_t181 + 0xe0)) = 0;
							 *((intOrPtr*)(_t181 + 0x110)) = 0;
							 *((short*)(_t181 + 0xe4)) = 0;
							_t63 = _t181 + 0x30; // 0x30
							_t133 = _t63;
							 *((intOrPtr*)(_t133 + 4)) = _t133;
							 *_t133 = _t133;
							_t65 = _t181 + 0x38; // 0x38
							_t134 = _t65;
							 *((intOrPtr*)(_t134 + 4)) = _t134;
							 *_t134 = _t134;
							_t67 = _t181 + 0x114; // 0x114
							_t135 = _t67;
							 *((intOrPtr*)(_t135 + 4)) = _t135;
							 *_t135 = _t135;
							E6DF6F194(_t181, _t183 - 0x58, 0);
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
							 *((intOrPtr*)(_t181 + 0xf0)) =  *((intOrPtr*)(_t183 + 4));
							_t73 = _t181 + 0x40; // 0x40
							_t178 = E6DF7196E(_t73, _t181);
							 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
							if(_t178 < 0) {
								goto L23;
							}
							_t178 = 0;
							 *((intOrPtr*)(_t183 - 0x1c)) = 0;
							E6DF62280(_t130, 0x6e0386b4);
							 *((intOrPtr*)(_t183 - 4)) = 2;
							_t77 = _t181 + 0xe8; // 0xe8
							_t139 = _t77;
							_t176 =  *0x6e0353dc; // 0x6e0353d8
							if( *_t176 != 0x6e0353d8) {
								_push(3);
								asm("int 0x29");
								goto L32;
							}
							 *_t139 = 0x6e0353d8;
							 *((intOrPtr*)(_t139 + 4)) = _t176;
							 *_t176 = _t139;
							 *0x6e0353dc = _t139;
							 *((intOrPtr*)(_t183 - 4)) = 1;
							_t130 = E6DF73B3D();
							goto L23;
						}
					}
				}
			}

0x6df737eb
0x6df737ed
0x6df737f2
0x6df737f7
0x6df737fa
0x6df73803
0x6df73806
0x6df7380b
0x6df7380e
0x6df73817
0x6df7381e
0x6dfb615c
0x6df73b0c
0x6df73b13
0x6df73b13
0x6df73827
0x6df7382a
0x6df7382d
0x6df73836
0x6df7383e
0x6dfb6168
0x6dfb616e
0x6dfb616e
0x6dfb6168
0x6df73865
0x6df73867
0x6df7386a
0x6df7386d
0x6df73876
0x6dfb6176
0x6dfb6176
0x6dfb617b
0x00000000
0x6df7387c
0x6df73882
0x6df73888
0x6df738a2
0x6df738a4
0x6df738a9
0x6dfb6183
0x6dfb6188
0x6dfb618b
0x6df73ad9
0x6df73ad9
0x6df73ae0
0x6df73ae7
0x6df73aee
0x00000000
0x00000000
0x6df73af3
0x6df73afc
0x6dfb6288
0x6dfb628d
0x6dfb6290
0x6df73b02
0x6df73b02
0x6df73b02
0x6df73b0a
0x6df73b71
0x6df73b73
0x6df73b73
0x00000000
0x6df73b0a
0x6df738af
0x6df738b1
0x6df738b4
0x6df738b7
0x6df738bd
0x6df738cd
0x6df738d1
0x6df738d2
0x6df738d2
0x6df738d7
0x6df738d9
0x6df738d9
0x6df738e1
0x00000000
0x00000000
0x6df738e6
0x6df738e9
0x6df738ec
0x6df738ef
0x6df738f1
0x6df738f1
0x6df738fa
0x6df73900
0x6df73916
0x6df7391b
0x6df7391e
0x6df73923
0x00000000
0x00000000
0x6df7392f
0x6df73935
0x6df7394d
0x6df73952
0x6df73955
0x6df7395a
0x00000000
0x00000000
0x6df73960
0x6df73965
0x6df73968
0x6df7396b
0x6df73978
0x6df7397a
0x6df7397f
0x00000000
0x00000000
0x6df73985
0x6df7398f
0x6df73992
0x6df73995
0x6df73998
0x6df7399b
0x6df7399e
0x6df739a1
0x6df739a4
0x6df739ad
0x6dfb6195
0x6df739b3
0x6df739b3
0x6df739b3
0x6df739b4
0x6df739b7
0x6df739ba
0x6df739bb
0x6df739bc
0x6df739c7
0x6df739c9
0x6df739ce
0x00000000
0x6df739d4
0x6df739d7
0x6df739da
0x6df739e2
0x6df739ec
0x6df739ee
0x6df739ee
0x6df739f0
0x6df739f3
0x6df739f6
0x6df739f9
0x6df739fa
0x6df739fb
0x6df73a00
0x6df73a02
0x6df73a05
0x6df73a06
0x6df73a11
0x6df73a13
0x6df73a18
0x6df73aca
0x6df73aca
0x6df73acd
0x6df73ad4
0x00000000
0x6df73a1e
0x6df73a22
0x6df73b14
0x6df73b19
0x6df73b1a
0x6df73b1c
0x6df73b24
0x6df73b26
0x6df73b2b
0x00000000
0x00000000
0x6df73b31
0x6df73b31
0x6df73a28
0x6df73a2b
0x6df73a31
0x6df73a37
0x6df73a3e
0x6df73a3e
0x6df73a41
0x6df73a44
0x6df73a46
0x6df73a46
0x6df73a49
0x6df73a4c
0x6df73a4e
0x6df73a4e
0x6df73a54
0x6df73a57
0x6df73a5f
0x6df73a67
0x6df73a6a
0x6df73a70
0x6df73a7a
0x6df73a7c
0x6df73a81
0x00000000
0x00000000
0x6df73a83
0x6df73a85
0x6df73a8d
0x6df73a92
0x6df73a99
0x6df73a99
0x6df73a9f
0x6df73aac
0x6df73b6c
0x6df73b6f
0x00000000
0x6df73b6f
0x6df73ab2
0x6df73ab4
0x6df73ab7
0x6df73ab9
0x6df73abe
0x6df73ac5
0x00000000
0x6df73ac5
0x6df73a18
0x6df739ce

APIs

RtlImageNtHeader.9419(?,6E01FF48,00000050,6DF73E98,?,6DF6F900,00000000,00000000,?,?,?,6E01FEB8,0000001C,6DF42C4C,?), ref: 6DF73817

Part of subcall function 6DF5B060: RtlImageNtHeaderEx.9419(00000001,?,00000000,00000000,?,?,?,6DF7381C,?,6E01FF48,00000050,6DF73E98,?,6DF6F900,00000000,00000000), ref: 6DF5B076

RtlAllocateHeap.9419(?,?,00000120,?,6E01FF48,00000050,6DF73E98,?,6DF6F900,00000000,00000000,?,?,?,6E01FEB8,0000001C), ref: 6DF73860
RtlAllocateHeap.9419(?,?,00000000,?,?,00000120,?,6E01FF48,00000050,6DF73E98,?,6DF6F900,00000000,00000000), ref: 6DF7389D
RtlAllocateHeap.9419(?,?,?,?,?,00000000,?,?,00000120,?,6E01FF48,00000050,6DF73E98,?,6DF6F900,00000000), ref: 6DF73916
RtlAllocateHeap.9419(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6E01FF48,00000050,6DF73E98), ref: 6DF7394D
ZwCreateIoCompletion.9419(00000028,001F0003,00000000,?), ref: 6DF739C2
ZwCreateWorkerFactory.9419(00000024,000F00FF,00000000,?,000000FF,6DF6C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6DF73A0C
RtlAcquireSRWLockExclusive.9419(6E0386B4,00000000,00000024,000F00FF,00000000,?,000000FF,6DF6C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6DF73A8D
RtlGetCurrentServiceSessionId.9419(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6E01FF48,00000050,6DF73E98), ref: 6DF73AF5
ZwSetInformationWorkerFactory.9419(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6DF6C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6DF73B1F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: c399856d8e2080f98f1588419d64b6bde8c83723c6918dcb764f87eb9535d7ec
Instruction ID: 97e4195e0a7c487257ef6f5c700fa39d2c219fa719b1638c42d3fb8acead411b
Opcode Fuzzy Hash: c399856d8e2080f98f1588419d64b6bde8c83723c6918dcb764f87eb9535d7ec
Instruction Fuzzy Hash: E2B166B1904609AFCB25CF9DD940BAEBBF4FB49704F11806EE52AAB790D7349901CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6DFCAE60, Relevance: 15.2, APIs: 5, Strings: 5, Instructions: 247
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6DFCAE60(signed short* _a4, short* _a8, short* _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				void* _v36;
				void* _v40;
				signed int _v44;
				signed short* _t85;
				unsigned int _t86;
				signed short _t100;
				short* _t109;
				short _t111;
				signed int _t113;
				void* _t130;
				signed short _t132;
				signed int _t133;
				signed short _t135;
				short* _t144;
				signed int _t148;
				signed int _t150;
				int _t151;
				void* _t153;
				void* _t154;
				signed short _t155;
				signed int _t156;
				short* _t159;
				short* _t160;
				signed short* _t161;
				unsigned int _t167;
				signed int _t169;
				unsigned int _t170;
				void* _t172;
				signed short _t176;
				void* _t177;
				int _t178;
				int _t180;
				void* _t183;
				void* _t184;
				signed int _t186;
				void* _t187;
				void* _t188;

				_t85 = _a4;
				_t150 = 0;
				_v40 = 0;
				_t176 =  *_t85 & 0x0000ffff;
				_t155 = _t85[2];
				_t86 = _t176 & 0x0000ffff;
				_v16 = _t155;
				_v24 = 0;
				_v20 = _t176;
				_v12 = 0x5c;
				_v28 = 0x2f;
				_t170 = _t86;
				if(_t86 == 0) {
					L11:
					_v20 = 0;
					asm("sbb eax, eax");
					_v36 = ( ~_t150 & 0xfffffff8) + 8;
					_v8 = _t170 - (_v16 - _t155 & 0xfffffffe);
					_t172 =  *0x6e036e54;
					_v44 = 0;
					if(_t172 != 0) {
						_t156 =  *0x6e036e50 & 0x0000ffff;
						_t151 = 0;
						_v20 = _v12;
						if(_t156 == 0) {
							L32:
							_t167 = _v8;
							L33:
							_t100 = _v36 + 0xe + _t151 + _v20 + _t167 + 2;
							_v32 = _t100;
							if(_t100 > 0xfffe) {
								L22:
								return 0xc0000106;
							}
							_t177 = E6DF63A1C(_t100 & 0x0000ffff);
							_v36 = _t177;
							if(_t177 != 0) {
								memcpy(_t177, _t172, _t151);
								_t188 = _t187 + 0xc;
								_t153 = _t177 + (_t151 >> 1) * 2;
								_t178 = _v20;
								if(_t178 != 0) {
									memcpy(_t153, L"\\microsoft.system.package.metadata\\Application", _t178);
									_t188 = _t188 + 0xc;
									_t153 = _t153 + (_t178 >> 1) * 2;
								}
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t180 = _v8;
								 *((short*)(_t153 + 0xc)) = _v12;
								_t154 = _t153 + 0xe;
								memcpy(_t154, _v16, _t180);
								_t109 = _t154 + (_t180 >> 1) * 2;
								if(_v24 != 0) {
									 *_t109 = 0;
								} else {
									asm("movsd");
									asm("movsd");
									asm("movsw");
								}
								_t159 = _a8;
								 *((intOrPtr*)(_t159 + 4)) = _v40;
								_t111 = _v44;
								 *((short*)(_t159 + 2)) = _t111;
								 *_t159 = _t111;
								if(_t111 != 0) {
									 *_t159 = _t111 + 0xfffffffe;
								}
								_t160 = _a12;
								 *((intOrPtr*)(_t160 + 4)) = _v36;
								_t113 = _v32 & 0x0000ffff;
								 *(_t160 + 2) = _t113;
								 *_t160 = _t113 + 0xfffffffe;
								return 0;
							}
							L35:
							return 0xc0000017;
						}
						while( *((short*)(_t172 + (_t151 >> 1) * 2)) != 0x3b) {
							_t151 = _t151 + 2;
							if(_t151 < _t156) {
								continue;
							}
							goto L32;
						}
						goto L32;
					}
					_t151 =  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff;
					_t172 =  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c);
					_v32 = _t172;
					if(( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00000001) == 0) {
						_t172 = _t172 +  *((intOrPtr*)( *[fs:0x30] + 0x10));
						_v32 = _t172;
					}
					_t161 = _t172 + ((_t151 >> 1) - 1) * 2;
					_t130 = _t172;
					while(_t161 > _t172) {
						_t169 =  *_t161 & 0x0000ffff;
						if(_t169 == _v12 || _t169 == _v28) {
							_t130 =  &(_t161[1]);
							L21:
							_t132 = _t130 - _t172 & 0xfffffffe;
							if(_t132 <= 0xfffe) {
								_t133 = _t132 & 0x0000ffff;
								_v28 = _t133;
								if(_t176 > 0xfffc) {
									goto L22;
								}
								_t135 = _v36 + _t133 + _v8 + 2;
								if(_t135 > 0xfffe) {
									goto L22;
								}
								_v44 = _t135 & 0x0000ffff;
								_t183 = E6DF63A1C(_t135 & 0x0000ffff);
								_v40 = _t183;
								if(_t183 == 0) {
									goto L35;
								}
								memcpy(_t183, _t172, _v28);
								_t184 = _t183 + (_v28 >> 1) * 2;
								memcpy(_t184, _v16, _v8);
								_t167 = _v8;
								_t187 = _t187 + 0x18;
								_t144 = _t184 + (_t167 >> 1) * 2;
								if(_v24 != 0) {
									 *_t144 = 0;
								} else {
									asm("movsd");
									asm("movsd");
									asm("movsw");
									_t172 = _v32;
								}
								goto L33;
							}
							goto L22;
						} else {
							_t161 = _t161 - 2;
							continue;
						}
					}
					goto L21;
				}
				_t148 = _t155 + ((_t86 >> 1) - 1) * 2;
				if(_t148 <= _t155) {
					goto L11;
				} else {
					goto L2;
				}
				do {
					L2:
					_t186 =  *_t148 & 0x0000ffff;
					if(_t186 != 0x2e) {
						if(_t186 == _v12 || _t186 == _v28) {
							_v16 = _t148 + 2;
							L10:
							_t176 = _v20;
							goto L11;
						} else {
							goto L7;
						}
					} else {
						if(_t150 == 0) {
							_t150 = _t148;
							_v24 = _t150;
						}
					}
					L7:
					_t148 = _t148 - 2;
				} while (_t148 > _t155);
				goto L10;
			}

0x6dfcae68
0x6dfcae6f
0x6dfcae71
0x6dfcae74
0x6dfcae77
0x6dfcae7a
0x6dfcae7d
0x6dfcae80
0x6dfcae83
0x6dfcae86
0x6dfcae8d
0x6dfcae95
0x6dfcae9a
0x6dfcaed7
0x6dfcaed9
0x6dfcaede
0x6dfcaee6
0x6dfcaef5
0x6dfcaef8
0x6dfcaefe
0x6dfcaf03
0x6dfcb000
0x6dfcb007
0x6dfcb00c
0x6dfcb011
0x6dfcb025
0x6dfcb025
0x6dfcb028
0x6dfcb036
0x6dfcb038
0x6dfcb040
0x6dfcaf73
0x00000000
0x6dfcaf73
0x6dfcb04f
0x6dfcb051
0x6dfcb056
0x6dfcb065
0x6dfcb06c
0x6dfcb06f
0x6dfcb072
0x6dfcb077
0x6dfcb080
0x6dfcb085
0x6dfcb08a
0x6dfcb08a
0x6dfcb097
0x6dfcb098
0x6dfcb099
0x6dfcb09a
0x6dfcb0a1
0x6dfcb0a5
0x6dfcb0a9
0x6dfcb0b9
0x6dfcb0bc
0x6dfcb0cd
0x6dfcb0be
0x6dfcb0c5
0x6dfcb0c6
0x6dfcb0c7
0x6dfcb0c7
0x6dfcb0d0
0x6dfcb0d6
0x6dfcb0d9
0x6dfcb0dc
0x6dfcb0e0
0x6dfcb0e5
0x6dfcb0ea
0x6dfcb0ea
0x6dfcb0ed
0x6dfcb0f6
0x6dfcb0f9
0x6dfcb0fc
0x6dfcb103
0x00000000
0x6dfcb106
0x6dfcb058
0x00000000
0x6dfcb058
0x6dfcb013
0x6dfcb01e
0x6dfcb023
0x00000000
0x00000000
0x00000000
0x6dfcb023
0x00000000
0x6dfcb013
0x6dfcaf12
0x6dfcaf1f
0x6dfcaf28
0x6dfcaf32
0x6dfcaf3a
0x6dfcaf3d
0x6dfcaf3d
0x6dfcaf45
0x6dfcaf48
0x6dfcaf5e
0x6dfcaf4c
0x6dfcaf53
0x6dfcaf64
0x6dfcaf67
0x6dfcaf69
0x6dfcaf71
0x6dfcaf82
0x6dfcaf85
0x6dfcaf8b
0x00000000
0x00000000
0x6dfcaf96
0x6dfcaf9d
0x00000000
0x00000000
0x6dfcafa3
0x6dfcafab
0x6dfcafad
0x6dfcafb2
0x00000000
0x00000000
0x6dfcafbd
0x6dfcafcd
0x6dfcafd1
0x6dfcafd6
0x6dfcafd9
0x6dfcafe4
0x6dfcafe7
0x6dfcaffb
0x6dfcafe9
0x6dfcaff0
0x6dfcaff1
0x6dfcaff2
0x6dfcaff4
0x6dfcaff4
0x00000000
0x6dfcafe7
0x00000000
0x6dfcaf5b
0x6dfcaf5b
0x00000000
0x6dfcaf5b
0x6dfcaf53
0x00000000
0x6dfcaf62
0x6dfcae9f
0x6dfcaea4
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfcaea6
0x6dfcaea6
0x6dfcaea6
0x6dfcaeac
0x6dfcaebd
0x6dfcaed1
0x6dfcaed4
0x6dfcaed4
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfcaeae
0x6dfcaeb0
0x6dfcaeb2
0x6dfcaeb4
0x6dfcaeb4
0x6dfcaeb0
0x6dfcaec5
0x6dfcaec5
0x6dfcaec8
0x00000000

APIs

memcpy.9419(00000000,?,0000002F,?,?,00000000,?,?,?,?,6DFD4109), ref: 6DFCAFBD
memcpy.9419(00000000,00000000,?,00000000,?,0000002F,?,?,00000000,?,?,?,?,6DFD4109), ref: 6DFCAFD1
memcpy.9419(00000000,?,00000000,?,?,00000000,?,?,?,?,6DFD4109), ref: 6DFCB065
memcpy.9419(00000000,\microsoft.system.package.metadata\Application,?,?,00000000,?,?,?,?,6DFD4109), ref: 6DFCB080
memcpy.9419(-0000000E,00000000,?,?,00000000,?,?,?,?,6DFD4109), ref: 6DFCB0A9

Strings

\microsoft.system.package.metadata\Application, xrefs: 6DFCB07A
.Local, xrefs: 6DFCB092
\, xrefs: 6DFCAE86
/, xrefs: 6DFCAE8D
.DLL, xrefs: 6DFCAFE9, 6DFCB0BE

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: .DLL$.Local$/$\$\microsoft.system.package.metadata\Application
API String ID: 3510742995-2518169356
Opcode ID: db3654cb2d8624128cf0f133db26aad3e90df2a4a524b43b1d3e61ebec3b88b2
Instruction ID: e4b8078ed93da2196fe080c0ecd6a4d74cbc8504752e640473c2363583d8adbd
Opcode Fuzzy Hash: db3654cb2d8624128cf0f133db26aad3e90df2a4a524b43b1d3e61ebec3b88b2
Instruction Fuzzy Hash: DC919A7690061A9BCB11CFADC880AAEB7F0FF49314F194569E820E7350E735E951CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6F86D, Relevance: 15.1, APIs: 10, Instructions: 124
threadmemoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6DF6F86D(void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t31;
				signed int _t40;
				signed int _t45;
				signed int _t46;
				signed int _t48;
				signed int _t50;
				signed int _t53;
				intOrPtr _t60;
				signed int* _t66;
				signed int _t67;
				signed int* _t70;
				void* _t71;

				_t64 = __edx;
				_t61 = __ecx;
				_push(0x1c);
				_push(0x6e01feb8);
				E6DF9D08C(__ebx, __edi, __esi);
				_t60 = __edx;
				 *((intOrPtr*)(_t71 - 0x28)) = __edx;
				_t70 = __ecx;
				 *((intOrPtr*)(_t71 - 0x2c)) = __ecx;
				_t66 =  *(_t71 + 8);
				if(_t66 == 0 || __ecx == 0 || __edx == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E6E0188F5(_t60, _t61, _t64, _t66, _t70, __eflags);
					_t31 = 0xc000000d;
					goto L9;
				} else {
					if( *__ecx == 0) {
						L10:
						 *(_t71 - 0x20) =  *(_t71 - 0x20) & 0x00000000;
						_t67 = E6DF73E70(_t71 - 0x20, 0);
						 *(_t71 - 0x24) = _t67;
						__eflags = _t67;
						if(_t67 < 0) {
							L24:
							_t31 = _t67;
							L9:
							return E6DF9D0D1(_t31);
						}
						E6DF62280(_t36, _t60);
						 *(_t71 - 4) = 1;
						__eflags =  *_t70;
						if( *_t70 != 0) {
							asm("lock inc dword [eax]");
							L21:
							 *(_t71 - 4) = 0xfffffffe;
							E6DF6F9DD(_t60);
							_t40 =  *(_t71 - 0x20);
							__eflags = _t40;
							if(__eflags != 0) {
								_push(_t40);
								E6DF49100(_t60, _t61, _t67, _t70, __eflags);
							}
							__eflags = _t67;
							if(_t67 >= 0) {
								 *( *(_t71 + 8)) =  *_t70;
							}
							goto L24;
						}
						__eflags = _t70 - 0x6e0386c0;
						if(_t70 != 0x6e0386c0) {
							__eflags = _t70 - 0x6e0386b8;
							if(_t70 != 0x6e0386b8) {
								L20:
								 *_t70 =  *(_t71 - 0x20);
								_t20 = _t71 - 0x20;
								 *_t20 =  *(_t71 - 0x20) & 0x00000000;
								__eflags =  *_t20;
								goto L21;
							}
							E6DF75AA0(_t61,  *(_t71 - 0x20), 1);
							_t45 = E6DF495F0( *(_t71 - 0x20), 1);
							L27:
							_t67 = _t45;
							__eflags = _t67;
							 *(_t71 - 0x24) = _t67;
							if(_t67 >= 0) {
								goto L20;
							}
							goto L21;
						}
						_t46 =  *0x6e038754;
						__eflags = _t46;
						if(_t46 != 0) {
							E6DF75AA0(_t61,  *(_t71 - 0x20), _t46);
						} else {
							_t50 =  *0x7ffe03c0 << 3;
							__eflags = _t50 - 0x300;
							if(_t50 < 0x300) {
								_t50 = 0x300;
							}
							E6DF75AA0(0x300,  *(_t71 - 0x20), _t50);
							_t53 =  *0x7ffe03c0 << 2;
							_t61 = 0x180;
							__eflags = _t53 - 0x180;
							if(_t53 < 0x180) {
								_t53 = 0x180;
							}
							E6DF85C70( *(_t71 - 0x20), _t53);
						}
						_t48 =  *0x6e038750;
						__eflags = _t48;
						if(_t48 != 0) {
							_t45 = E6DF4B8F0( *(_t71 - 0x20), _t48);
							goto L27;
						} else {
							goto L20;
						}
					}
					 *((char*)(_t71 - 0x19)) = 0;
					E6DF6FAD0(__edx);
					 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
					if( *_t70 != 0) {
						asm("lock inc dword [eax]");
						 *_t66 =  *_t70;
						 *((char*)(_t71 - 0x19)) = 1;
					}
					 *(_t71 - 4) = 0xfffffffe;
					E6DF6F9D6(_t60);
					if( *((char*)(_t71 - 0x19)) == 0) {
						goto L10;
					} else {
						_t31 = 0;
						goto L9;
					}
				}
			}

0x6df6f86d
0x6df6f86d
0x6df6f86d
0x6df6f86f
0x6df6f874
0x6df6f879
0x6df6f87b
0x6df6f87e
0x6df6f880
0x6df6f883
0x6df6f888
0x6dfb47c9
0x6dfb47ce
0x00000000
0x6df6f8b1
0x6df6f8b4
0x6df6f8f1
0x6df6f8f1
0x6df6f900
0x6df6f902
0x6df6f905
0x6df6f907
0x6df6f9a9
0x6df6f9a9
0x6df6f8e9
0x6df6f8ee
0x6df6f8ee
0x6df6f90e
0x6df6f913
0x6df6f91c
0x6df6f91e
0x6df6f9e4
0x6df6f98b
0x6df6f98b
0x6df6f992
0x6df6f997
0x6df6f99a
0x6df6f99c
0x6df6f9e9
0x6df6f9ea
0x6df6f9ea
0x6df6f99e
0x6df6f9a0
0x6df6f9a7
0x6df6f9a7
0x00000000
0x6df6f9a0
0x6df6f924
0x6df6f92a
0x6df6f9b0
0x6df6f9b6
0x6df6f982
0x6df6f985
0x6df6f987
0x6df6f987
0x6df6f987
0x00000000
0x6df6f987
0x6df6f9be
0x6df6f9c6
0x6df6f9cb
0x6df6f9cb
0x6df6f9cd
0x6df6f9cf
0x6df6f9d2
0x00000000
0x00000000
0x00000000
0x6df6f9d4
0x6df6f930
0x6df6f935
0x6df6f937
0x6dfb47a3
0x6df6f93d
0x6df6f942
0x6df6f94a
0x6df6f94c
0x6df6f94e
0x6df6f94e
0x6df6f954
0x6df6f95e
0x6df6f961
0x6df6f966
0x6df6f968
0x6df6f96a
0x6df6f96a
0x6df6f970
0x6df6f970
0x6df6f975
0x6df6f97a
0x6df6f97c
0x6dfb47b1
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6f97c
0x6df6f8b6
0x6df6f8bb
0x6df6f8c0
0x6df6f8c8
0x6df6f8ca
0x6df6f8cf
0x6df6f8d1
0x6df6f8d1
0x6df6f8d5
0x6df6f8dc
0x6df6f8e5
0x00000000
0x6df6f8e7
0x6df6f8e7
0x00000000
0x6df6f8e7
0x6df6f8e5

APIs

RtlAcquireSRWLockShared.9419(?,?,?,?,6E01FEB8,0000001C,6DF42C4C,?), ref: 6DF6F8BB
TpAllocPool.9419(00000000,00000000,?,?,?,6E01FEB8,0000001C,6DF42C4C,?), ref: 6DF6F8FB
RtlAcquireSRWLockExclusive.9419(?,00000000,00000000,?,?,?,6E01FEB8,0000001C,6DF42C4C,?), ref: 6DF6F90E
TpSetPoolMaxThreads.9419(00000000,7FFE03C0,?,00000000,00000000,?,?,?,6E01FEB8,0000001C,6DF42C4C,?), ref: 6DF6F954
TpSetPoolMaxThreadsSoftLimit.9419(00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000,?,?,?,6E01FEB8,0000001C,6DF42C4C,?), ref: 6DF6F970
TpSetPoolMaxThreads.9419(00000000,00000001,?,00000000,00000000,?,?,?,6E01FEB8,0000001C,6DF42C4C,?), ref: 6DF6F9BE
TpSetPoolMinThreads.9419(00000000,00000001,00000000,00000001,?,00000000,00000000,?,?,?,6E01FEB8,0000001C,6DF42C4C,?), ref: 6DF6F9C6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Pool$Threads$AcquireLock$AllocExclusiveLimitSharedSoft
String ID:
API String ID: 4196657934-0
Opcode ID: 67c05e4e487f6b9bbbd1fe93d5aeb63deba1059a72aea8a2b987ac10cde57770
Instruction ID: 3ad1bc483acb5ac70fe79bdd0b74f5a3a53ce11e5772e05feec9b7751ce1673a
Opcode Fuzzy Hash: 67c05e4e487f6b9bbbd1fe93d5aeb63deba1059a72aea8a2b987ac10cde57770
Instruction Fuzzy Hash: 6741BB71A08246AFEB51CFACCC80BAEB7B5BF49318F214519E550EB695DB348C00CB71

Uniqueness

Uniqueness Score: -1.00%

Function 6DF45210, Relevance: 15.1, APIs: 10, Instructions: 107
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6DF45210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				void* _t35;
				int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = L6DF452A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *(_t31 + 0x28);
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *(_t61 + 0x10);
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6DF895D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					} else {
						E6DF5EB70(_t54, 0x6e0379a0);
					}
					return _t52 + 2;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E6DF895D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
							}
						} else {
							E6DF5EB70(_t54, 0x6e0379a0);
						}
						return _t52;
					}
					L5:
					_t33 = memcpy(_a8, _t54, _t52);
					if(_t61 == 0) {
						E6DF5EB70(_t54, 0x6e0379a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6DF895D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t35 + _t52)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x6df45220
0x6df45224
0x6dfa0d13
0x6dfa0d16
0x6dfa0d19
0x6df4522a
0x6df4522a
0x6df4522d
0x6df4522d
0x6df45231
0x6df45235
0x6df45239
0x6dfa0d5c
0x6dfa0d62
0x00000000
0x00000000
0x6dfa0d6a
0x6dfa0d7b
0x6dfa0d7f
0x6dfa0d81
0x6dfa0d84
0x6dfa0d95
0x6dfa0d95
0x6dfa0d6c
0x6dfa0d71
0x6dfa0d71
0x00000000
0x6df4524a
0x6df4524a
0x6df45250
0x6dfa0d24
0x6dfa0d35
0x6dfa0d39
0x6dfa0d3b
0x6dfa0d3e
0x6dfa0d50
0x6dfa0d50
0x6dfa0d26
0x6dfa0d2b
0x6dfa0d2b
0x00000000
0x6dfa0d55
0x6df45256
0x6df4525b
0x6df45265
0x6dfa0da7
0x6df4526b
0x6df4526e
0x6df45272
0x6dfa0db1
0x6dfa0db4
0x6dfa0dc5
0x6dfa0dc5
0x6df45272
0x6df45278
0x6df4527e
0x6df4528a
0x6df4528c
0x6df4528d
0x00000000
0x6df45280
0x6df45282
0x6df45288
0x6df4529f
0x6df45292
0x00000000
0x6df45292
0x00000000
0x6df45288
0x6df4527e

APIs

memcpy.9419(?,?), ref: 6DF4525B
RtlLeaveCriticalSection.9419(6E0379A0), ref: 6DFA0D2B
RtlLeaveCriticalSection.9419(6E0379A0), ref: 6DFA0D71
ZwClose.9419(?), ref: 6DFA0D84
RtlFreeHeap.9419(?,00000000,00000000,?), ref: 6DFA0D95
RtlLeaveCriticalSection.9419(6E0379A0), ref: 6DFA0DA7
ZwClose.9419(?), ref: 6DFA0DB4
RtlFreeHeap.9419(?,00000000,00000000,?), ref: 6DFA0DC5

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalLeaveSection$CloseFreeHeap$memcpy
String ID:
API String ID: 3958933951-0
Opcode ID: b8b245ac94508f1f67ef0fc3f50285d7ce2c9d835b7517face9092b8a9029468
Instruction ID: c65d7fd342eecc685107ef3fe95e2af28a7f7e6776c696aaef3134b6751ee5cf
Opcode Fuzzy Hash: b8b245ac94508f1f67ef0fc3f50285d7ce2c9d835b7517face9092b8a9029468
Instruction Fuzzy Hash: 14312632655602EBC7229F1DD840B3A7BB5FF00764F16862AF9194BAA5DBA0FD00C790

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7FF9C, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 100
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6DF7FF9C() {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _v28;
				void* _v36;
				void* _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				signed int _t35;
				signed int _t52;
				char _t57;
				void* _t68;

				_t35 =  *0x6e035c88; // 0x2
				_t68 = 2;
				if(_t35 == _t68) {
					_v12 = 0;
					RtlInitUnicodeString( &_v28, L"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\WindowsStore");
					_v12 = 0;
					_v60 =  &_v28;
					_push( &_v68);
					_push(0x20019);
					_v68 = 0x18;
					_push( &_v12);
					_v64 = 0;
					_v56 = 0x40;
					_v52 = 0;
					_v48 = 0;
					if( *0x6df26cd8() >= 0) {
						_v8 = 0;
						_v16 = 4;
						RtlInitUnicodeString( &_v36, L"AutoDownload");
						if(E6E01F1B5(_v12,  &_v36,  &_v20,  &_v8,  &_v16) < 0 || _v20 != 4 || _v8 != _t68) {
							_v8 = 0;
							_t57 = 4;
							_v16 = _t57;
							RtlInitUnicodeString( &_v44, L"DisableStoreApps");
							if(E6E01F1B5(_v12,  &_v44,  &_v20,  &_v8,  &_v16) < 0 || _v20 != _t57) {
								goto L3;
							} else {
								if(_v8 == 1) {
									goto L9;
								}
							}
						} else {
							L9:
							asm("lock cmpxchg [edx], ecx");
						}
					} else {
						L3:
					}
					asm("lock cmpxchg [edx], esi");
				}
				_t52 =  *0x6e035c88; // 0x2
				return _t52 & 0xffffff00 | _t52 == 0x00000000;
			}

0x6df7ffa1
0x6df7ffae
0x6df7ffb1
0x6df7ffcf
0x6df7ffd2
0x6df7ffdb
0x6df7ffde
0x6df7ffe4
0x6df7ffe5
0x6df7ffed
0x6df7fff4
0x6df7fff5
0x6df7fff8
0x6df7ffff
0x6df80002
0x6df80010
0x6dfbc15d
0x6dfbc161
0x6dfbc168
0x6dfbc187
0x6dfbc1a8
0x6dfbc1ae
0x6dfbc1b5
0x6dfbc1b8
0x6dfbc1d7
0x00000000
0x6dfbc1e6
0x6dfbc1ee
0x00000000
0x6dfbc1f4
0x6dfbc1ee
0x6dfbc194
0x6dfbc199
0x6dfbc19d
0x6dfbc19d
0x6df80016
0x6df80016
0x6df80016
0x6df8001d
0x6df8001d
0x6df7ffb3
0x6df7ffc3

APIs

RtlInitUnicodeString.9419(?,\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore,?,?,?), ref: 6DF7FFD2
ZwOpenKey.9419(?,00020019,?), ref: 6DF80005

Strings

@, xrefs: 6DF7FFF8
DisableStoreApps, xrefs: 6DFBC1AF
AutoDownload, xrefs: 6DFBC155
\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore, xrefs: 6DF7FFC4

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode
String ID: @$AutoDownload$DisableStoreApps$\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore
API String ID: 3946626324-1446860424
Opcode ID: 8ab1825a5dd4a5445067915fedbd1caabe93445557a5220c07207b2e4b8f412d
Instruction ID: 5728eaf762ac8a64681d3d326f34c4d14953847004af5badcab009e08efe3ca4
Opcode Fuzzy Hash: 8ab1825a5dd4a5445067915fedbd1caabe93445557a5220c07207b2e4b8f412d
Instruction Fuzzy Hash: 953119B2E1121EEFDB11DFD9C880AEEBBB8FB49315F10456AE505E6240DB709A458B90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF74D3B, Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6DF74D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				void _v176;
				char _v177;
				long _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t42;
				void* _t44;
				long _t46;
				intOrPtr _t50;
				long _t56;
				void* _t57;
				int _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x6e03d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				memset( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x6e037bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E6DF8B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
						}
						_v177 = 1;
						_t44 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = RtlNtStatusToDosError(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E6DF8B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E6DF8F380(_t67 + 0xc, 0x6df25138, 0x10) == 0) {
								 *0x6e0360d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E6DF74F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				_t56 = E6DF74E70(0x6e0386b0, 0x6df75690, 0, 0);
				if(_t56 != 0) {
					_t46 = RtlNtStatusToDosError(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x6df74d3b
0x6df74d4d
0x6df74d53
0x6df74d58
0x6df74d65
0x6df74d6c
0x6df74d71
0x6df74d77
0x6df74d7f
0x6df74d8c
0x6df74d8e
0x6df74dad
0x6df74db0
0x6df74db7
0x6df74db8
0x6df74db9
0x6df74dba
0x6df74dbb
0x6df74dc1
0x6df74dc8
0x6df74dcc
0x6df74dd5
0x6df74dde
0x6df74ddf
0x6df74de0
0x6df74de1
0x6df74de6
0x6df74de7
0x6df74de9
0x6df74df3
0x00000000
0x00000000
0x6dfb6c7c
0x6dfb6c8a
0x6dfb6c8a
0x6dfb6c9d
0x6dfb6ca7
0x6dfb6cac
0x6dfb6cb2
0x6dfb6cb9
0x00000000
0x6dfb6cbf
0x6dfb6cbf
0x00000000
0x6dfb6cbf
0x6dfb6cb9
0x6df74dfb
0x6dfb6ccf
0x6dfb6cd3
0x6df74e32
0x6df74e39
0x6dfb6ce0
0x6dfb6cf2
0x6dfb6cf2
0x6dfb6ce0
0x6df74e3f
0x6df74e41
0x6df74e51
0x6df74e51
0x6df74e03
0x6df74e03
0x6df74e09
0x6df74e0f
0x6df74e57
0x00000000
0x00000000
0x6df74e1b
0x6df74e30
0x6df74e5b
0x6df74e5b
0x00000000
0x6df74e30
0x6df74e11
0x6df74e11
0x6df74e16
0x00000000
0x6df74e16
0x6df74e01
0x00000000
0x6df74e01
0x6df74d9e
0x6df74da5
0x6dfb6c6b
0x00000000
0x6df74dab
0x6df74dab
0x00000000
0x6df74dab

APIs

memset.9419(?,00000000,000000A0,00000000,00000000,00000024), ref: 6DF74D77
RtlRunOnceExecuteOnce.9419(6E0386B0,6DF75690,00000000,00000000,00000000,00000000,00000024), ref: 6DF74D9E
ZwTraceControl.9419(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6DF74DE9
memcmp.9419(00000000,6DF25138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6DF74E26
RtlNtStatusToDosError.9419(00000000,6E0386B0,6DF75690,00000000,00000000,00000000,00000000,00000024), ref: 6DFB6C6B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ControlErrorExecuteStatusTracememcmpmemset
String ID:
API String ID: 1949686928-0
Opcode ID: 6f11e5bccc9ef61e2867aba21bfc1f0809d73213115b683a9010ee2263e9a668
Instruction ID: d6461f88b253b0e644d6d5ecb6c051d5cbd35f16f5173bbca1db4b8f2806df8b
Opcode Fuzzy Hash: 6f11e5bccc9ef61e2867aba21bfc1f0809d73213115b683a9010ee2263e9a668
Instruction Fuzzy Hash: EB41D171A44319AFEB32CF1CDC80FAAB7B9EB49724F01409AEA459B281D774DD44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF74BAD, Relevance: 13.6, APIs: 9, Instructions: 131
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6DF74BAD(long __ecx, void* __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				char _v36;
				void _v156;
				short _v158;
				intOrPtr _v160;
				long _v164;
				long _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				void* _t84;
				void* _t85;
				long _t86;
				int _t87;
				long _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x6e03d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E6DF4CC50(_t86);
					L11:
					return E6DF8B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0 || _t45 !=  *((intOrPtr*)(_t77 + 0x34))) {
					goto L22;
				} else {
					_t9 = _t77 + 0x24; // 0x6e038504
					E6DF62280(_t9, _t9);
					_t87 = 0x78;
					 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
					memset( &_v156, 0, _t87);
					_t85 =  &_v156;
					_v36 =  *((intOrPtr*)(_t77 + 0x30));
					_v28 = _v168;
					_v32 = 0;
					_v24 = 0;
					_v20 = _v158;
					_v160 = 0;
					while(1) {
						_push( &_v164);
						_push(_t87);
						_push(_t85);
						_push(0x18);
						_push( &_v36);
						_push(0x1e);
						_t88 = E6DF8B0B0();
						if(_t88 != 0xc0000023) {
							break;
						}
						if(_t85 !=  &_v156) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						}
						_t84 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v164);
						_v168 = _v164;
						if(_t84 == 0) {
							_t88 = 0xc0000017;
							goto L19;
						} else {
							_t74 = _v160 + 1;
							_v160 = _t74;
							if(_t74 >= 0x10) {
								L19:
								_t86 = RtlNtStatusToDosError(_t88);
								if(_t86 != 0) {
									L8:
									 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
									_t30 = _t77 + 0x24; // 0x6e038504
									E6DF5FFB0(_t77, _t84, _t30);
									if(_t84 != 0 && _t84 !=  &_v156) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t84);
									}
									if(_t86 != 0) {
										goto L12;
									} else {
										goto L11;
									}
								}
								L6:
								 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
								if(_v164 != 0) {
									_t83 = _t84;
									E6DF74F49(_t77, _t84);
								}
								goto L8;
							}
							_t87 = _v168;
							continue;
						}
					}
					if(_t88 != 0) {
						goto L19;
					}
					goto L6;
				}
			}

0x6df74bad
0x6df74bbf
0x6df74bc2
0x6df74bc6
0x6df74bcd
0x6df74bd9
0x6dfb67fe
0x6dfb6800
0x6df74ccc
0x6df74ccd
0x6df74cb7
0x6df74cc9
0x6df74cc9
0x6df74bdf
0x6df74be5
0x00000000
0x6df74bf5
0x6df74bf5
0x6df74bf9
0x6df74c06
0x6df74c0b
0x6df74c17
0x6df74c1f
0x6df74c25
0x6df74c33
0x6df74c3d
0x6df74c40
0x6df74c43
0x6df74c47
0x6df74c4d
0x6df74c53
0x6df74c54
0x6df74c55
0x6df74c56
0x6df74c5b
0x6df74c5c
0x6df74c63
0x6df74c6b
0x00000000
0x00000000
0x6dfb6776
0x6dfb6784
0x6dfb6784
0x6dfb679f
0x6dfb67a7
0x6dfb67af
0x6dfb67ce
0x00000000
0x6dfb67b1
0x6dfb67b7
0x6dfb67b8
0x6dfb67c1
0x6dfb67d3
0x6dfb67d9
0x6dfb67dd
0x6df74c94
0x6df74c94
0x6df74c98
0x6df74c9c
0x6df74ca3
0x6dfb67f4
0x6dfb67f4
0x6df74cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x6df74cb5
0x6df74c79
0x6df74c7e
0x6df74c89
0x6df74c8b
0x6df74c8f
0x6df74c8f
0x00000000
0x6df74c89
0x6dfb67c3
0x00000000
0x6dfb67c3
0x6dfb67af
0x6df74c73
0x00000000
0x00000000
0x00000000
0x6df74c73

APIs

RtlAcquireSRWLockExclusive.9419(6E038504,6E035338,00000000,6E035320), ref: 6DF74BF9
memset.9419(?,00000000,00000078,6E038504,6E035338,00000000,6E035320), ref: 6DF74C17
ZwTraceControl.9419(0000001E,00000000,00000018,?,00000078,?,6E035338,00000000,6E035320), ref: 6DF74C5E
RtlReleaseSRWLockExclusive.9419(6E038504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6E035338,00000000,6E035320), ref: 6DF74C9C
RtlSetLastWin32Error.9419(00000000,6E038504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6E035338,00000000,6E035320), ref: 6DF74CCD
RtlFreeHeap.9419(?,00000000,?,0000001E,00000000,00000018,?,00000078,?,6E035338,00000000,6E035320), ref: 6DFB6784
RtlAllocateHeap.9419(?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6E035338,00000000,6E035320), ref: 6DFB679A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateControlErrorFreeLastReleaseTraceWin32memset
String ID:
API String ID: 375855687-0
Opcode ID: dad18ed8113aa5c8ca2b00ab3c4407f2832f183dda0943348042e5f7b3438f75
Instruction ID: deabeb4b3e90b6aef076bf47af7205145df4dfa46baa1ca7d1a77dc86146fbab
Opcode Fuzzy Hash: dad18ed8113aa5c8ca2b00ab3c4407f2832f183dda0943348042e5f7b3438f75
Instruction Fuzzy Hash: 7341B336A442699BCB21DF6CD940FEA77B4FF49710F0140A6EA08AB641DB74DE84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6C182, Relevance: 13.6, APIs: 9, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6DF6C182(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				char* _t43;
				void* _t48;
				signed char _t62;
				void* _t63;
				void* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E6DF67D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E6E018D34(_v8, _t80);
					}
					E6DF62280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E6DF5FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t83 = _t80 + 0xd0;
						E6E018833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E6DF5FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E6DF8B180();
						if(_a4 != 0) {
							E6DF62280(_t48, _t81);
						}
					} else {
						E6DF6BB2D(_v8 + 0xc, _t80 + 0x98);
						E6DF6BB2D(_v8 + 8, _t80 + 0xb0);
						E6DF6B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E6DF5FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							E6DF5FFB0(0, _t80, _t80 + 0x90);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					E6DF5FFB0(0, __ecx, __ecx + 0x90);
				}
				return 0;
			}

0x6df6c18d
0x6df6c18f
0x6df6c191
0x6df6c19b
0x6df6c1a0
0x6df6c1d4
0x6df6c1de
0x6dfb2d6e
0x6df6c1e4
0x6df6c1e4
0x6df6c1e4
0x6df6c1ec
0x6dfb2d7d
0x6dfb2d7d
0x6df6c1f3
0x6df6c1ff
0x6dfb2d88
0x6dfb2d8d
0x6dfb2d94
0x6dfb2d9f
0x6dfb2da4
0x6dfb2dab
0x6dfb2db0
0x6dfb2db2
0x6dfb2db3
0x6dfb2db4
0x6dfb2dbc
0x6dfb2dc3
0x6dfb2dc3
0x6df6c205
0x6df6c211
0x6df6c222
0x6df6c22c
0x6df6c234
0x6df6c23a
0x6df6c23f
0x6df6c245
0x6df6c24b
0x6df6c251
0x6df6c25a
0x6df6c27d
0x6df6c27d
0x6df6c25c
0x6df6c25c
0x00000000
0x6df6c25e
0x6df6c1a4
0x6df6c1aa
0x6df6c1b3
0x6df6c26c
0x6df6c26c
0x00000000

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,00000000,?,00000000,?,?,?,?,?,6E00C9F8,000000FE), ref: 6DF6C1D7
RtlAcquireSRWLockExclusive.9419(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6E00C9F8,000000FE), ref: 6DF6C1F3
RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6E00C9F8,000000FE), ref: 6DF6C23A
RtlReleaseSRWLockExclusive.9419(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6E00C9F8,000000FE), ref: 6DF6C26C
RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6E00C9F8,000000FE), ref: 6DF6C27D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireCurrentServiceSession
String ID:
API String ID: 4254861812-0
Opcode ID: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction ID: 1d98dc7f746ac54daac3a24be1fb35a6bf1f60a5767a1d85892ea5b1d5feb255
Opcode Fuzzy Hash: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction Fuzzy Hash: EC315972A095C6BEDB05DFBCC880BE9FBA4BF46208F04815AD95C47601CB395E19C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7DE9E, Relevance: 13.6, APIs: 9, Instructions: 79
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6DF7DE9E(void* __ecx) {
				char _v0;
				char _v12;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v65;
				void* _v66;
				void* __ebx;
				void* __edi;
				void* _t81;
				signed int _t82;
				intOrPtr* _t92;
				signed int _t96;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				intOrPtr _t109;
				intOrPtr* _t110;
				signed int _t116;
				char _t121;
				void* _t128;
				signed int* _t130;
				signed int* _t135;
				signed int _t138;
				signed int _t140;
				void* _t145;
				unsigned int _t147;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				signed int _t156;
				intOrPtr* _t157;
				signed int _t161;
				signed int* _t162;
				char _t163;
				signed int _t164;
				signed int _t169;
				signed int _t171;
				intOrPtr* _t173;
				signed int _t176;
				signed int _t177;
				intOrPtr* _t178;
				void* _t181;
				void* _t183;
				signed int _t186;
				signed int _t188;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				void* _t196;

				_t194 = _t193 & 0xfffffff8;
				_push(__ecx);
				_push(_t173);
				_t181 = __ecx;
				_t81 = E6DF62280( *0x6e0384cc + 4,  *0x6e0384cc + 4);
				_t128 = _t181 + 0x28;
				_t82 = E6DF62280(_t81, _t128);
				asm("lock xadd [esi+0x50], eax");
				if((_t82 | 0xffffffff) != 1) {
					E6DF5FFB0(_t128, _t173, _t128);
					L8:
					return E6DF5FFB0(_t128, _t173,  *0x6e0384cc + 4);
				} else {
					if(E6DF67D50() != 0) {
						_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
					} else {
						_t92 = 0x7ffe038e;
					}
					_t173 = _t181 + 0x10;
					if( *_t92 != 0) {
						E6DFD2EA3(_t181,  *_t173,  *((intOrPtr*)(_t173 + 4)));
					}
					_push(_t173);
					E6DF8B150();
					_t96 = _t181 + 0x1c;
					_t162 =  *_t96;
					if(_t162[1] != _t96) {
						L10:
						_t145 = 3;
						asm("int 0x29");
						_t191 = _t194;
						_push(_t145);
						_push(_t145);
						_push(_t128);
						_push(_t181);
						_push(_t173);
						_t130 = _t162;
						_t183 = _t145;
						asm("lock xadd [esi+0x2c], eax");
						if((_t96 | 0xffffffff) == 1) {
							_t146 =  *((intOrPtr*)(_t183 + 0x28));
							if( *((intOrPtr*)(_t183 + 0x28)) != 0) {
								E6DF4A745(_t130, _t146, _t162, _t173);
							}
							_t100 = _t183 + 4;
							_t163 =  *_t100;
							if( *((intOrPtr*)(_t163 + 4)) != _t100) {
								L20:
								_t147 = 3;
								asm("int 0x29");
								_push(_t191);
								_t196 = (_t194 & 0xfffffff8) - 0x1c;
								_v56 = _v56 & 0x00000000;
								_push(_t130);
								 *((char*)(_t196 + 0xb)) = _t163;
								 *(_t196 + 0x18) = _t147;
								_push(_t183);
								_push(_t173);
								_t135 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + ((_t147 >> 0x00000005 & 0x0000007f) + 0x97) * 4;
								_t103 = 0;
								_t164 =  *_t135;
								_v48 = _t135;
								 *(_t196 + 0x12) = 0;
								if(_t164 != 0) {
									while((_t164 & 0x00000001) == 0) {
										_t103 = _t164;
										if((_t164 & 0x00000002) != 0) {
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												goto L54;
											}
										} else {
											_t186 = _t164 | 0x00000002;
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												L54:
												_t164 = _t103;
												if(_t103 != 0) {
													continue;
												} else {
												}
											} else {
												while(1) {
													L25:
													_t138 = _t186 & 0xfffffffc;
													 *(_t196 + 0x24) = _t138;
													_t176 = _t138;
													if( *((intOrPtr*)(_t138 + 0x10)) == 0) {
														goto L56;
													}
													L26:
													_t177 =  *((intOrPtr*)(_t176 + 0x10));
													 *((intOrPtr*)(_t138 + 0x10)) = _t177;
													while(_t177 != 0) {
														_t169 =  *((intOrPtr*)(_t177 + 0xc));
														_v52 = _t169;
														if( *_t177 !=  *((intOrPtr*)(_t196 + 0x20))) {
															L60:
															_t177 = _t169;
															continue;
														} else {
															_t152 =  *(_t177 + 8);
															if(_t177 != _t138) {
																 *(_t169 + 8) = _t152;
																_t153 =  *(_t177 + 8);
																_t109 =  *((intOrPtr*)(_t177 + 0xc));
																if(_t153 != 0) {
																	 *((intOrPtr*)(_t153 + 0xc)) = _t109;
																} else {
																	 *((intOrPtr*)(_t138 + 0x10)) = _t109;
																	 *((intOrPtr*)( *((intOrPtr*)(_t177 + 0xc)) + 0x10)) =  *((intOrPtr*)(_t177 + 0xc));
																}
																goto L34;
															} else {
																if(_t152 != 0) {
																	_t152 = _t152 ^ (_t152 ^ _t186) & 0x00000003;
																}
																_t116 = _t186;
																asm("lock cmpxchg [ebx], edx");
																_t138 =  *(_t196 + 0x24);
																if(_t116 != _t186) {
																	_t186 = _t116;
																	goto L25;
																} else {
																	_t171 =  *(_t177 + 8);
																	_t156 = _t152 & 0xffffff00 | _t152 == 0x00000000;
																	 *(_t196 + 0x12) = _t156;
																	if(_t171 != 0) {
																		 *(_t171 + 0xc) =  *(_t171 + 0xc) & 0x00000000;
																		 *((intOrPtr*)(_t171 + 0x10)) =  *((intOrPtr*)(_t177 + 0x10));
																		 *(_t196 + 0x12) = _t156;
																	}
																	_t169 = _v52;
																	L34:
																	_t154 = 2;
																	_t49 = _t177 + 0x14; // 0x14
																	_t110 = _t49;
																	_t155 =  *_t110;
																	 *_t110 = _t154;
																	if(_t155 == 2) {
																		goto L60;
																	} else {
																		if(_t155 == 0) {
																			 *(_t177 + 8) = _v56;
																			_v56 = _t177;
																		}
																		if( *((char*)(_t196 + 0x13)) != 0) {
																			goto L60;
																		}
																	}
																}
															}
														}
														break;
													}
													_t103 = _v56;
													if(_t103 != 0) {
														do {
															_push( *((intOrPtr*)(_t103 + 4)));
															_t188 =  *(_t103 + 8);
															E6DF89BF0();
															_t103 = _t188;
														} while (_t188 != 0);
													}
													if( *(_t196 + 0x12) == 0) {
														_t151 =  *_v48;
														while(1) {
															_t140 = _t151 & 0x00000001;
															asm("sbb edx, edx");
															_t103 = _t151;
															asm("lock cmpxchg [esi], edx");
															if(_t103 == _t151) {
																break;
															}
															_t151 = _t103;
														}
														if(_t140 != 0) {
															_t103 = E6DFFCF30(_t103);
														}
													}
													goto L41;
													do {
														L56:
														_t104 = _t176;
														_t176 =  *(_t176 + 8);
														 *(_t176 + 0xc) = _t104;
													} while ( *((intOrPtr*)(_t176 + 0x10)) == 0);
													goto L26;
												}
											}
										}
										goto L41;
									}
								}
								L41:
								return _t103;
							} else {
								_t157 =  *((intOrPtr*)(_t100 + 4));
								if( *_t157 != _t100) {
									goto L20;
								} else {
									 *_t157 = _t163;
									 *((intOrPtr*)(_t163 + 4)) = _t157;
									_t178 =  *((intOrPtr*)(_t183 + 0x30));
									 *_t130 =  *(_t183 + 0x38);
									 *_v0 =  *((intOrPtr*)(_t183 + 0x3c));
									_t121 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t183);
									if(_t178 != 0) {
										 *_t178 = 1;
										_t121 =  &_v12;
										asm("lock or [eax], ecx");
										_push(0);
										L21();
									}
									goto L13;
								}
							}
						} else {
							_t121 = _v0;
							 *_t130 =  *_t130 & 0x00000000;
							 *_t121 =  *_t121 & 0x00000000;
							L13:
							return _t121;
						}
					} else {
						_t161 =  *(_t96 + 4);
						if( *_t161 != _t96) {
							goto L10;
						} else {
							 *_t161 = _t162;
							_t162[1] = _t161;
							E6DF5FFB0(_t128, _t173, _t128);
							if( *(_t181 + 0x58) != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t181 + 0x58));
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t181);
							goto L8;
						}
					}
				}
			}

0x6df7dea3
0x6df7dea6
0x6df7deae
0x6df7deb2
0x6df7deb5
0x6df7deba
0x6df7debe
0x6df7dec6
0x6df7decc
0x6df7df40
0x6df7df2a
0x6df7df3e
0x6df7dece
0x6df7ded5
0x6dfbb445
0x6df7dedb
0x6df7dedb
0x6df7dedb
0x6df7dee2
0x6df7dee7
0x6dfbb456
0x6dfbb456
0x6df7deed
0x6df7deee
0x6df7def3
0x6df7def6
0x6df7defb
0x6df7df47
0x6df7df49
0x6df7df4a
0x6df7df4f
0x6df7df51
0x6df7df52
0x6df7df53
0x6df7df54
0x6df7df55
0x6df7df56
0x6df7df58
0x6df7df5d
0x6df7df63
0x6df7df77
0x6df7df7c
0x6df7dfd3
0x6df7dfd3
0x6df7df7e
0x6df7df81
0x6df7df86
0x6df7dfda
0x6df7dfdc
0x6df7dfdd
0x6df7dfe1
0x6df7dfe7
0x6df7dff0
0x6df7dff5
0x6df7dff8
0x6df7e005
0x6df7e00f
0x6df7e010
0x6df7e011
0x6df7e014
0x6df7e016
0x6df7e018
0x6df7e01c
0x6df7e022
0x6df7e028
0x6df7e031
0x6df7e036
0x6dfbb47d
0x6dfbb483
0x00000000
0x00000000
0x6df7e03c
0x6df7e03e
0x6df7e043
0x6df7e049
0x6dfbb489
0x6dfbb489
0x6dfbb48d
0x00000000
0x00000000
0x6dfbb493
0x00000000
0x6df7e04f
0x6df7e04f
0x6df7e051
0x6df7e054
0x6df7e058
0x6df7e05e
0x00000000
0x00000000
0x6df7e064
0x6df7e064
0x6df7e067
0x6df7e06a
0x6df7e076
0x6df7e079
0x6df7e07f
0x6dfbb4cc
0x6dfbb4cc
0x00000000
0x6df7e085
0x6df7e085
0x6df7e08a
0x6df7e11c
0x6df7e11f
0x6df7e122
0x6df7e127
0x6df7e164
0x6df7e129
0x6df7e129
0x6df7e12f
0x6df7e12f
0x00000000
0x6df7e090
0x6df7e092
0x6dfbb4b2
0x6dfbb4b2
0x6df7e09e
0x6df7e0a0
0x6df7e0a4
0x6df7e0aa
0x6dfbb4d3
0x00000000
0x6df7e0b0
0x6df7e0b0
0x6df7e0b5
0x6df7e0b8
0x6df7e0be
0x6dfbb4b9
0x6dfbb4c0
0x6dfbb4c3
0x6dfbb4c3
0x6df7e0c4
0x6df7e0c8
0x6df7e0ca
0x6df7e0cb
0x6df7e0cb
0x6df7e0ce
0x6df7e0ce
0x6df7e0d3
0x00000000
0x6df7e0d9
0x6df7e0db
0x6df7e0e1
0x6df7e0e4
0x6df7e0e4
0x6df7e0ed
0x00000000
0x00000000
0x6df7e0ed
0x6df7e0d3
0x6df7e0aa
0x6df7e08a
0x00000000
0x6df7e07f
0x6df7e0f3
0x6df7e0f9
0x6df7e0fb
0x6df7e0fb
0x6df7e0fe
0x6df7e101
0x6df7e106
0x6df7e108
0x6df7e0fb
0x6df7e111
0x6df7e138
0x6df7e13a
0x6df7e13e
0x6df7e148
0x6df7e14e
0x6df7e150
0x6df7e156
0x00000000
0x00000000
0x6df7e16c
0x6df7e16c
0x6df7e15a
0x6df7e15d
0x6df7e15d
0x6df7e15a
0x00000000
0x6dfbb498
0x6dfbb498
0x6dfbb498
0x6dfbb49a
0x6dfbb49d
0x6dfbb4a0
0x00000000
0x6dfbb4a6
0x6df7e04f
0x6df7e049
0x00000000
0x6df7e036
0x6df7e028
0x6df7e113
0x6df7e119
0x6df7df88
0x6df7df88
0x6df7df8d
0x00000000
0x6df7df8f
0x6df7df8f
0x6df7df91
0x6df7df97
0x6df7df9a
0x6df7dfa5
0x6df7dfb0
0x6df7dfb7
0x6df7dfb9
0x6df7dfbf
0x6df7dfc4
0x6df7dfc7
0x6df7dfcc
0x6df7dfcc
0x00000000
0x6df7dfb7
0x6df7df8d
0x6df7df65
0x6df7df65
0x6df7df68
0x6df7df6b
0x6df7df6e
0x6df7df74
0x6df7df74
0x6df7defd
0x6df7defd
0x6df7df02
0x00000000
0x6df7df04
0x6df7df04
0x6df7df07
0x6df7df0a
0x6df7df13
0x6dfbb46e
0x6dfbb46e
0x6df7df25
0x00000000
0x6df7df25
0x6df7df02
0x6df7defb

APIs

RtlAcquireSRWLockExclusive.9419(?,00000000,?,00000000,?,?,6DF43A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6DF7DEB5
RtlAcquireSRWLockExclusive.9419(?,?,00000000,?,00000000,?,?,6DF43A82,?,?,?,?,?,00000001,00000000,?), ref: 6DF7DEBE

Part of subcall function 6DF62280: RtlDllShutdownInProgress.9419(00000000), ref: 6DF622BA
Part of subcall function 6DF62280: ZwWaitForAlertByThreadId.9419(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6DF623A3

RtlGetCurrentServiceSessionId.9419(?,?,00000000,?,00000000,?,?,6DF43A82,?,?,?,?,?,00000001,00000000,?), ref: 6DF7DECE
ZwUnsubscribeWnfStateChange.9419(?,?,?,00000000,?,00000000,?,?,6DF43A82,?,?,?,?,?,00000001,00000000), ref: 6DF7DEEE
RtlReleaseSRWLockExclusive.9419(?,?,?,?,00000000,?,00000000,?,?,6DF43A82,?,?,?,?,?,00000001), ref: 6DF7DF0A
RtlFreeHeap.9419(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6DF43A82,?), ref: 6DF7DF25
RtlReleaseSRWLockExclusive.9419(?,?,?,?,00000000,?,00000000,?,?,6DF43A82,?,?,?,?,?,00000001), ref: 6DF7DF33
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,00000000,?,?,6DF43A82,?,?,?,?,?,00000001,00000000), ref: 6DF7DF40
RtlFreeHeap.9419(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6DF43A82,?), ref: 6DFBB46E

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: 9befabe6c57f15791e957f69762ded3d8aba4e0d23fab65c9ac18de328705895
Instruction ID: 332d24c6ad8a24a919534feff7a1c6b902db8f0ba73f7f882c27852e673c2e31
Opcode Fuzzy Hash: 9befabe6c57f15791e957f69762ded3d8aba4e0d23fab65c9ac18de328705895
Instruction Fuzzy Hash: E321FF32109681DBD3218F2CDC40F92B7B8FF41718F4546AAE5048BAA1D735E800CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF23E3, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E6DFF23E3(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed short _t52;
				intOrPtr _t54;
				signed short _t64;
				signed short _t66;
				intOrPtr _t69;
				signed short _t73;
				signed short _t76;
				signed short _t77;
				signed short _t79;
				void* _t83;
				signed int _t84;
				signed int _t85;
				signed char _t94;
				unsigned int _t99;
				unsigned int _t104;
				signed int _t108;
				void* _t110;
				void* _t111;
				unsigned int _t114;

				_t84 = __ecx;
				_push(__ecx);
				_t114 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t73 =  *__edx;
							if(( *(__ecx + 0x4c) & _t73) != 0) {
								_t73 = _t73 ^  *(__ecx + 0x50);
							}
							_t44 = _t73 & 0x0000ffff;
						}
					} else {
						_t104 = __edx >> 0x00000003 ^  *__edx ^  *0x6e03874c ^ __ecx;
						if(_t104 == 0) {
							_t76 =  *((intOrPtr*)(__edx - (_t104 >> 0xd)));
						} else {
							_t76 = 0;
						}
						_t44 =  *((intOrPtr*)(_t76 + 0x14));
					}
					_t94 =  *((intOrPtr*)(_t114 + 7));
					_t108 = _t44 & 0xffff;
					if(_t94 != 5) {
						if((_t94 & 0x00000040) == 0) {
							if((_t94 & 0x0000003f) == 0x3f) {
								if(_t94 >= 0) {
									if( *(_t84 + 0x4c) == 0) {
										_t48 =  *_t114 & 0x0000ffff;
									} else {
										_t66 =  *_t114;
										if(( *(_t84 + 0x4c) & _t66) != 0) {
											_t66 = _t66 ^  *(_t84 + 0x50);
										}
										_t48 = _t66 & 0x0000ffff;
									}
								} else {
									_t99 = _t114 >> 0x00000003 ^  *_t114 ^  *0x6e03874c ^ _t84;
									if(_t99 == 0) {
										_t69 =  *((intOrPtr*)(_t114 - (_t99 >> 0xd)));
									} else {
										_t69 = 0;
									}
									_t48 =  *((intOrPtr*)(_t69 + 0x14));
								}
								_t85 =  *(_t114 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t85 = _t94 & 0x3f;
							}
						} else {
							_t85 =  *(_t114 + 4 + (_t94 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t85 =  *(_t84 + 0x54) & 0x0000ffff ^  *(_t114 + 4) & 0x0000ffff;
					}
					_t110 = (_t108 << 3) - _t85;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t77 =  *__edx & 0x0000ffff;
					} else {
						_t79 =  *__edx;
						if(( *(__ecx + 0x4c) & _t79) != 0) {
							_t79 = _t79 ^  *(__ecx + 0x50);
						}
						_t77 = _t79 & 0x0000ffff;
					}
					_t110 =  *((intOrPtr*)(_t114 - 8)) - (_t77 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t114 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t64 = _t51 & 0x3f;
					goto L38;
				} else {
					_t64 =  *(_t114 + 6) & 0x000000ff;
					L38:
					_t52 = _t64 << 0x00000003 & 0x0000ffff;
					L42:
					_t35 = _t114 + 8; // -16
					_t111 = _t110 + (_t52 & 0x0000ffff);
					_t83 = _t35 + _t111;
					_t54 = E6DF9D4F0(_t83, 0x6df26c58, 8);
					_v8 = _t54;
					if(_t54 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t111);
					_push(_v8 + _t83);
					E6DF4B150("Heap block at %p modified at %p past requested size of %Ix\n", _t114);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6e036378 = 1;
						asm("int3");
						 *0x6e036378 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x6dff23e3
0x6dff23e8
0x6dff23eb
0x6dff23ee
0x6dff23f3
0x6dff259b
0x6dff259b
0x6dff259d
0x6dff25a3
0x6dff25a3
0x6dff23fb
0x6dff2424
0x6dff244f
0x6dff2460
0x6dff2451
0x6dff2451
0x6dff2456
0x6dff2458
0x6dff2458
0x6dff245b
0x6dff245b
0x6dff2426
0x6dff2431
0x6dff2436
0x6dff2443
0x6dff2438
0x6dff2438
0x6dff2438
0x6dff2445
0x6dff2445
0x6dff2463
0x6dff2469
0x6dff246f
0x6dff2480
0x6dff2495
0x6dff24a1
0x6dff24ce
0x6dff24df
0x6dff24d0
0x6dff24d0
0x6dff24d5
0x6dff24d7
0x6dff24d7
0x6dff24da
0x6dff24da
0x6dff24a3
0x6dff24b0
0x6dff24b5
0x6dff24c2
0x6dff24b7
0x6dff24b7
0x6dff24b7
0x6dff24c4
0x6dff24c4
0x6dff24e8
0x6dff2497
0x6dff249a
0x6dff249a
0x6dff2482
0x6dff2488
0x6dff2488
0x6dff2471
0x6dff2479
0x6dff2479
0x6dff24ef
0x6dff23fd
0x6dff2401
0x6dff2412
0x6dff2403
0x6dff2403
0x6dff2408
0x6dff240a
0x6dff240a
0x6dff240d
0x6dff240d
0x6dff241b
0x6dff241b
0x6dff24f1
0x6dff24f6
0x6dff2507
0x6dff2510
0x00000000
0x6dff2510
0x6dff250b
0x00000000
0x6dff24f8
0x6dff24f8
0x6dff24fc
0x6dff2500
0x6dff2512
0x6dff2515
0x6dff251a
0x6dff2521
0x6dff2524
0x6dff2529
0x6dff252f
0x00000000
0x00000000
0x6dff253c
0x6dff255c
0x6dff2561
0x6dff253e
0x6dff2554
0x6dff2559
0x6dff256a
0x6dff256d
0x6dff2574
0x6dff2586
0x6dff2588
0x6dff258f
0x6dff2590
0x6dff2590
0x6dff2597
0x00000000
0x6dff2597

APIs

RtlCompareMemory.9419(-00000010,6DF26C58,00000008,?,-00000018,?,?,?,6E004BD7), ref: 6DFF2524
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,-00000010,6DF26C58,00000008,?,-00000018,?,?,?,6E004BD7), ref: 6DFF2554
DbgPrint.9419(HEAP: ,-00000010,6DF26C58,00000008,?,-00000018,?,?,?,6E004BD7), ref: 6DFF2561
DbgPrint.9419(Heap block at %p modified at %p past requested size of %Ix,-00000018,?,?,-00000010,6DF26C58,00000008,?,-00000018,?,?,?,6E004BD7), ref: 6DFF2574

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 6DFF256F
HEAP: , xrefs: 6DFF255C
HEAP[%wZ]: , xrefs: 6DFF254F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemory
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 216965414-3815128232
Opcode ID: 8dd8e223b7a87e735cfd8d82a3e6828bfaabc2e287d7e75b972a337e9d341f15
Instruction ID: 53a8c046a395d2e63c1934c944938a3adcdce10b871501a312981a047596d90a
Opcode Fuzzy Hash: 8dd8e223b7a87e735cfd8d82a3e6828bfaabc2e287d7e75b972a337e9d341f15
Instruction Fuzzy Hash: 025103351141918AE371CF2EC850772B7E1EB4A348F518899E8D1CB2A7D3B7DA47DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1570, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DFD1570(intOrPtr __ecx, signed int __edx, void* __edi, void* __eflags) {
				signed int _v8;
				char _v36;
				void _v52;
				char _v56;
				char _v60;
				short _v64;
				char _v68;
				char _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				char _v100;
				int _v104;
				int _v108;
				int _v112;
				int _v116;
				int _v120;
				char _v124;
				void* _v132;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t48;
				intOrPtr _t53;
				intOrPtr _t59;
				signed int _t61;
				signed int _t62;
				signed int* _t63;
				signed int* _t70;
				int _t73;
				signed int _t84;

				_t82 = __edi;
				_t81 = __edx;
				_v8 =  *0x6e03d360 ^ _t84;
				_t73 = 0;
				_v76 = __edx;
				_v80 = __ecx;
				_v60 = 0;
				_v56 = 0;
				_v68 = 0;
				_v64 = 0x500;
				_t48 = E6DFD16FA();
				_t83 = _t48;
				if(_t48 < 0) {
					L19:
					if(_v60 != 0) {
						_push(_v60);
						E6DF895D0();
					}
					return E6DF8B640(_t83, _t73, _v8 ^ _t84, _t81, _t82, _t83);
				}
				_push(0);
				_push(8);
				_push( &_v100);
				_push(0x73);
				_t53 = E6DF89860();
				_t83 = _t53;
				if(_t53 < 0) {
					goto L19;
				}
				_t83 = E6DFD176C(_v100);
				if(_t83 < 0) {
					goto L19;
				}
				_t92 = _t83 - 0x102;
				if(_t83 == 0x102) {
					goto L19;
				}
				RtlInitUnicodeString( &_v132, L"\\WindowsErrorReportingServicePort");
				memset( &_v52, 0, 0x2c);
				_v36 = 0x568;
				_push( &_v56);
				_t59 = E6DFD1879(0,  &_v68, __edi, _t83, _t92);
				_t83 = _t59;
				if(_t59 >= 0) {
					_t61 = _v96;
					_v124 = 0x18;
					_v120 = 0;
					_v112 = 0;
					_v116 = 0;
					_v108 = 0;
					_v104 = 0;
					if(_t61 != 0xffffffff) {
						_t81 = _t61 * 0xffffd8f0 >> 0x20;
						_t62 = _t61 * 0xffffd8f0;
						__eflags = _t62;
						_v92 = _t62;
						_t63 =  &_v92;
						_v88 = _t61 * 0xffffd8f0 >> 0x20;
					} else {
						_t73 = 1;
						_t63 = 0;
					}
					_push(_t63);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(_v56);
					_push(0x20000);
					_push( &_v52);
					_push( &_v124);
					_push( &_v132);
					_push( &_v60);
					_t83 = E6DF89C70();
					if(_t83 >= 0 && _t83 != 0x102) {
						_v72 = 0x568;
						if(_t73 == 0) {
							_t70 =  &_v92;
						} else {
							_t70 = 0;
						}
						_t73 = _v76;
						_push(_t70);
						_push(0);
						_push( &_v72);
						_push(_t73);
						_push(0);
						_push(_v80);
						_push(0x20000);
						_push(_v60);
						_t83 = E6DF89DA0();
						if(_t83 >= 0 && _t83 != 0x102) {
							_t83 =  *((intOrPtr*)(_t73 + 0x1c));
							if( *((intOrPtr*)(_t73 + 0x1c)) >= 0) {
								_t83 = 0;
							}
						}
					}
				}
				if(_v56 != 0) {
					E6DFD1AD6(_v56);
				}
				goto L19;
			}

0x6dfd1570
0x6dfd1570
0x6dfd1582
0x6dfd1586
0x6dfd1588
0x6dfd158c
0x6dfd158f
0x6dfd1592
0x6dfd1595
0x6dfd1598
0x6dfd159e
0x6dfd15a3
0x6dfd15a7
0x6dfd16da
0x6dfd16de
0x6dfd16e0
0x6dfd16e3
0x6dfd16e3
0x6dfd16f9
0x6dfd16f9
0x6dfd15ad
0x6dfd15ae
0x6dfd15b3
0x6dfd15b4
0x6dfd15b6
0x6dfd15bb
0x6dfd15bf
0x00000000
0x00000000
0x6dfd15cd
0x6dfd15d1
0x00000000
0x00000000
0x6dfd15d7
0x6dfd15dd
0x00000000
0x00000000
0x6dfd15ec
0x6dfd15f8
0x6dfd1600
0x6dfd160d
0x6dfd1611
0x6dfd1616
0x6dfd161a
0x6dfd1620
0x6dfd1623
0x6dfd162a
0x6dfd162d
0x6dfd1630
0x6dfd1633
0x6dfd1636
0x6dfd163c
0x6dfd1649
0x6dfd1649
0x6dfd1649
0x6dfd164b
0x6dfd164e
0x6dfd1651
0x6dfd163e
0x6dfd163e
0x6dfd1640
0x6dfd1640
0x6dfd1654
0x6dfd1657
0x6dfd1658
0x6dfd1659
0x6dfd165a
0x6dfd165b
0x6dfd1661
0x6dfd1666
0x6dfd166a
0x6dfd166e
0x6dfd1672
0x6dfd1678
0x6dfd167c
0x6dfd1686
0x6dfd168f
0x6dfd1695
0x6dfd1691
0x6dfd1691
0x6dfd1691
0x6dfd1698
0x6dfd169b
0x6dfd169c
0x6dfd16a1
0x6dfd16a2
0x6dfd16a3
0x6dfd16a5
0x6dfd16a8
0x6dfd16ad
0x6dfd16b5
0x6dfd16b9
0x6dfd16c3
0x6dfd16c8
0x6dfd16ca
0x6dfd16ca
0x6dfd16c8
0x6dfd16b9
0x6dfd167c
0x6dfd16d0
0x6dfd16d5
0x6dfd16d5
0x00000000

APIs

Part of subcall function 6DFD16FA: ZwQueryWnfStateNameInformation.9419(6DF2FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6DFD15A3,?,00000568), ref: 6DFD1718
Part of subcall function 6DFD16FA: ZwUpdateWnfStateData.9419(6DF2FB74,00000000,00000000,00000000,00000000,00000000,00000000,6DF2FB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6DFD172D
Part of subcall function 6DFD16FA: EtwEventWriteNoRegistration.9419(6DF2FB7C,?,00000000,00000000,6DF2FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6DFD174B

ZwQuerySystemInformation.9419(00000073,?,00000008,00000000,?,00000568), ref: 6DFD15B6

Part of subcall function 6DF89860: LdrInitializeThunk.NTDLL(6DFD15BB,00000073,?,00000008,00000000,?,00000568), ref: 6DF8986A

Part of subcall function 6DFD176C: ZwOpenEvent.9419(00000568,00100001,?,?,00000000), ref: 6DFD17B5
Part of subcall function 6DFD176C: ZwWaitForSingleObject.9419(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6DFD17E1
Part of subcall function 6DFD176C: ZwClose.9419(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6DFD17EB

RtlInitUnicodeString.9419(?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6DFD15EC
memset.9419(?,00000000,0000002C,?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6DFD15F8
ZwAlpcConnectPort.9419(?,?,00000018,?,00020000,?,00000000,00000000,00000000,00000000,?), ref: 6DFD1673
ZwAlpcSendWaitReceivePort.9419(?,00020000,?,00000000,?,00000568,00000000,?,?,?,00000018,?,00020000,?,00000000,00000000), ref: 6DFD16B0
ZwClose.9419(00000000,?,00000568), ref: 6DFD16E3

Strings

\WindowsErrorReportingServicePort, xrefs: 6DFD15E3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcCloseEventInformationPortQueryStateWait$ConnectDataInitInitializeNameObjectOpenReceiveRegistrationSendSingleStringSystemThunkUnicodeUpdateWritememset
String ID: \WindowsErrorReportingServicePort
API String ID: 360723211-589754893
Opcode ID: 9e8022975f358c9eb9daa5ae5d07ed6db71138df6d5bd3b8aa1a13955e397050
Instruction ID: be3d09824cbe967ad378041de7a6b299a1d087848752f86bb1252847ab7f8eb9
Opcode Fuzzy Hash: 9e8022975f358c9eb9daa5ae5d07ed6db71138df6d5bd3b8aa1a13955e397050
Instruction Fuzzy Hash: DD4160B2D0561DABDB51CFE9D880AEEBBB9FF04714F190129E915AB290DB309D44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5DD80, Relevance: 12.3, APIs: 8, Instructions: 337
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6DF5DD80(void* __ecx, signed int __edx) {
				intOrPtr _v8;
				signed char _v13;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				long _v40;
				signed char _v44;
				signed int _v48;
				signed int _v52;
				void* __ebp;
				signed int _t111;
				signed char _t117;
				void* _t119;
				void* _t121;
				signed int _t123;
				signed int _t132;
				intOrPtr _t141;
				signed char _t142;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed char _t151;
				signed int* _t157;
				signed int _t162;
				signed int _t165;
				signed char _t168;
				signed int _t169;
				void* _t172;
				signed char _t176;
				char _t178;
				signed int _t186;
				signed int _t187;
				signed int _t188;
				signed int _t195;
				signed int _t199;
				void* _t201;
				signed int* _t203;
				signed int _t207;
				signed int* _t208;
				void* _t213;

				_t186 = __edx;
				_v8 =  *((intOrPtr*)(_t213 + 4));
				_t203 = __edx;
				_v24 = 0;
				_t195 = __ecx;
				_v32 = __edx;
				_v20 = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((intOrPtr*)(__edx + 8)) = 0;
				if( *0x6e038474 != 3) {
					L16:
					_push(0);
					_push(0xc);
					_push( &_v52);
					_push(6);
					_push(_t195);
					_push(0xffffffff);
					if(E6DF89730() < 0) {
						L66:
						_t165 = 0;
						_v20 = 0;
						L21:
						_t203[1] = _t165;
						if(_t165 == 0) {
							_t187 = _v24;
							L43:
							_t111 = _t187;
							L15:
							return _t111;
						}
						_v28 = 0;
						E6DF5E9C0(1, _t165, 0, 0,  &_v28);
						if(( *(_v28 + 0x5e) & 0x00000400) != 0) {
							L56:
							_t188 = _t186 | 0xffffffff;
							_t111 = _t188;
							_t203[3] = _t195 | _t188;
							 *_t203 = _t188;
							goto L15;
						}
						E6DF5E9C0(1, _v20, 0, 0,  &_v40);
						_t117 = _v20;
						_t195 = 0;
						_v13 = 1;
						_t168 = _t117;
						_v24 = _t168;
						_v32 = 0;
						_v36 = 0;
						if((_t117 & 0x00000003) != 0) {
							_v24 = _t168;
							_v13 =  !_t117 & 0x00000001;
						}
						_t119 = E6DF5E9C0(1, _t168, 0, 0,  &_v32);
						_t169 = _v32;
						if(_t169 == 0) {
							L72:
							if(_t119 < 0) {
								goto L74;
							}
							_t186 = _v32;
						} else {
							_t132 =  *(_t169 + 0x18) & 0x0000ffff;
							_t186 = 0x10b;
							if(_t132 != 0x10b) {
								_t186 = 0x20b;
								if(_t132 != 0x20b) {
									L74:
									_t121 = RtlImageDirectoryEntryToData(_v20, 1, 0xe,  &_v40);
									if(_t121 == 0 || ( *(_t121 + 0x10) & 0x00000001) == 0) {
										_t187 = 0;
										L42:
										_t203[3] = 0;
										 *_t203 = _t187;
										goto L43;
									} else {
										goto L56;
									}
								}
								_t186 = _v13;
								_t119 = E6DF42F47(_v24, _t186, 0xa,  &_v32, _t169,  &_v36);
								_t195 = _v36;
								goto L72;
							}
							if( *((intOrPtr*)(_t169 + 0x74)) <= 0xa) {
								goto L74;
							}
							_t195 =  *(_t169 + 0xc8);
							if(_t195 == 0) {
								goto L74;
							}
							_t186 =  *(_t169 + 0xcc);
							_v36 = _t186;
							if(_v13 == 0) {
								if(_t195 <  *((intOrPtr*)(_t169 + 0x54))) {
									goto L30;
								}
								_t195 = E6DF83C00(_t169, _v24, _t195);
								if(_t195 == 0) {
									goto L74;
								}
								_t186 = _v36;
								L31:
								if(_t195 == 0 || _t186 == 0 || _t186 != 0x40 && _t186 !=  *_t195) {
									goto L74;
								} else {
									_t123 =  *(_v40 + 4) & 0x0000ffff;
									if(_t123 == 0x3a64 || _t123 == 0x14c) {
										if( *_t195 < 0x48) {
											goto L74;
										}
										_t186 =  *(_t195 + 0x40);
										if(_t186 == 0) {
											goto L74;
										}
										_t195 =  *(_t195 + 0x44);
										if(_t195 == 0) {
											goto L74;
										}
										_t172 = _v20;
										if(_t186 <  *((intOrPtr*)(_v28 + 0x54)) + _t172 || _t195 >  *((intOrPtr*)(_v28 + 0x50)) - _t186 + _t172 >> 2) {
											goto L56;
										} else {
											goto L42;
										}
									} else {
										goto L74;
									}
								}
							}
							L30:
							_t195 = _t195 + _v24;
						}
						goto L31;
					}
					_t165 = _v52;
					_v20 = _t165;
					if(_t165 == 0 || (_v44 & 0x00000003) != 0 || _t195 < _t165) {
						goto L66;
					} else {
						_t203[2] = _v48;
						goto L21;
					}
				}
				E6DF6FAD0(0x6e038654);
				_t141 =  *0x6e03b350; // 0x1
				if(_t141 == 1) {
					L13:
					_t142 = 0x11;
					asm("lock cmpxchg [esi], ecx");
					_t176 = 0x11;
					if(0x11 != 0x11) {
						if(1 == 0) {
							L6DF9DF30(0x11, _t186, 0xc0000264);
							L62:
							_t145 = _t176 & 0xfffffff0;
							_t186 =  *(_t145 + 4);
							if(_t186 != 0) {
								L64:
								asm("lock xadd [edx+0x10], eax");
								if((_t145 | 0xffffffff) - 1 > 0) {
									goto L14;
								}
								_v28 = 0xfffffff7;
								L50:
								_t199 = _v28;
								while(1) {
									_t149 = _t176 & 0x00000006;
									_v36 = _t149;
									if(_t149 != 2) {
										_t150 = _t199;
									} else {
										_t150 = _t199 + 4;
									}
									_t186 = _t176 + _t150;
									_t151 = _t176;
									asm("lock cmpxchg [edi], esi");
									_t199 = _v28;
									if(_t151 == _t176) {
										break;
									}
									_t176 = _t151;
								}
								_t195 = _v20;
								if(_v36 == 2) {
									_t186 = 0;
									E6DF800C2(0x6e038654, 0, 0);
								}
								goto L14;
							} else {
								goto L63;
							}
							do {
								L63:
								_t145 =  *_t145;
								_t186 =  *(_t145 + 4);
							} while (_t186 == 0);
							goto L64;
						}
						if(0 != 0) {
							L48:
							if((_t176 & 0x00000008) != 0) {
								goto L62;
							}
							_v28 = _t142 | 0xffffffff;
							goto L50;
						} else {
							goto L46;
						}
						while(1) {
							L46:
							_t75 = _t176 - 0x10; // 0x1
							asm("sbb edx, edx");
							_t186 =  ~((_t176 & 0xfffffff0) - 0x10) & _t75;
							_t142 = _t176;
							asm("lock cmpxchg [esi], edx");
							if(_t142 == _t176) {
								goto L14;
							}
							_t176 = _t142;
							if((_t142 & 0x00000002) == 0) {
								continue;
							}
							goto L48;
						}
					}
					L14:
					_t111 = _v24;
					if(_t111 == 0) {
						if( *0x6e03b35c == 0) {
							goto L15;
						}
						_t203 = _v32;
						goto L16;
					}
					goto L15;
				}
				_t178 = 1;
				_t8 = _t141 - 1; // 0x0
				_t201 = _t8;
				if(_t201 < 1) {
					L12:
					_t195 = _v20;
					goto L13;
				}
				do {
					_t186 = _t178 + _t201 >> 1;
					_t157 = (_t186 << 4) + 0x6e03b360;
					_t207 = _t157[1];
					if(_v20 < _t207) {
						if(_t186 == 0) {
							goto L12;
						}
						_t201 = _t186 - 1;
						goto L7;
					}
					if(_v20 < _t157[2] + _t207) {
						_t208 = _v32;
						 *_t208 =  *_t157;
						_t208[1] = _t157[1];
						_t208[2] = _t157[2];
						_t208[3] = _t157[3];
						_t186 =  *0x7ffe0330;
						asm("ror eax, cl");
						_t162 =  *_t208 ^ _t186;
						_v24 = _t162;
						 *_t208 = _t162;
						goto L12;
					}
					_t178 = _t186 + 1;
					L7:
				} while (_t201 >= _t178);
				goto L12;
			}

0x6df5dd80
0x6df5dd92
0x6df5dda3
0x6df5dda5
0x6df5ddad
0x6df5ddaf
0x6df5ddb2
0x6df5ddb5
0x6df5ddbc
0x6df5ddc3
0x6df5de8b
0x6df5de8b
0x6df5de8d
0x6df5de92
0x6df5de93
0x6df5de95
0x6df5de96
0x6df5de9f
0x6dfab5c2
0x6dfab5c2
0x6dfab5c4
0x6df5decb
0x6df5decb
0x6df5ded0
0x6dfab645
0x6df5e01e
0x6df5e01e
0x6df5de82
0x6df5de8a
0x6df5de8a
0x6df5ded9
0x6df5dee8
0x6df5def9
0x6df5e0b6
0x6df5e0b6
0x6df5e0bb
0x6df5e0bd
0x6df5e0c0
0x00000000
0x6df5e0c0
0x6df5df0d
0x6df5df12
0x6df5df15
0x6df5df17
0x6df5df1b
0x6df5df1d
0x6df5df20
0x6df5df27
0x6df5df2c
0x6df5df35
0x6df5df38
0x6df5df38
0x6df5df46
0x6df5df4b
0x6df5df50
0x6dfab611
0x6dfab613
0x00000000
0x00000000
0x6dfab615
0x6df5df56
0x6df5df56
0x6df5df5a
0x6df5df62
0x6dfab5ee
0x6dfab5f6
0x6dfab61d
0x6dfab629
0x6dfab630
0x6dfab63c
0x6df5e019
0x6df5e019
0x6df5e01c
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfab630
0x6dfab5f8
0x6dfab609
0x6dfab60e
0x00000000
0x6dfab60e
0x6df5df6c
0x00000000
0x00000000
0x6df5df72
0x6df5df7a
0x00000000
0x00000000
0x6df5df84
0x6df5df8a
0x6df5df8d
0x6dfab5cf
0x00000000
0x00000000
0x6dfab5e0
0x6dfab5e4
0x00000000
0x00000000
0x6dfab5e6
0x6df5df96
0x6df5df98
0x00000000
0x6df5dfb3
0x6df5dfbb
0x6df5dfc2
0x6df5dfd5
0x00000000
0x00000000
0x6df5dfdb
0x6df5dfe0
0x00000000
0x00000000
0x6df5dfe6
0x6df5dfeb
0x00000000
0x00000000
0x6df5dff4
0x6df5dffe
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df5dfc2
0x6df5df98
0x6df5df93
0x6df5df93
0x6df5df93
0x00000000
0x6df5df50
0x6df5dea5
0x6df5dea8
0x6df5dead
0x00000000
0x6df5dec5
0x6df5dec8
0x00000000
0x6df5dec8
0x6df5dead
0x6df5ddce
0x6df5ddd3
0x6df5dddb
0x6df5de5c
0x6df5de63
0x6df5de68
0x6df5de6c
0x6df5de71
0x6df5e028
0x6dfab58b
0x6dfab590
0x6dfab592
0x6dfab595
0x6dfab59a
0x6dfab5a5
0x6dfab5a8
0x6dfab5b0
0x00000000
0x00000000
0x6dfab5b6
0x6df5e067
0x6df5e067
0x6df5e070
0x6df5e072
0x6df5e075
0x6df5e07b
0x6df5e0dc
0x6df5e07d
0x6df5e07d
0x6df5e07d
0x6df5e080
0x6df5e08a
0x6df5e08c
0x6df5e090
0x6df5e095
0x00000000
0x00000000
0x6df5e0e0
0x6df5e0e0
0x6df5e09b
0x6df5e09e
0x6df5e0a5
0x6df5e0ac
0x6df5e0ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfab59c
0x6dfab59c
0x6dfab59c
0x6dfab59e
0x6dfab5a1
0x00000000
0x6dfab59c
0x6df5e031
0x6df5e058
0x6df5e05b
0x00000000
0x00000000
0x6df5e064
0x00000000
0x00000000
0x00000000
0x00000000
0x6df5e033
0x6df5e033
0x6df5e035
0x6df5e040
0x6df5e042
0x6df5e044
0x6df5e046
0x6df5e04c
0x00000000
0x00000000
0x6df5e052
0x6df5e056
0x00000000
0x00000000
0x00000000
0x6df5e056
0x6df5e033
0x6df5de77
0x6df5de77
0x6df5de7c
0x6df5e0ce
0x00000000
0x00000000
0x6df5e0d4
0x00000000
0x6df5e0d4
0x00000000
0x6df5de7c
0x6df5dddd
0x6df5dde2
0x6df5dde2
0x6df5dde7
0x6df5de59
0x6df5de59
0x00000000
0x6df5de59
0x6df5ddf0
0x6df5ddf3
0x6df5ddfa
0x6df5ddff
0x6df5de05
0x6df5de1c
0x00000000
0x00000000
0x6df5de1e
0x00000000
0x6df5de1e
0x6df5de0f
0x6df5de25
0x6df5de28
0x6df5de2d
0x6df5de33
0x6df5de3e
0x6df5de41
0x6df5de50
0x6df5de52
0x6df5de54
0x6df5de57
0x00000000
0x6df5de57
0x6df5de11
0x6df5de14
0x6df5de14
0x00000000

APIs

RtlAcquireSRWLockShared.9419(6E038654,6DF917F0,00000000), ref: 6DF5DDCE
ZwQueryVirtualMemory.9419(000000FF,000000FE,00000006,?,0000000C,00000000,6DF917F0,00000000), ref: 6DF5DE98
RtlImageNtHeaderEx.9419(00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000,6DF917F0,00000000), ref: 6DF5DEE8
RtlImageNtHeaderEx.9419(00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000), ref: 6DF5DF0D
RtlImageNtHeaderEx.9419(00000001,?,00000000,00000000,00000000,00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF), ref: 6DF5DF46

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage$AcquireLockMemoryQuerySharedVirtual
String ID:
API String ID: 114269737-0
Opcode ID: be46843506f40529d8e854ce9b71a5a05dfae2e305c5ef0c728b2976010ee57f
Instruction ID: 645441ccb11cfbec1f0117adeedd43ec3eb0c28920a15c4961ca92edaa1268fa
Opcode Fuzzy Hash: be46843506f40529d8e854ce9b71a5a05dfae2e305c5ef0c728b2976010ee57f
Instruction Fuzzy Hash: 46C1D271A0420A8FEB14CF5CC840BAEB7B6BFA5314F28866DD565EB380D734E951CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E003518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6E003518(signed int* __ecx) {
				char _v8;
				void* _t11;
				signed int* _t34;

				_push(__ecx);
				_t34 = __ecx;
				if(__ecx !=  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
					if(E6DF440E1("RtlDestroyHeap") == 0 || E6E004496(__ecx, 0) == 0) {
						goto L5;
					} else {
						_t32 = __ecx + 0x80;
						 *((intOrPtr*)(__ecx + 0x60)) = 0;
						if( *((intOrPtr*)(__ecx + 0x80)) != 0) {
							_v8 = 0;
							E6DF7174B(_t32,  &_v8, 0x8000);
						}
						_t11 = 1;
					}
				} else {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6DF4B150("May not destroy the process heap at %p\n", _t34);
					L5:
					_t11 = 0;
				}
				return _t11;
			}

0x6e00351d
0x6e003525
0x6e00352a
0x6e00357d
0x00000000
0x6e00358c
0x6e00358e
0x6e003594
0x6e003599
0x6e00359b
0x6e0035a7
0x6e0035a7
0x6e0035ac
0x6e0035ac
0x6e00352c
0x6e003536
0x6e003555
0x6e00355a
0x6e003538
0x6e00354d
0x6e003552
0x6e003566
0x6e00356d
0x6e00356d
0x6e00356d
0x6e0035b2

APIs

DbgPrint.9419(HEAP[%wZ]: ,-0000002C,00000000,?,?,6DF9FC67), ref: 6E00354D
DbgPrint.9419(HEAP: ,00000000,?,?,6DF9FC67), ref: 6E00355A
DbgPrint.9419(May not destroy the process heap at %p,?,00000000,?,?,6DF9FC67), ref: 6E003566

Strings

May not destroy the process heap at %p, xrefs: 6E003561
HEAP: , xrefs: 6E003555
HEAP[%wZ]: , xrefs: 6E003548
RtlDestroyHeap, xrefs: 6E003571

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: 8d8f4541df848d4539c05b7ce043d2cc24049be240efd32933a450a512a0b5b6
Instruction ID: c8807980e72766eaff0e15d4dff92d732a421ab2a619f5ad7afe14d64d7d9c1a
Opcode Fuzzy Hash: 8d8f4541df848d4539c05b7ce043d2cc24049be240efd32933a450a512a0b5b6
Instruction Fuzzy Hash: C5014932118600EFE752DFFCC458F9A77E8EF49664F028855E8059B263DB3AED44CA91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4C600, Relevance: 12.2, APIs: 8, Instructions: 225
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6DF4C600(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v1036;
				intOrPtr _v1040;
				char _v1048;
				intOrPtr _v1052;
				short _v1054;
				void* _v1056;
				void* _v1060;
				long* _v1064;
				char _v1068;
				long _v1076;
				intOrPtr _v1080;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t70;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				intOrPtr* _t81;
				void* _t101;
				void* _t102;
				void* _t107;
				intOrPtr _t109;
				long* _t110;
				long* _t111;
				long* _t112;
				long* _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				void* _t117;
				intOrPtr _t118;
				void* _t120;
				long _t121;
				long _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x6e03d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E6DF56D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E6DF8B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t74 = RtlAllocateHeap(_t107,  *0x6e037b9c + 0x180000, _t121);
					_v1060 = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1068);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1056);
					_push(_t116);
					_t122 = E6DF89650();
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *((intOrPtr*)(_t102 + 4));
							if(_t109 == 3 || _t109 == 7) {
								if(_t114 != _t109) {
									goto L59;
								}
								_t110 = _v1064;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1068 = _t118;
								if(_t110 == 0 ||  *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								} else {
									_push( *((intOrPtr*)(_t102 + 8)));
									_t59 = _t102 + 0xc; // 0xc
									_push(_t110);
									goto L54;
								}
							} else {
								_t118 = 4;
								if(_t109 != _t118) {
									if(_t109 != 0xb) {
										if(_t109 == 1) {
											if(_t114 != _t118) {
												_t118 =  *((intOrPtr*)(_t102 + 8));
												_v1068 = _t118;
												if(_t118 > _t77) {
													L10:
													_t122 = 0x80000005;
													L11:
													_t81 = _v1048;
													if(_t81 != 0 && (_t122 >= 0 || _t122 == 0x80000005)) {
														 *_t81 = _t118;
													}
													L15:
													_t78 = _v1060;
													if(_t78 != 0) {
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t78);
													}
													_t68 = _t122;
													goto L4;
												}
												_push(_t118);
												_t56 = _t102 + 0xc; // 0xc
												_push(_v1064);
												L54:
												memcpy();
												_t125 = _t125 + 0xc;
												goto L11;
											}
											if(_t77 != _t118) {
												L34:
												_t122 = 0xc0000004;
												goto L15;
											}
											_t111 = _v1064;
											if((_t111 & 0x00000003) == 0) {
												_v1068 = _t118;
												if(_t111 == 0) {
													goto L10;
												}
												_t42 = _t102 + 0xc; // 0xc
												_v1052 = _t42;
												_v1056 =  *((intOrPtr*)(_t102 + 8));
												_v1054 =  *((intOrPtr*)(_t102 + 8));
												_t122 = RtlUnicodeStringToInteger( &_v1056, 0, _t111);
												L44:
												_t118 = _v1080;
												goto L11;
											}
											_t122 = 0x80000002;
											goto L15;
										}
										_t122 = 0xc0000024;
										goto L44;
									}
									if(_t114 != _t109) {
										L59:
										_t122 = 0xc0000024;
										goto L15;
									}
									_t118 = 8;
									if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
										goto L34;
									} else {
										_t112 = _v1064;
										_v1068 = _t118;
										if(_t112 == 0) {
											goto L10;
										}
										 *_t112 =  *(_t102 + 0xc);
										_t112[1] =  *(_t102 + 0x10);
										goto L11;
									}
								}
								if(_t114 != _t118) {
									goto L59;
								}
								if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								} else {
									_t113 = _v1064;
									_v1068 = _t118;
									if(_t113 == 0) {
										goto L10;
									}
									 *_t113 =  *(_t102 + 0xc);
									goto L11;
								}
							}
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						if(_t118 <= _a20) {
							_t114 =  *((intOrPtr*)(_t102 + 4));
							_t77 = _t118;
							goto L26;
						}
						_v1068 = _t118;
						goto L10;
					}
					if(_t122 != 0x80000005) {
						goto L15;
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1076;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E6DF89650();
				if(_t122 >= 0) {
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x6df4c608
0x6df4c615
0x6df4c625
0x6df4c62d
0x6df4c635
0x6df4c640
0x6df4c680
0x6df4c687
0x6df4c688
0x6df4c689
0x6df4c694
0x6df4c694
0x6df4c642
0x6df4c64a
0x6df4c697
0x6dfb7a25
0x6dfb7a2b
0x6dfb7a30
0x6dfb7bea
0x6dfb7bea
0x00000000
0x6dfb7bea
0x6dfb7a43
0x6dfb7a48
0x6dfb7a4e
0x00000000
0x00000000
0x6dfb7a58
0x6dfb7a5a
0x6dfb7a5b
0x6dfb7a5c
0x6dfb7a5d
0x6dfb7a63
0x6dfb7a64
0x6dfb7a6a
0x6dfb7a6e
0x6dfb79cb
0x6dfb79cb
0x6dfb79d0
0x6dfb7a98
0x6dfb7a9b
0x6dfb7a9b
0x6dfb7aa1
0x6dfb7bc0
0x00000000
0x00000000
0x6dfb7bc2
0x6dfb7bc6
0x6dfb7bc9
0x6dfb7bcf
0x00000000
0x6dfb7bde
0x6dfb7ba9
0x6dfb7bac
0x6dfb7bb0
0x00000000
0x6dfb7bb0
0x6dfb7ab0
0x6dfb7ab2
0x6dfb7ab5
0x6dfb7aef
0x6dfb7b28
0x6dfb7b64
0x6dfb7b8f
0x6dfb7b92
0x6dfb7b98
0x6dfb79e6
0x6dfb79e6
0x6dfb79eb
0x6dfb79eb
0x6dfb79f1
0x6dfb79ff
0x6dfb79ff
0x6dfb7a01
0x6dfb7a01
0x6dfb7a07
0x6dfb7a15
0x6dfb7a15
0x6dfb7a1a
0x00000000
0x6dfb7a1a
0x6dfb7b9e
0x6dfb7b9f
0x6dfb7ba3
0x6dfb7bb1
0x6dfb7bb1
0x6dfb7bb6
0x00000000
0x6dfb7bb6
0x6dfb7b68
0x6dfb7ae2
0x6dfb7ae2
0x00000000
0x6dfb7ae2
0x6dfb7b6e
0x6dfb7b75
0x6dfb7b81
0x6dfb7b87
0x00000000
0x00000000
0x6dfb7b31
0x6dfb7b34
0x6dfb7b3c
0x6dfb7b46
0x6dfb7b57
0x6dfb7b59
0x6dfb7b59
0x00000000
0x6dfb7b59
0x6dfb7b77
0x00000000
0x6dfb7b77
0x6dfb7b2a
0x00000000
0x6dfb7b2a
0x6dfb7af3
0x6dfb7be0
0x6dfb7be0
0x00000000
0x6dfb7be0
0x6dfb7afb
0x6dfb7afe
0x00000000
0x6dfb7b05
0x6dfb7b05
0x6dfb7b09
0x6dfb7b0f
0x00000000
0x00000000
0x6dfb7b18
0x6dfb7b1d
0x00000000
0x6dfb7b1d
0x6dfb7afe
0x6dfb7ab9
0x00000000
0x00000000
0x6dfb7ac1
0x00000000
0x6dfb7ac8
0x6dfb7ac8
0x6dfb7acc
0x6dfb7ad2
0x00000000
0x00000000
0x6dfb7adb
0x00000000
0x6dfb7adb
0x6dfb7ac1
0x6dfb7aa1
0x6dfb79d6
0x6dfb79dc
0x6dfb7a91
0x6dfb7a94
0x00000000
0x6dfb7a94
0x6dfb79e2
0x00000000
0x6dfb79e2
0x6dfb7a7a
0x00000000
0x00000000
0x6dfb7a8a
0x6dfb7a21
0x6dfb7a21
0x00000000
0x6dfb7a21
0x6df4c650
0x6df4c651
0x6df4c656
0x6df4c65c
0x6df4c65d
0x6df4c663
0x6df4c664
0x6df4c66a
0x6df4c66e
0x6dfb79c7
0x00000000
0x6dfb79c7
0x6df4c67a
0x00000000
0x00000000
0x00000000

APIs

RtlInitUnicodeStringEx.9419(?,?,?,?,?), ref: 6DF4C639
ZwQueryValueKey.9419(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6DF4C665
RtlFreeHeap.9419(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6DFB7A15
RtlAllocateHeap.9419(?,?,?,?,?,?,?,?), ref: 6DFB7A43
ZwQueryValueKey.9419(?,?,00000002,00000000,?,?,?,?), ref: 6DFB7A65
RtlFreeHeap.9419(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6DFB7A8A
RtlUnicodeStringToInteger.9419(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6DFB7B52
memcpy.9419(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6DFB7BB1

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: 833e163adfc4d4976c1042e3d846318d376176f65601c8b058681be4da50e9e7
Instruction ID: dd19bd0a49d49feac7f1a9256c7b3d90471431a2a3c41af6559d826cd8239bb4
Opcode Fuzzy Hash: 833e163adfc4d4976c1042e3d846318d376176f65601c8b058681be4da50e9e7
Instruction Fuzzy Hash: 1181B376A483428FDB12CE1DC880B6BB7F8FB84354F15885AED599B254D330DD44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF45050, Relevance: 12.1, APIs: 8, Instructions: 133
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DF45050(intOrPtr _a4) {
				char _v20;
				void* _v24;
				long _v26;
				void* _v28;
				void* _v40;
				void* _v42;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v64;
				intOrPtr _t34;
				void* _t36;
				void* _t38;
				signed short _t41;
				signed int _t51;
				void* _t58;
				void* _t60;
				void* _t69;
				intOrPtr _t74;
				long _t78;
				void* _t79;
				void* _t80;
				void* _t81;
				signed int _t82;
				void* _t84;

				_t84 = (_t82 & 0xfffffff8) - 0x1c;
				_t34 =  *[fs:0x30];
				_t58 =  *(_t34 + 0x18);
				_t74 =  *((intOrPtr*)(_t34 + 0x10));
				_v28 = _t58;
				if(E6DF4519E(_a4) != 0) {
					_t36 = 0;
					L14:
					return _t36;
				}
				if(E6DF674C0(_a4) != 0) {
					_t36 = 0xc0000103;
				} else {
					_t78 =  *(_t74 + 0x26) & 0x0000ffff;
					while(1) {
						_t38 = RtlAllocateHeap(_t58, 0, _t78);
						_v24 = _t38;
						if(_t38 == 0) {
							break;
						}
						_v28 = 0;
						if(_t78 > 0xffff) {
							_v26 = 0xffff;
							L25:
							_t79 = 0xc0000095;
							L26:
							RtlFreeHeap(_t58, 0, _t38);
							_t36 = _t79;
							goto L14;
						}
						_v26 = _t78;
						_t80 = E6DF66E30(_a4, _t78, _t38, 0, 0,  &_v20);
						if(_t80 == 0) {
							_t79 = 0xc0000033;
							L23:
							_t38 = _v24;
							goto L26;
						}
						_t41 = _v26;
						if(_t80 > (_t41 & 0x0000ffff) - 4) {
							__eflags =  *((char*)( *[fs:0x30] + 3));
							if(__eflags >= 0) {
								_t41 = _v26;
								goto L7;
							}
							RtlFreeHeap(_t58, 0, _v24);
							_t78 = _t80 + 4;
							continue;
						}
						L7:
						_t72 = _t41 & 0x0000ffff;
						if(_t80 > (_t41 & 0x0000ffff)) {
							_t79 = 0xc0000106;
							goto L23;
						}
						_t92 = _t80 - 0xffff;
						if(_t80 > 0xffff) {
							_v28 = 0xffff;
							_t38 = _v24;
							goto L25;
						}
						_v28 = _t80;
						_t60 = E6DF7F0BF( &_v28, _t72, _t92, _t84 + 0x14);
						RtlFreeHeap(_v40, 0, _v28);
						if(_t60 >= 0) {
							L6DF5EEF0(0x6e0379a0);
							_t69 = _v44;
							_t81 =  *0x6e038210;
							 *((intOrPtr*)(_t74 + 0x2c)) =  *((intOrPtr*)(_t69 + 4));
							 *((intOrPtr*)(_t74 + 0x28)) =  *((intOrPtr*)(_t69 + 0x10));
							 *((short*)(_t74 + 0x24)) =  *((intOrPtr*)(_t69 + 0xc));
							 *0x6e038210 = _t69;
							_t51 = E6DF5EB70(_t69, 0x6e0379a0);
							if(_t81 != 0) {
								asm("lock xadd [esi], eax");
								if((_t51 | 0xffffffff) == 0) {
									_push( *((intOrPtr*)(_t81 + 4)));
									E6DF895D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t81);
								}
							}
						}
						_t36 = _t60;
						goto L14;
					}
					_t36 = 0xc0000017;
				}
			}

0x6df45058
0x6df4505b
0x6df45066
0x6df4506a
0x6df4506d
0x6df45078
0x6df4519a
0x6df45191
0x6df45197
0x6df45197
0x6df45088
0x6dfa0c21
0x6df4508e
0x6df4508e
0x6df45092
0x6df45096
0x6df4509b
0x6df450a1
0x00000000
0x00000000
0x6df450ae
0x6df450b5
0x6dfa0c72
0x6dfa0c77
0x6dfa0c77
0x6dfa0c7c
0x6dfa0c80
0x6dfa0c85
0x00000000
0x6dfa0c85
0x6df450bf
0x6df450d4
0x6df450d8
0x6dfa0c67
0x6dfa0c6c
0x6dfa0c6c
0x00000000
0x6dfa0c6c
0x6df450de
0x6df450eb
0x6dfa0c31
0x6dfa0c35
0x6dfa0c4b
0x00000000
0x6dfa0c4b
0x6dfa0c3e
0x6dfa0c43
0x00000000
0x6dfa0c43
0x6df450f1
0x6df450f1
0x6df450f6
0x6dfa0c55
0x00000000
0x6dfa0c55
0x6df45101
0x6df45103
0x6dfa0c5c
0x6dfa0c61
0x00000000
0x6dfa0c61
0x6df4510d
0x6df45120
0x6df45128
0x6df4512f
0x6df45136
0x6df4513b
0x6df4513f
0x6df4514d
0x6df45153
0x6df4515a
0x6df4515e
0x6df45164
0x6df4516b
0x6df45170
0x6df45174
0x6df45176
0x6df45179
0x6df4518a
0x6df4518a
0x6df45174
0x6df4516b
0x6df4518f
0x00000000
0x6df4518f
0x6dfa0c8c
0x6dfa0c8c

APIs

RtlAllocateHeap.9419(?,00000000,?), ref: 6DF45096
RtlFreeHeap.9419(?,00000000,00000000,00000000,?), ref: 6DFA0C80

Part of subcall function 6DF66E30: memset.9419(01000000,00000000,?,?,00000024,00000000,?), ref: 6DF66F17

RtlFreeHeap.9419(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6DF45128
RtlEnterCriticalSection.9419(6E0379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6DF45136
RtlLeaveCriticalSection.9419(6E0379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6DF45164
ZwClose.9419(?,6E0379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000), ref: 6DF45179
RtlFreeHeap.9419(?,00000000,?,?,6E0379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000), ref: 6DF4518A
RtlFreeHeap.9419(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6DFA0C3E

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$CriticalSection$AllocateCloseEnterLeavememset
String ID:
API String ID: 1968905909-0
Opcode ID: 2ac12dfc3ae1375804016a1b501f416977f2619dd3a6aa8402216695f5c001a1
Instruction ID: 458ccaeb90c1d4240a171621ee26d5a15cb8a1a80a6105ac83e954d245a84cc7
Opcode Fuzzy Hash: 2ac12dfc3ae1375804016a1b501f416977f2619dd3a6aa8402216695f5c001a1
Instruction Fuzzy Hash: 72412736618352EBC310EF2DD880B2ABBA4BF84304F164929F9958B781D770DC01C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7513A, Relevance: 10.8, APIs: 7, Instructions: 258
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6DF7513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				int _v28;
				int* _v32;
				signed int _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				void* _t165;
				signed int _t172;
				signed int _t181;
				void* _t185;
				void* _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				intOrPtr _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr _t230;
				void** _t233;
				signed int _t234;
				signed int _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t241;
				void* _t246;
				signed int _t247;
				signed int _t248;
				void* _t249;
				void* _t252;
				void* _t253;
				signed int _t254;
				signed int _t256;
				signed int _t257;

				_t256 = (_t254 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6e03d360 ^ _t256;
				_v32 = _v32 & 0x00000000;
				_t252 = __edx;
				_t238 = __ecx;
				_t212 = 6;
				_t246 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t246, 0, _t212 << 2);
				_t257 = _t256 + 0xc;
				_t247 = _t246 + _t212;
				if(_t207 == 2) {
					_t248 =  *(_t238 + 0x60);
					_t208 =  *(_t238 + 0x64);
					_v63 =  *((intOrPtr*)(_t238 + 0x4c));
					_t159 =  *((intOrPtr*)(_t238 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t238 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t248;
					L8:
					_t214 = 0;
					if( *(_t238 + 0x74) > 0) {
						_t82 = _t238 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = 1 + _t214;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t238 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t238 +  *((intOrPtr*)(_v88 + _t238 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t238 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t238 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t241 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t252 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t241 + 0x4e) & 0x7fff)) {
								_t181 = E6DF8D0F0(1, _t226 + 0x20, 0);
								_t230 = _v40;
								 *(_t230 + 8) = _t181;
								 *((intOrPtr*)(_t230 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t250 = _t127;
								E6DF62280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *(_t210 + 0x94);
								if(_t185 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t185);
								}
								_t189 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v20 + 0x10);
								 *(_t210 + 0x94) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v28;
									( *(_t210 + 0x94))[3] = _v24;
									_t233 =  *(_t210 + 0x94);
									 *_t233 =  &(_t233[4]);
									_t233[1] = _t233[1] & 0x00000000;
									memcpy( *( *(_t210 + 0x94)), _v36, _v28);
									_t257 = _t257 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E6DF5FFB0(_t210, _t250, _t250);
								_t222 = _v84;
								_t172 = _v88;
								_t208 = _v92;
								_t248 = _v96;
								L10:
								_t239 =  *((intOrPtr*)(_t252 + 0x1c));
								_v44 = _t239;
								if(_t239 != 0) {
									 *0x6e03b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t248, _t208, _v32,  *((intOrPtr*)(_t252 + 0x20)));
									_v44();
								}
								_pop(_t249);
								_pop(_t253);
								_pop(_t209);
								return E6DF8B640(0, _t209, _v8 ^ _t257, _t239, _t249, _t253);
							}
							_t181 = _v92;
							L31:
							_t226 = 1 + _t226;
							_t181 = _t181 + 0x18;
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t248 = _t247 | 0xffffffff;
				_t208 = _t248;
				_v84 = _t248;
				_v80 = _t208;
				if( *((intOrPtr*)(_t252 + 0x4c)) == _t157) {
					_t234 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t252 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t252 + 0x40);
					_t234 = _v72 |  *(_t252 + 0x44);
					_t248 =  *(_t252 + 0x38);
					_t208 =  *(_t252 + 0x3c);
					_v76 = _t202;
					_v72 = _t234;
					_v84 = _t248;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t234;
				if( *((char*)(_t252 + 0xc4)) != 0) {
					_t238 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t252 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t252 + 0xc5));
						_t238 = _v48;
					}
					_t203 = _t202 |  *(_t252 + 0xb8);
					_t235 = _t234 |  *(_t252 + 0xbc);
					_t248 = _t248 &  *(_t252 + 0xb0);
					_t208 = _t208 &  *(_t252 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t235;
					_v72 = _t235;
					_v84 = _t248;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t248 = 0;
					 *(_t238 + 0x74) =  *(_t238 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x6df75142
0x6df7514c
0x6df75150
0x6df75157
0x6df75159
0x6df7515e
0x6df75165
0x6df75169
0x6df7516c
0x6df75172
0x6df75176
0x6df7517a
0x6df7517a
0x6df7517a
0x6df7517f
0x6dfb6d8b
0x6dfb6d8e
0x6dfb6d91
0x6dfb6d95
0x6dfb6d98
0x6dfb6d9c
0x6dfb6da0
0x6dfb6da3
0x6dfb6da7
0x6dfb6e26
0x6dfb6e26
0x6dfb6e2a
0x6df751f9
0x6df751f9
0x6df751fe
0x6dfb6e33
0x6dfb6e33
0x6dfb6e39
0x6dfb6e3d
0x6dfb6e46
0x6dfb6e50
0x00000000
0x00000000
0x6dfb6e52
0x6dfb6e53
0x6dfb6e56
0x6dfb6e5d
0x00000000
0x00000000
0x00000000
0x6dfb6e5f
0x6dfb6e67
0x6dfb6e77
0x6dfb6e7f
0x6dfb6e80
0x6dfb6e88
0x6dfb6e90
0x6dfb6e9f
0x6dfb6ea5
0x6dfb6ea9
0x6dfb6eb1
0x6dfb6ebf
0x00000000
0x00000000
0x6dfb6ecf
0x6dfb6ed3
0x00000000
0x00000000
0x6dfb6edb
0x6dfb6ede
0x6dfb6ee1
0x6dfb6ee8
0x6dfb6eeb
0x6dfb6eed
0x6dfb6ef0
0x6dfb6ef4
0x6dfb6ef8
0x6dfb6efc
0x00000000
0x00000000
0x6dfb6f0d
0x6dfb6f11
0x6dfb6f32
0x6dfb6f37
0x6dfb6f3b
0x6dfb6f3e
0x6dfb6f41
0x6dfb6f46
0x00000000
0x00000000
0x6dfb6f4c
0x6dfb6f50
0x6dfb6f50
0x6dfb6f54
0x6dfb6f62
0x6dfb6f65
0x6dfb6f6d
0x6dfb6f7b
0x6dfb6f7b
0x6dfb6f93
0x6dfb6f98
0x6dfb6fa0
0x6dfb6fa6
0x6dfb6fb3
0x6dfb6fb6
0x6dfb6fbf
0x6dfb6fc1
0x6dfb6fd5
0x6dfb6fda
0x6dfb6fda
0x6dfb6fdd
0x6dfb6fe2
0x6dfb6fe7
0x6dfb6feb
0x6dfb6fef
0x6dfb6ff3
0x6df7520c
0x6df7520c
0x6df7520f
0x6df75215
0x6df75234
0x6df7523a
0x6df7523a
0x6df75244
0x6df75245
0x6df75246
0x6df75251
0x6df75251
0x6dfb6f13
0x6dfb6f17
0x6dfb6f17
0x6dfb6f18
0x6dfb6f1b
0x6dfb6f1f
0x6dfb6f23
0x00000000
0x6dfb6f28
0x6df75204
0x6df75204
0x6df75208
0x00000000
0x6df75208
0x6df75185
0x6df75188
0x6df7518a
0x6df7518e
0x6df75195
0x6dfb6db1
0x6dfb6db5
0x6dfb6db9
0x6df7519b
0x6df7519b
0x6df7519e
0x6df751a7
0x6df751a9
0x6df751a9
0x6df751b5
0x6df751b8
0x6df751bb
0x6df751be
0x6df751c1
0x6df751c5
0x6df751c9
0x6df751cd
0x6df751cd
0x6df751d8
0x6df751dc
0x6df751e0
0x6dfb6dcc
0x6dfb6dd0
0x6dfb6dd5
0x6dfb6ddd
0x6dfb6de1
0x6dfb6de1
0x6dfb6de5
0x6dfb6deb
0x6dfb6df1
0x6dfb6df7
0x6dfb6dfd
0x6dfb6e01
0x6dfb6e05
0x6dfb6e09
0x6dfb6e0d
0x6dfb6e11
0x6dfb6e11
0x6df751eb
0x6dfb6e1a
0x6dfb6e1f
0x6dfb6e21
0x6dfb6e23
0x00000000
0x6df751f1
0x6df751f1
0x00000000
0x6df751f1

APIs

RtlDebugPrintTimes.9419(?,?,?,?,?,-00000054,6E0386CC,?,000000FF,?,000000A0,?), ref: 6DF75234

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: dee52c5a358168bdc259c464b1075e52c304885a331a3f1c57f79276bad80e12
Instruction ID: 3d1c1e29c3d4027dfb66332ea67f44add137d8bacaa087cceab4de8e87013868
Opcode Fuzzy Hash: dee52c5a358168bdc259c464b1075e52c304885a331a3f1c57f79276bad80e12
Instruction Fuzzy Hash: 99C141755083818FD355CF29C480A6AFBF1BF89308F148A6EF9998B352D771E845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DF6B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E6E00A80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0x6e038748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E6DF4B150();
					__eflags =  *0x6e037bc8;
					if(__eflags == 0) {
						E6E002073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E6E00A80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0x6e038720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0x6e038720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E6DF6B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E6E00A80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E6DF6E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}

0x6df6b746
0x6df6b74b
0x6df6b74d
0x6df6b750
0x6df6b755
0x6df6b758
0x6df6b758
0x6df6b75e
0x6df6b763
0x6df6b764
0x6df6b76a
0x6df6b76d
0x6df6b771
0x6df6b776
0x6df6b85c
0x6df6b85d
0x6df6b860
0x6df6b865
0x6dfb2ba1
0x6dfb2ba2
0x6dfb2ba9
0x6dfb2bae
0x6dfb2bae
0x6df6b77c
0x6df6b77c
0x6df6b77c
0x6df6b785
0x6df6b788
0x6dfb2bb6
0x6dfb2bb9
0x00000000
0x00000000
0x6dfb2bbf
0x6dfb2bc5
0x6dfb2bc9
0x6dfb2be8
0x6dfb2bed
0x6dfb2bcb
0x6dfb2be0
0x6dfb2be5
0x6dfb2bf3
0x6dfb2bf8
0x6dfb2bfd
0x6dfb2c05
0x6dfb2c0e
0x6dfb2c0e
0x00000000
0x6df6b78e
0x6df6b78e
0x6df6b78e
0x6df6b791
0x6df6b791
0x6df6b797
0x6df6b797
0x6df6b79f
0x6df6b7a9
0x6df6b7af
0x6df6b7af
0x6df6b7b1
0x6df6b7b6
0x6df6b7e2
0x6df6b7e2
0x6df6b7e7
0x6df6b880
0x6df6b7ed
0x6df6b7ed
0x6df6b7ed
0x6df6b7ef
0x6df6b7f2
0x6df6b7f2
0x6df6b7f5
0x6df6b7fa
0x6dfb2c2d
0x6dfb2c2e
0x6dfb2c39
0x6df6b800
0x6df6b800
0x6df6b802
0x6df6b805
0x6df6b808
0x6df6b808
0x6df6b80a
0x6df6b80d
0x6df6b816
0x6df6b81c
0x6df6b822
0x6df6b82f
0x6df6b88b
0x6df6b892
0x6df6b897
0x6df6b899
0x6df6b89b
0x6df6b89e
0x6df6b8a5
0x6df6b8a8
0x6df6b8aa
0x6df6b8ac
0x6df6b8ac
0x6df6b8aa
0x6df6b892
0x6df6b831
0x6df6b839
0x6df6b83b
0x6df6b83b
0x6df6b844
0x6df6b84b
0x6df6b852
0x6df6b7b8
0x6df6b7ba
0x6df6b7bf
0x6df6b7c4
0x6dfb2c18
0x6dfb2c19
0x6dfb2c23
0x6df6b7ca
0x6df6b7ca
0x6df6b7cc
0x6df6b7cf
0x6df6b7d1
0x6df6b7d1
0x6df6b7d4
0x6df6b7dc
0x6df6b8bb
0x6df6b8bb
0x6df6b8be
0x6df6b8be
0x6df6b8c1
0x00000000
0x00000000
0x6df6b8c3
0x6df6b8c5
0x6df6b8c7
0x6df6b8e0
0x00000000
0x6df6b8e0
0x6df6b8cc
0x6df6b8cc
0x00000000
0x6df6b8cc
0x6df6b8d6
0x6df6b8d6
0x00000000
0x6df6b7dc
0x6df6b7b6

Strings

((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6DFB2BF3
HEAP: , xrefs: 6DFB2BE8
HEAP[%wZ]: , xrefs: 6DFB2BDB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: a5deab341bdcc120f11a35f62d2e3148260da99dfca7f797bcf5bbf0160e6164
Instruction ID: d55044cdbee0a382007dc84ec32cfedeb73b7c90e3f4ff30fd040080b657f6f9
Opcode Fuzzy Hash: a5deab341bdcc120f11a35f62d2e3148260da99dfca7f797bcf5bbf0160e6164
Instruction Fuzzy Hash: 0D61BF71614286DFDB19CF6CC440B6ABBB5FF45304F14C969E8598B642D731E882CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF795EC, Relevance: 10.7, APIs: 7, Instructions: 165
timelibraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DF795EC(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t55;
				signed int _t59;
				signed int* _t62;
				void* _t68;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;
				signed int _t111;
				signed int _t114;
				signed int _t116;

				_v8 =  *0x6e03d360 ^ _t116;
				_t114 = __edx;
				_v28 = __ecx;
				_v24 = 0;
				_v20 = 0;
				_t115 =  *((intOrPtr*)(__edx + 0x58));
				if(_t115 != 0) {
					_push( &_v20);
					_push(0);
					_push(0);
					E6DF83720(_t90, __edx, __edx, _t115, __eflags);
				}
				_t91 = _t114 + 0x8c;
				_t95 =  *_t91;
				do {
					_t111 = _t95;
					_t55 = _t95 >> 1;
					if(_t55 == 0) {
						_v16 = _v16 & 0x00000000;
						_v12 = _v12 & 0x00000000;
					} else {
						_v16 = 1;
						_v12 = 1;
						if((_t95 & 0x00000001 | _t55 * 0x00000002 - 0x00000002) < 2) {
							_v12 = _v12 & 0x00000000;
						}
					}
					asm("lock cmpxchg [ebx], ecx");
					_t95 = _t111;
				} while (_t95 != _t111);
				_t92 = _t91 | 0xffffffff;
				if(_t115 != 0) {
					__eflags = _v16;
					if(__eflags != 0) {
						__eflags = E6DF7EAA0(_t95, 0, _t115);
						if(__eflags >= 0) {
							_t86 = _v28;
							_t35 = _t86 + 0x50;
							 *_t35 =  *(_t86 + 0x50) | 0x00000100;
							__eflags =  *_t35;
							 *((intOrPtr*)(_t86 + 0x64)) = _t115;
						} else {
							_v16 = _v16 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							_v24 = 1;
						}
					}
					_push(_v20);
					_push(0);
					E6DF84520(_t92, _t114, _t115, __eflags);
					__eflags = _v24;
					if(_v24 != 0) {
						_t113 = _t92;
						E6DF79ED0(_t114 + 0x20, _t92, 0);
						E6E018450(_t114);
					}
				}
				if(_v12 != 0) {
					_push(2);
					asm("lock xadd [edi], eax");
					_t59 = E6DF67D50();
					__eflags = _t59;
					if(_t59 != 0) {
						_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t62 = 0x7ffe0386;
					}
					__eflags =  *_t62;
					if( *_t62 != 0) {
						E6E018A62( *(_t114 + 0x5c), _t114 + 0x78,  *((intOrPtr*)(_t114 + 0x30)),  *((intOrPtr*)(_t114 + 0x34)),  *((intOrPtr*)(_t114 + 0x3c)));
					}
					_t113 =  *(_t114 + 0x5c);
					E6DF79702(_t92, _t114 + 0x78,  *(_t114 + 0x5c),  *((intOrPtr*)(_t114 + 0x74)), 0);
					asm("lock xadd [edi], eax");
					if(__eflags == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6e03b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
				}
				if(_a4 != 0) {
					_t113 = 0;
					__eflags = E6DF7992F(0);
					if(__eflags != 0) {
						 *((intOrPtr*)(_t114 + 0x70)) = _v0;
						asm("lock xadd [edi], eax");
						if(__eflags == 0) {
							_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
							 *0x6e03b1e0(_t114);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
						}
					}
				}
				if(_v16 == 0) {
					asm("lock xadd [edi], ebx");
					_t92 = _t92 - 1;
					__eflags = _t92;
					if(_t92 == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6e03b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
					_t68 = 0;
				} else {
					_t113 = _t114;
					E6DF6E63F(_v28, _t114);
					_t68 = 1;
				}
				return E6DF8B640(_t68, _t92, _v8 ^ _t116, _t113, _t114, _t115);
			}

0x6df795fb
0x6df79601
0x6df79603
0x6df79608
0x6df7960b
0x6df7960e
0x6df79613
0x6dfb967f
0x6dfb9680
0x6dfb9681
0x6dfb9682
0x6dfb9682
0x6df79619
0x6df7961f
0x6df79621
0x6df79623
0x6df79625
0x6df79627
0x6dfb968c
0x6dfb9690
0x6df7962d
0x6df79634
0x6df79643
0x6df79649
0x6df7964b
0x6df7964f
0x6df79649
0x6df79653
0x6df79657
0x6df79659
0x6df7965d
0x6df79662
0x6dfb969c
0x6dfb96a0
0x6dfb96aa
0x6dfb96ac
0x6dfb96bf
0x6dfb96c2
0x6dfb96c2
0x6dfb96c2
0x6dfb96c9
0x6dfb96ae
0x6dfb96ae
0x6dfb96b2
0x6dfb96b6
0x6dfb96b6
0x6dfb96ac
0x6dfb96cc
0x6dfb96cf
0x6dfb96d1
0x6dfb96d6
0x6dfb96da
0x6dfb96e5
0x6dfb96e7
0x6dfb96ed
0x6dfb96ed
0x6dfb96da
0x6df7966c
0x6df7969e
0x6df796a1
0x6df796a5
0x6df796aa
0x6df796ac
0x6dfb9700
0x6df796b2
0x6df796b2
0x6df796b2
0x6df796b9
0x6df796bb
0x6dfb9719
0x6dfb9719
0x6df796c1
0x6df796cc
0x6df796d3
0x6df796d7
0x6dfb9727
0x6dfb972b
0x6dfb9731
0x6dfb9731
0x6df796d7
0x6df79672
0x6df796de
0x6df796e7
0x6df796e9
0x6df796ee
0x6df796f3
0x6df796f7
0x6dfb973c
0x6dfb9740
0x6dfb9746
0x6dfb9746
0x6df796f7
0x6df796e9
0x6df79678
0x6dfb974d
0x6dfb9751
0x6dfb9751
0x6dfb9752
0x6dfb9758
0x6dfb975c
0x6dfb9762
0x6dfb9762
0x6dfb9764
0x6df7967e
0x6df79681
0x6df79683
0x6df7968a
0x6df7968a
0x6df7969b

APIs

RtlGetCurrentServiceSessionId.9419(00000000,00000001,?,?,7FFE0386), ref: 6DF796A5

Part of subcall function 6DF79702: RtlAcquireSRWLockExclusive.9419(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6DF7974F
Part of subcall function 6DF79702: RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6DF7976D

LdrLockLoaderLock.9419(00000000,00000000,00000001,?,?,7FFE0386,?,6DF46778,00000001), ref: 6DFB9682
RtlDebugPrintTimes.9419(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6DFB972B
RtlDebugPrintTimes.9419(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6DFB9740

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$DebugExclusivePrintTimes$AcquireCurrentLoaderReleaseServiceSession
String ID:
API String ID: 732933571-0
Opcode ID: b44784ac4828bae6e70b3981018cffe8084ac4c513f91e2108c326dfd1046a43
Instruction ID: f553172375de763876406c1fcfaf671f038cd169077fba9baf69e14fbd349ebd
Opcode Fuzzy Hash: b44784ac4828bae6e70b3981018cffe8084ac4c513f91e2108c326dfd1046a43
Instruction Fuzzy Hash: 6251EC71A0860AEFDB15CF6CD844BAEB7B5FF15318F10822AE512972A0EF749911CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF43FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6DF43FC5(signed int __edx, intOrPtr _a4) {
				void* __ecx;
				signed char _t44;
				signed char _t48;
				intOrPtr* _t50;
				unsigned int _t51;
				signed char _t52;
				signed int _t58;
				signed int _t59;
				intOrPtr _t62;
				intOrPtr* _t64;
				signed int _t65;
				signed int _t78;

				_t58 = __edx;
				_t78 = _t59;
				if(__edx == 0 || (__edx & 0x00000007) != 0) {
					L37:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6DF4B150();
					} else {
						E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t58 + 8);
					_push(_t78);
					E6DF4B150("Invalid address specified to %s( %p, %p )\n", _a4);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6e036378 = 1;
						asm("int3");
						 *0x6e036378 = 0;
					}
					return 0;
				} else {
					_t44 =  *((intOrPtr*)(__edx + 7));
					if((_t44 & 0x0000003f) == 0) {
						goto L37;
					}
					if(_t44 < 0) {
						if( *((char*)(_t78 + 0xda)) != 2) {
							_t62 = 0;
						} else {
							_t62 =  *((intOrPtr*)(_t78 + 0xd4));
						}
						if(_t62 != 0) {
							if(_t44 != 4) {
								L23:
								return 1;
							}
						}
						goto L37;
					}
					if( *(_t78 + 0x4c) == 0 || ( *(_t78 + 0x50) ^  *__edx) >> 0x18 == (( *(_t78 + 0x50) ^  *__edx) >> 0x00000010 ^ ( *(_t78 + 0x50) ^  *__edx) >> 0x00000008 ^ _t76)) {
						if( *((char*)(_t58 + 7)) == 4) {
							if((_t58 & 0x00000fff) != 0x18) {
								goto L37;
							}
							L13:
							if( *(_t78 + 0x4c) == 0) {
								_t48 =  *((intOrPtr*)(_t58 + 2));
							} else {
								_t51 =  *_t58;
								if(( *(_t78 + 0x4c) & _t51) != 0) {
									_t51 = _t51 ^  *(_t78 + 0x50);
								}
								_t48 = _t51 >> 0x10;
							}
							if((_t48 & 0x00000004) != 0) {
								if(E6DFF23E3(_t78, _t58) != 0) {
									goto L18;
								}
							} else {
								L18:
								if( *((char*)(_t58 + 7)) == 4) {
									goto L23;
								}
								_t64 = _t78 + 0xa4;
								_t50 =  *_t64;
								while(_t50 != _t64) {
									if(_t58 <  *((intOrPtr*)(_t50 + 0x14)) || _t58 >=  *((intOrPtr*)(_t50 + 0x18))) {
										_t50 =  *_t50;
										continue;
									} else {
										goto L23;
									}
								}
							}
							goto L37;
						}
						_t52 =  *((intOrPtr*)(_t58 + 6));
						if(_t52 == 0) {
							_t65 = _t78;
						} else {
							_t65 = (_t58 & 0xffff0000) - ((_t52 & 0x000000ff) << 0x10) + 0x10000;
						}
						if(_t65 == 0 ||  *((intOrPtr*)(_t65 + 0x18)) != _t78 || _t58 <  *((intOrPtr*)(_t65 + 0x24)) || _t58 >=  *((intOrPtr*)(_t65 + 0x28))) {
							goto L37;
						} else {
							goto L13;
						}
					} else {
						goto L37;
					}
				}
			}

0x6df43fcc
0x6df43fcf
0x6df43fd3
0x6dfa03b8
0x6dfa03c2
0x6dfa03e1
0x6dfa03e6
0x6dfa03c4
0x6dfa03d9
0x6dfa03de
0x6dfa03ef
0x6dfa03f0
0x6dfa03f9
0x6dfa040b
0x6dfa040d
0x6dfa0414
0x6dfa0415
0x6dfa0415
0x00000000
0x6df43fe2
0x6df43fe2
0x6df43fe7
0x00000000
0x00000000
0x6df43fef
0x6df440b8
0x6df440d8
0x6df440ba
0x6df440ba
0x6df440ba
0x6df440c2
0x6df440ca
0x6df440a4
0x00000000
0x6df440a4
0x6df440cc
0x00000000
0x6df440c2
0x6df43ff9
0x6df4401f
0x6dfa03a0
0x00000000
0x00000000
0x6df44069
0x6df4406d
0x6df440dc
0x6df4406f
0x6df4406f
0x6df44074
0x6df44076
0x6df44076
0x6df44079
0x6df44079
0x6df4407e
0x6dfa03b2
0x00000000
0x00000000
0x6df44084
0x6df44084
0x6df44088
0x00000000
0x00000000
0x6df4408a
0x6df44090
0x6df44092
0x6df4409d
0x6df440ad
0x00000000
0x00000000
0x00000000
0x00000000
0x6df4409d
0x6df44092
0x00000000
0x6df4407e
0x6df44025
0x6df4402a
0x6df440d1
0x6df44030
0x6df44040
0x6df44040
0x6df44048
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df43ff9

APIs

DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,6E003933,RtlGetUserInfoHeap), ref: 6DFA03D9
DbgPrint.9419(HEAP: ,?,?,?,?,6E003933,RtlGetUserInfoHeap), ref: 6DFA03E6
DbgPrint.9419(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6E003933,RtlGetUserInfoHeap), ref: 6DFA03F9

Strings

Invalid address specified to %s( %p, %p ), xrefs: 6DFA03F4
HEAP: , xrefs: 6DFA03E1
HEAP[%wZ]: , xrefs: 6DFA03D4

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: 17dbe6e0cbc9e96cbe2dc243b0488a4be7ee6aac6310a6229d4445678bfe5fa0
Instruction ID: 9b9d1184972a4fbce45003daf0afb5504dae9561dc380903dbfa306097b6e4d3
Opcode Fuzzy Hash: 17dbe6e0cbc9e96cbe2dc243b0488a4be7ee6aac6310a6229d4445678bfe5fa0
Instruction Fuzzy Hash: 37410231218342CBEB25CF1ED4C177A7BA0AF06308F0CC469D5959B64BC7E698D5CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7CE6C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131
memoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DF7CE6C(void* __ecx, signed int __edx, signed short* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _t37;
				void* _t54;
				signed int* _t56;
				void* _t58;
				signed int _t59;
				void* _t60;
				intOrPtr _t66;
				signed int _t69;
				void* _t70;
				void* _t73;
				signed short* _t74;
				void* _t75;
				signed int* _t76;

				_t74 = _a4;
				_t54 = __ecx;
				_t37 = __edx;
				_t73 = 0;
				_v12 = __edx;
				if(__ecx == 0 || __edx < 1 || __edx >  *((intOrPtr*)(__ecx + 4))) {
					_t56 = _a8;
					goto L17;
				} else {
					if(_t74 == 0) {
						_t56 = _a8;
						L20:
						_v8 = _v8 & _t73;
						L21:
						if(_t74 == 0) {
							_v12 = _v12 & _t73;
						} else {
							_v12 =  *_t74 & 0x0000ffff;
						}
						if(_t54 == 0) {
							_t66 = 0;
						} else {
							_t66 =  *((intOrPtr*)(_t54 + 4));
						}
						_push(_t56);
						_push(_v8);
						_push(_v12);
						_push(_t74);
						_push(_t66);
						_push(_t37);
						_push(_t54);
						E6DFD5720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Map                    : %p\nSXS:  AssemblyRosterIndex    : 0x%lx\nSXS:  Map->AssemblyCount     : 0x%lx\nSXS:  StorageLocation        : %p\nSXS:  StorageLocation->Length: 0x%x\nSXS:  StorageLocation->Buffer: %p\nSXS:  OpenDirectoryHandle    : %p\n", "RtlpInsertAssemblyStorageMapEntry");
						_t75 = 0xc000000d;
						L12:
						if(_t73 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t73);
						}
						L13:
						return _t75;
					}
					_t69 =  *_t74 & 0x0000ffff;
					_t58 = 2;
					_t56 = _a8;
					if(_t69 < _t58 || _t74[2] == 0 || _t56 == 0) {
						L17:
						if(_t74 == 0) {
							goto L20;
						}
						_v8 = _t74[2];
						goto L21;
					} else {
						_t59 = _t69;
						if(_t59 + 2 > 0xfffe) {
							_t75 = 0xc0000106;
							goto L13;
						}
						_t73 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t59 + 0x12);
						if(_t73 == 0) {
							_t75 = 0xc0000017;
							goto L13;
						}
						 *_t73 =  *_t73 & 0x00000000;
						_t9 = _t73 + 0x10; // 0x10
						_t60 = _t9;
						 *(_t73 + 4) =  *_t74;
						 *(_t73 + 8) = _t60;
						_t70 = 2;
						 *((short*)(_t73 + 6)) =  *_t74 + _t70;
						memcpy(_t60, _t74[2],  *_t74 & 0x0000ffff);
						_t76 = _a8;
						 *((short*)( *(_t73 + 8) + (( *(_t73 + 4) & 0x0000ffff) >> 1) * 2)) = 0;
						 *(_t73 + 0xc) =  *_t76;
						asm("lock cmpxchg [edx], ecx");
						if(0 == 0) {
							_t73 = 0;
							 *_t76 =  *_t76 & 0;
						}
						_t75 = 0;
						goto L12;
					}
				}
			}

0x6df7ce76
0x6df7ce79
0x6df7ce7c
0x6df7ce7e
0x6df7ce80
0x6df7ce85
0x6dfbadcd
0x00000000
0x6df7ce9d
0x6df7ce9f
0x6dfbaddc
0x6dfbaddf
0x6dfbaddf
0x6dfbade2
0x6dfbade4
0x6dfbadee
0x6dfbade6
0x6dfbade9
0x6dfbade9
0x6dfbadf3
0x6dfbadfa
0x6dfbadf5
0x6dfbadf5
0x6dfbadf5
0x6dfbadfc
0x6dfbadfd
0x6dfbae00
0x6dfbae03
0x6dfbae04
0x6dfbae05
0x6dfbae06
0x6dfbae15
0x6dfbae1d
0x6df7cf50
0x6df7cf52
0x6dfbae34
0x6dfbae34
0x6df7cf59
0x6df7cf60
0x6df7cf60
0x6df7cea5
0x6df7ceaa
0x6df7ceae
0x6df7ceb1
0x6dfbadd0
0x6dfbadd2
0x00000000
0x00000000
0x6dfbadd7
0x00000000
0x6df7cec8
0x6df7cec8
0x6df7ced2
0x6dfbadc3
0x00000000
0x6dfbadc3
0x6df7ceeb
0x6df7ceef
0x6df7cf63
0x00000000
0x6df7cf63
0x6df7cef1
0x6df7cef4
0x6df7cef4
0x6df7cefa
0x6df7cf00
0x6df7cf06
0x6df7cf0a
0x6df7cf16
0x6df7cf27
0x6df7cf2c
0x6df7cf35
0x6df7cf42
0x6df7cf48
0x6df7cf4a
0x6df7cf4c
0x6df7cf4c
0x6df7cf4e
0x00000000
0x6df7cf4e
0x6df7ceb1

APIs

RtlAllocateHeap.9419(?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6DF7CEE6
memcpy.9419(00000010,?,00000000,?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6DF7CF16
DbgPrintEx.9419(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand,RtlpInsertAssemblyStorageMapEntry,00000040,?,00000000,00000000,00000000,00000002,?,00000040,00000000,?,?,00000000), ref: 6DFBAE15
RtlFreeHeap.9419(?,00000000,00000000,00000040,00000000,?,?,00000000,00000002), ref: 6DFBAE34

Strings

RtlpInsertAssemblyStorageMapEntry, xrefs: 6DFBAE07
SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand, xrefs: 6DFBAE0C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreePrintmemcpy
String ID: RtlpInsertAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand
API String ID: 3020890669-2104531740
Opcode ID: a8c5e40db0a7b20c4e68502911104b5107d4929146860ea96f90fadd47a76ba7
Instruction ID: 1d7006880c92e8214164524e0c2eb4d2576499fca4cfc30fadf977ab54da199b
Opcode Fuzzy Hash: a8c5e40db0a7b20c4e68502911104b5107d4929146860ea96f90fadd47a76ba7
Instruction Fuzzy Hash: C541E132600616ABD725CF5ED840EBAB3F5FF98B11F11806EE9998B640E771DD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF79ED0, Relevance: 10.6, APIs: 7, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6DF79ED0(signed int* __ecx, signed int __edx, intOrPtr _a4) {
				char _v12;
				signed int _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int* _v40;
				char _v41;
				char _v42;
				char _v45;
				char _v46;
				void* __ebx;
				void* __edi;
				signed int _t39;
				signed int _t66;
				char _t70;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				signed int _t93;
				signed int _t94;
				void* _t98;

				_push(_t66);
				_t88 =  *__ecx;
				_t70 = 0;
				_t93 = __ecx[1];
				_v40 = __ecx;
				_t39 = __edx;
				asm("cdq");
				_v41 = 0;
				_v42 = 0;
				_v36 = __edx;
				_v16 = __edx;
				L1:
				while(1) {
					if(_t70 != 0) {
						E6DF5FFB0(_t66, _t88, _v40 + 8);
						_v46 = 0;
						L15:
						_t39 = _v36;
						L3:
						_v32 = _t93;
						_v28 = _t88;
						asm("adc eax, esi");
						_t89 = _t88 ^ _t39 + _t88 ^ _t88;
						_t94 = _t93 ^ (_v16 ^ _t93) & 0x0fffffff;
						_t84 = _t94 & 0x0fffffff;
						if((_v32 & 0x80000000) != 0) {
							if((_t89 | _t84) != 0) {
								goto L4;
							}
							_t94 = _t94 & 0x7fffffff;
							_v42 = 1;
							E6DF62280(_v40 + 8, _v40 + 8);
							L5:
							_t66 = _t89;
							asm("lock cmpxchg8b [esi]");
							_t88 = _v28;
							_t93 = _v32;
							_t39 = _v36;
							if(_t88 != _v28 || _t93 != _v32) {
								_t70 = _v41;
								continue;
							} else {
								if(_v42 != 0) {
									_t54 = _v40;
									 *((intOrPtr*)(_v40 + 0xc)) = 0;
									E6DF5FFB0(_t66, _t88, _v40 + 8);
									_t39 = E6E018858( *((intOrPtr*)(_t54 + 0xc)));
								} else {
									if(_v41 != 0) {
										_t91 = _v40;
										_t98 = _v40 + 0xc;
										E6E018833(_t98,  &_v12);
										E6DF6FA00(_t66, _t98, _v40, _t91 + 8);
										_push(0);
										_push(_t98);
										_t39 = E6DF8B180();
									}
								}
								return _t39;
							}
						}
						L4:
						if(_a4 != 0) {
							if((_t89 | _t84) == 0) {
								goto L5;
							}
							_t94 = _t94 | 0x80000000;
							_v41 = 1;
							E6DF6FAD0(_v40 + 8);
						}
						goto L5;
					}
					if(_t70 != 0) {
						E6DF6FA00(_t66, _t70, _t88, _v40 + 8);
						_v45 = 0;
						goto L15;
					}
					goto L3;
				}
			}

0x6df79edf
0x6df79ee2
0x6df79ee4
0x6df79ee6
0x6df79ee9
0x6df79eed
0x6df79eef
0x6df79ef0
0x6df79ef4
0x6df79ef8
0x6df79efc
0x00000000
0x6df79f00
0x6df79f02
0x6dfb9836
0x6dfb983b
0x6dfb9854
0x6dfb9854
0x6df79f10
0x6df79f12
0x6df79f1c
0x6df79f20
0x6df79f26
0x6df79f31
0x6df79f3d
0x6df79f45
0x6dfb9861
0x00000000
0x00000000
0x6dfb986b
0x6dfb9874
0x6dfb987a
0x6df79f51
0x6df79f5b
0x6df79f61
0x6df79f65
0x6df79f67
0x6df79f69
0x6df79f71
0x6df79fa7
0x00000000
0x6df79f79
0x6df79f7e
0x6dfb98a1
0x6dfb98a8
0x6dfb98b3
0x6dfb98ba
0x6df79f84
0x6df79f89
0x6dfb98c4
0x6dfb98cc
0x6dfb98d1
0x6dfb98da
0x6dfb98df
0x6dfb98e1
0x6dfb98e2
0x6dfb98e2
0x6df79f89
0x6df79f95
0x6df79f95
0x6df79f71
0x6df79f4b
0x6df79f4f
0x6df79f9c
0x00000000
0x00000000
0x6dfb9888
0x6dfb9891
0x6dfb9897
0x6dfb9897
0x00000000
0x6df79f4f
0x6df79f0a
0x6dfb984a
0x6dfb984f
0x00000000
0x6dfb984f
0x00000000
0x6df79f0a

APIs

RtlReleaseSRWLockExclusive.9419(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6DFB9836
RtlReleaseSRWLockShared.9419(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6DFB984A
RtlAcquireSRWLockExclusive.9419(?), ref: 6DFB987A
RtlAcquireSRWLockShared.9419(?), ref: 6DFB9897
RtlReleaseSRWLockExclusive.9419(?), ref: 6DFB98B3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: b7a256f61759123d46d22e4545c41ef99df86f8558ebd7c331963c54a6fc41e1
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: A341907261C6828BC714CF2DD800B9BB7E5AFD5318F19894EF8949B241DA34ED0887E3

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4649B, Relevance: 10.6, APIs: 7, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6DF4649B(signed int __ecx, short* __edx) {
				signed int _v8;
				char _v40;
				void* _v80;
				short _v82;
				char _v84;
				long _v88;
				char _v92;
				void* _v96;
				void* _v98;
				void* _v100;
				void* _v104;
				void* _v106;
				void* _v108;
				void* _v112;
				void* _v120;
				void* _v122;
				void* _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t37;
				short _t41;
				void* _t43;
				short _t45;
				void* _t65;
				short* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				signed int _t77;
				signed int _t79;

				_t69 = __edx;
				_t79 = (_t77 & 0xfffffff8) - 0x5c;
				_v8 =  *0x6e03d360 ^ _t79;
				_t71 = __edx;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_v80 = 0;
				if(__edx == 0) {
					_t37 = 0xc000000d;
					L7:
					_pop(_t72);
					_pop(_t74);
					_pop(_t65);
					return E6DF8B640(_t37, _t65, _v8 ^ _t79, _t69, _t72, _t74);
				}
				_t75 = __ecx & 0x0000ffff;
				 *__edx = 0;
				_v80 =  &_v40;
				_t41 = 0x1e;
				_v82 = _t41;
				_t43 = E6DF54720(__edx, __ecx & 0x0000ffff,  &_v84, 2, 0);
				if(_t43 < 0) {
					if(_t43 == 0xc0000023) {
						_v80 = 0;
						_v82 = 0;
						_t43 = E6DF54720(__edx, _t75,  &_v84, 2, 1);
					}
					if(_t43 >= 0) {
						goto L2;
					} else {
						_t76 = 0xc000000d;
						L4:
						if(_v88 != _t79 + 0x24) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						if(_v88 != _t79 + 0x44) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						_t37 = _t76;
						goto L7;
					}
				}
				L2:
				_v88 = _t79 + 0x28;
				_t45 = 0x1e;
				 *((short*)(_t79 + 0x16)) = _t45;
				_t76 = E6DF52EB0(_t69, _v80,  &_v92, 6, 0);
				if(_t76 < 0) {
					if(_t76 == 0xc0000023) {
						_v88 = 0;
						 *((short*)(_t79 + 0x16)) = 0;
						_t76 = E6DF52EB0(_t69, _v80,  &_v92, 6, 1);
					}
					if(_t76 < 0) {
						goto L4;
					} else {
						goto L3;
					}
				}
				L3:
				if(0 != _v92) {
					_t76 = E6DF54570(_t69, _v88, _t79 + 0x24, 3);
					if(_t76 >= 0) {
						 *_t71 =  *((intOrPtr*)(_t79 + 0x20));
					}
				}
				goto L4;
			}

0x6df4649b
0x6df464a3
0x6df464ad
0x6df464b6
0x6df464b8
0x6df464bc
0x6df464c0
0x6df464c4
0x6df464ca
0x6dfa1905
0x6df46550
0x6df46554
0x6df46555
0x6df46556
0x6df46561
0x6df46561
0x6df464d2
0x6df464d5
0x6df464de
0x6df464e2
0x6df464e4
0x6df464f1
0x6df464f8
0x6dfa1914
0x6dfa1918
0x6dfa191e
0x6dfa192b
0x6dfa192b
0x6dfa1932
0x00000000
0x6dfa1938
0x6dfa1938
0x6df46532
0x6df4653a
0x6dfa1984
0x6dfa1984
0x6df46548
0x6dfa199c
0x6dfa199c
0x6df4654e
0x00000000
0x6df4654e
0x6dfa1932
0x6df464fe
0x6df46504
0x6df46508
0x6df4650a
0x6df4651f
0x6df46523
0x6dfa1948
0x6dfa194c
0x6dfa1952
0x6dfa1967
0x6dfa1967
0x6dfa196b
0x00000000
0x6dfa1971
0x00000000
0x6dfa1971
0x6dfa196b
0x6df46529
0x6df46530
0x6df46572
0x6df46576
0x6df4657d
0x6df4657d
0x6df46576
0x00000000

APIs

RtlLcidToLocaleName.9419(?,?,00000002,00000000), ref: 6DF464F1
RtlGetParentLocaleName.9419(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6DF4651A
RtlLocaleNameToLcid.9419(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6DF4656D
RtlLcidToLocaleName.9419(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6DFA192B
RtlGetParentLocaleName.9419(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6DFA1962

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: 8d36847b8d1273cb536c2860d5ab6dcfb984a2f98621a98f1989c2c3b258f120
Instruction ID: 273303ab2af64c1eb3261f68000117e6f4f40053faead62afd40f8f3f82dee37
Opcode Fuzzy Hash: 8d36847b8d1273cb536c2860d5ab6dcfb984a2f98621a98f1989c2c3b258f120
Instruction Fuzzy Hash: 694150325187469ED311CF68D840A9BB7E9FF88B58F01492AF994D7250E730DE548BD3

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD6365, Relevance: 10.6, APIs: 7, Instructions: 123
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6DFD6365(void* __ecx, wchar_t* __edx, signed short _a4, signed int* _a8, void** _a12, intOrPtr* _a16, char* _a20) {
				long _v8;
				wchar_t* _v12;
				int _v16;
				long _t30;
				void _t36;
				void _t39;
				intOrPtr* _t40;
				signed int* _t41;
				char* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				int _t52;
				void* _t53;
				intOrPtr _t56;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t64;
				long _t65;
				wchar_t* _t66;
				wchar_t* _t67;
				void* _t68;

				_t65 = _a4 & 0x0000ffff;
				_v12 = __edx;
				_t63 = __ecx;
				_t47 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t65);
				_t30 = 0;
				_v8 = 0;
				if(_t47 == 0) {
					_t64 = 0xc0000017;
					L8:
					if(_t47 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t30, _t47);
					}
					return _t64;
				}
				_push( &_v16);
				_push(_t65);
				_push(_t47);
				_push(2);
				_push(_t63);
				_push(0xffffffff);
				_t64 = E6DF89730();
				if(_t64 < 0) {
					L7:
					_t30 = 0;
					goto L8;
				}
				_t49 =  *(_t47 + 4);
				_t61 = _t49 + 2;
				do {
					_t36 =  *_t49;
					_t49 = _t49 + 2;
				} while (_t36 != _v8);
				_t52 = 2 + (_t49 - _t61 >> 1) * 2;
				_v16 = _t52;
				if(_t52 >= _t65) {
					_t64 = 0x80000005;
					goto L7;
				}
				_t66 = _v12;
				memcpy(_t66,  *(_t47 + 4), _t52);
				_t67 = wcsrchr(_t66, 0x5c);
				if(_t67 != 0) {
					_t68 = _t67 + 2;
					_t53 = _t68;
					_t15 = _t53 + 2; // 0x0
					_t62 = _t15;
					do {
						_t39 =  *_t53;
						_t53 = _t53 + 2;
					} while (_t39 != _v8);
					_t56 = (_t53 - _t62 >> 1) + (_t53 - _t62 >> 1);
					_v8 = _t56;
					if(_a12 == 0) {
						L17:
						_t40 = _a16;
						if(_t40 != 0) {
							 *_t40 = _t56;
						}
						_t41 = _a8;
						if(_t41 != 0) {
							 *_t41 = _t68 - _v12 & 0xfffffffe;
						}
						_t42 = _a20;
						if(_t42 != 0) {
							 *_t42 = 1;
						}
						goto L7;
					}
					_t19 = _t56 + 2; // -2
					_t45 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t19);
					 *_a12 = _t45;
					if(_t45 != 0) {
						memcpy(_t45, _t68, _v8 + 2);
						_t56 = _v8;
						goto L17;
					}
					_t64 = 0xc0000017;
					goto L7;
				}
				_t64 = 0xc0000039;
				goto L7;
			}

0x6dfd6375
0x6dfd6380
0x6dfd6383
0x6dfd638a
0x6dfd638c
0x6dfd638e
0x6dfd6393
0x6dfd64ab
0x6dfd63fc
0x6dfd63fe
0x6dfd640b
0x6dfd640b
0x6dfd6418
0x6dfd6418
0x6dfd639c
0x6dfd639d
0x6dfd639e
0x6dfd639f
0x6dfd63a1
0x6dfd63a2
0x6dfd63a9
0x6dfd63ad
0x6dfd63fa
0x6dfd63fa
0x00000000
0x6dfd63fa
0x6dfd63af
0x6dfd63b2
0x6dfd63b5
0x6dfd63b5
0x6dfd63b8
0x6dfd63bb
0x6dfd63c5
0x6dfd63cc
0x6dfd63d1
0x6dfd64a1
0x00000000
0x6dfd64a1
0x6dfd63d7
0x6dfd63df
0x6dfd63ec
0x6dfd63f3
0x6dfd641b
0x6dfd641e
0x6dfd6420
0x6dfd6420
0x6dfd6423
0x6dfd6423
0x6dfd6426
0x6dfd6429
0x6dfd6433
0x6dfd6439
0x6dfd643c
0x6dfd6476
0x6dfd6476
0x6dfd647b
0x6dfd647d
0x6dfd647d
0x6dfd647f
0x6dfd6484
0x6dfd648c
0x6dfd648c
0x6dfd648e
0x6dfd6493
0x6dfd6499
0x6dfd6499
0x00000000
0x6dfd6493
0x6dfd643e
0x6dfd644d
0x6dfd6455
0x6dfd6459
0x6dfd646b
0x6dfd6470
0x00000000
0x6dfd6473
0x6dfd645b
0x00000000
0x6dfd645b
0x6dfd63f5
0x00000000

APIs

RtlAllocateHeap.9419(?,00000008,?,00000000,?,00000000), ref: 6DFD6385
ZwQueryVirtualMemory.9419(000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6DFD63A4
memcpy.9419(?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6DFD63DF
wcsrchr.9419(?,0000005C,?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?), ref: 6DFD63E7
RtlFreeHeap.9419(?,00000000,00000000,?,00000008,?,00000000,?,00000000), ref: 6DFD640B
RtlAllocateHeap.9419(?,00000008,-00000002,00000008,?,00000000,?), ref: 6DFD644D
memcpy.9419(00000000,-00000002,?,00000000,?), ref: 6DFD646B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Allocatememcpy$FreeMemoryQueryVirtualwcsrchr
String ID:
API String ID: 58330029-0
Opcode ID: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction ID: 69bec46b0001117f604d438d66a4d8b4b06d59b812e5b3712fc7fe6c3dadf4e0
Opcode Fuzzy Hash: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction Fuzzy Hash: 5A41DB36A0014AEBDB15CF6C8850BAF3779EF85714F1A8168FA029B280DB31DE41C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF74020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
nativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DF74020(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				intOrPtr* _t43;
				char _t69;
				intOrPtr _t76;
				intOrPtr* _t78;

				_t78 = _a4;
				_t69 = 0;
				_t76 =  *[fs:0x30];
				_v32 = 0;
				_v28 = 0;
				_v12 = 0;
				 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(_t78 + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(_t78 + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				 *((intOrPtr*)(_t78 + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t43 =  *((intOrPtr*)(_t76 + 0x1f4));
				if(_t43 == 0 ||  *_t43 == 0) {
					 *((short*)(_t78 + 0x14)) = 0;
				} else {
					if(E6DF54921(_t78 + 0x14, 0x100, _t43) < 0) {
						 *((short*)(_t78 + 0x14)) = 0;
					}
					_t69 = 0;
				}
				if( *_t78 != 0x11c) {
					if( *_t78 != 0x124) {
						goto L10;
					}
					goto L4;
				} else {
					L4:
					 *((short*)(_t78 + 0x114)) =  *(_t76 + 0xaf) & 0x000000ff;
					 *(_t78 + 0x116) =  *(_t76 + 0xae) & 0x000000ff;
					 *(_t78 + 0x118) = E6DF74190();
					if( *_t78 == 0x124) {
						 *(_t78 + 0x11c) = E6DF74190() & 0x0001ffff;
					}
					 *((char*)(_t78 + 0x11a)) = _t69;
					if(E6DF74710( &_v16) != 0) {
						 *((char*)(_t78 + 0x11a)) = _v16;
					}
					RtlInitUnicodeString( &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
					_push( &_v24);
					_push(4);
					_push( &_v12);
					_push( &_v20);
					_push( &_v32);
					if(E6DF8A9B0() < 0) {
						L10:
						return 0;
					} else {
						if(_v12 == 1) {
							if(_v20 != 4 || _v24 != 4) {
								goto L9;
							} else {
								goto L10;
							}
						}
						L9:
						 *(_t78 + 0x118) =  *(_t78 + 0x118) & 0x0000ffef | 0x00000100;
						if( *_t78 == 0x124) {
							 *(_t78 + 0x11c) =  *(_t78 + 0x11c) & 0xfffdffef | 0x00000100;
						}
						goto L10;
					}
				}
			}

0x6df7402a
0x6df7402d
0x6df74030
0x6df7403c
0x6df7403f
0x6df74042
0x6df7404b
0x6df74054
0x6df7405e
0x6df74067
0x6df7406a
0x6df74072
0x6df7407f
0x6dfb63db
0x6dfb63e8
0x6dfb63ec
0x6dfb63ec
0x6dfb63f0
0x6dfb63f0
0x6df74089
0x6df7414e
0x00000000
0x00000000
0x00000000
0x6df7408f
0x6df7408f
0x6df7409b
0x6df740ac
0x6df740bd
0x6df740c6
0x6df7415f
0x6df7415f
0x6df740cf
0x6df740dd
0x6df740e2
0x6df740e2
0x6df740f1
0x6df740f9
0x6df740fa
0x6df740ff
0x6df74103
0x6df74107
0x6df7410f
0x6df7413f
0x6df74145
0x6df74111
0x6df74115
0x6dfb63fb
0x00000000
0x6dfb640b
0x00000000
0x6dfb640b
0x6dfb63fb
0x6df7411b
0x6df74132
0x6df7413b
0x6df74177
0x6df74177
0x00000000
0x6df7413b
0x6df7410f

APIs

RtlGetSuiteMask.9419(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DF740B3
RtlGetNtProductType.9419(?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DF740D6
RtlInitUnicodeString.9419(?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DF740F1
ZwQueryLicenseValue.9419(?,?,?,00000004,?,?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DF74108
RtlGetSuiteMask.9419(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DF74155

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 6DF740E8

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: MaskSuite$InitLicenseProductQueryStringTypeUnicodeValue
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 2592082795-996340685
Opcode ID: 0176a77eeb8a65e81743e1358fc50a8b1bafa66089877fd698b0c9db956fda0e
Instruction ID: e1ff8ac51e9c0ab8c7fbd1652fffccff49f8546a614212afc85178c596fcab23
Opcode Fuzzy Hash: 0176a77eeb8a65e81743e1358fc50a8b1bafa66089877fd698b0c9db956fda0e
Instruction Fuzzy Hash: 23418075A0474AAAC725EFB8D4406EAF7F8FF19304F00482FD6A9C7240E374A545CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5A3E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
nativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6DF5A3E0(struct _EXCEPTION_RECORD _a4) {
				signed int _v8;
				char _v88;
				intOrPtr _v92;
				short _v94;
				char _v96;
				void* _v100;
				char _v104;
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t39;
				void* _t44;
				void* _t45;
				short _t46;
				void* _t47;
				struct _EXCEPTION_RECORD _t48;
				signed int _t49;

				_v8 =  *0x6e03d360 ^ _t49;
				_t48 = _a4;
				_push( &_v104);
				_push(0x50);
				_push( &_v88);
				_push(1);
				_push(0xfffffffa);
				_t25 = E6DF89710();
				_t50 = _t25;
				if(_t25 >= 0 && E6DF5A4B0(_t50, _v88,  &_v100) >= 0) {
					_push(_t45);
					_t46 = _v100;
					 *_t48 = 0;
					 *((short*)(_t48 + 2)) = _t46 + 0x22;
					_t31 = E6DF63A1C(_t46 + 0x00000022 & 0x0000ffff);
					 *((intOrPtr*)(_t48 + 4)) = _t31;
					_t52 = _t31;
					if(_t31 == 0) {
						_t25 = 0xc0000017;
					} else {
						RtlAppendUnicodeToString(_t48, L"\\REGISTRY\\USER\\");
						_v96 = 0;
						_v94 = _t46;
						_v92 =  *((intOrPtr*)(_t48 + 4)) + (( *_t48 & 0x0000ffff) >> 1) * 2;
						_t47 = E6DF5A500(_t39, _t48, _t52,  &_v96, _v88, 0);
						if(_t47 < 0) {
							RtlFreeUnicodeString(_t48);
						} else {
							 *_t48 =  *_t48 + _v96;
						}
						_t25 = _t47;
					}
					_pop(_t45);
				}
				return E6DF8B640(_t25, _t39, _v8 ^ _t49, _t44, _t45, _t48);
			}

0x6df5a3ef
0x6df5a3f3
0x6df5a3f9
0x6df5a3fa
0x6df5a3ff
0x6df5a400
0x6df5a402
0x6df5a404
0x6df5a409
0x6df5a40b
0x6df5a41d
0x6df5a41e
0x6df5a423
0x6df5a429
0x6df5a431
0x6df5a436
0x6df5a439
0x6df5a43b
0x6df5a48f
0x6df5a43d
0x6df5a443
0x6df5a44d
0x6df5a45b
0x6df5a462
0x6df5a46e
0x6df5a472
0x6df5a497
0x6df5a474
0x6df5a478
0x6df5a478
0x6df5a47b
0x6df5a47b
0x6df5a47d
0x6df5a47d
0x6df5a48c

APIs

ZwQueryInformationToken.9419(000000FA,00000001,?,00000050,?,?), ref: 6DF5A404
RtlLengthSidAsUnicodeString.9419(?,?,000000FA,00000001,?,00000050,?,?), ref: 6DF5A414

Part of subcall function 6DF5A4B0: RtlValidSid.9419(?,?,?,6DF5A419,?,?,000000FA,00000001,?,00000050,?,?), ref: 6DF5A4BA

RtlFreeUnicodeString.9419(?,?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6DF5A497

Part of subcall function 6DF63A1C: RtlAllocateHeap.9419(?,00000000,00000000,?,6DF867C0,0000004E,00000000,?,6DFD83BE,?,?), ref: 6DF63A2F

RtlAppendUnicodeToString.9419(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6DF5A443

Part of subcall function 6DF5A990: memmove.9419(00000000,00000050,00000052,?,?,00000000,?,?,6DF5A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6DF5A9E2

RtlConvertSidToUnicodeString.9419(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6DF5A469

Part of subcall function 6DF5A500: RtlValidSid.9419(00000050,?), ref: 6DF5A523
Part of subcall function 6DF5A500: wcscpy_s.9419(?,00000100,S-1-,?,00000050,?), ref: 6DF5A54A

Strings

\REGISTRY\USER\, xrefs: 6DF5A43D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Valid$AllocateAppendConvertFreeHeapInformationLengthQueryTokenmemmovewcscpy_s
String ID: \REGISTRY\USER\
API String ID: 3017593230-2169711131
Opcode ID: dec2959a18f070e2321d9a59f862dfc082652df6b10135ced16bda92b56881ab
Instruction ID: ea92895adf76dad42125edf7ecd2a73e90ef286e296b8949b992a2e4cc793ff5
Opcode Fuzzy Hash: dec2959a18f070e2321d9a59f862dfc082652df6b10135ced16bda92b56881ab
Instruction Fuzzy Hash: EB21A431900249DADB10DFECC840DAEB3F8AF15304F11452AE945DB550EB34EE25C761

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6B8E4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6DF6B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0x6e038748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E6DF4B150();
						} else {
							E6DF4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E6DF4B150();
						__eflags =  *0x6e037bc8;
						if(__eflags == 0) {
							E6E002073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E6DF6AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}

0x6df6b8f0
0x6df6b8f2
0x6df6b8f4
0x6dfb2c4e
0x6dfb2c50
0x6dfb2c56
0x6dfb2c5c
0x6dfb2c60
0x6dfb2c7f
0x6dfb2c84
0x6dfb2c62
0x6dfb2c77
0x6dfb2c7c
0x6dfb2c8a
0x6dfb2c8f
0x6dfb2c94
0x6dfb2c9c
0x6dfb2ca5
0x6dfb2ca5
0x6dfb2c9c
0x6dfb2c50
0x6df6b8fa
0x6df6b902
0x6df6b921
0x6df6b921
0x6df6b924
0x6df6b924
0x6df6b927
0x00000000
0x00000000
0x6df6b929
0x6df6b92b
0x6df6b92d
0x6df6b940
0x00000000
0x6df6b940
0x6df6b932
0x6df6b932
0x00000000
0x6df6b932
0x00000000
0x6df6b904
0x6df6b904
0x6df6b90a
0x6df6b90c
0x6df6b916
0x6df6b919
0x6df6b915
0x6df6b915
0x6df6b91b
0x6df6b91b
0x00000000
0x6df6b910

APIs

DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,-00000020,?,6DF6B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6DFB2C77
DbgPrint.9419((ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size),?,-00000020,?,6DF6B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6DFB2C8F

Strings

(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 6DFB2C8A
HEAP: , xrefs: 6DFB2C7F
HEAP[%wZ]: , xrefs: 6DFB2C72

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 3558298466-2558761708
Opcode ID: f4f02bbd0f9dea1a242505fe57a9d5f9ee93d25719e43247372abb1acc414b45
Instruction ID: 250f83ccdf46d23b43b905300de4b3b4b6ce82012a35f67764e4e4af98e1cace
Opcode Fuzzy Hash: f4f02bbd0f9dea1a242505fe57a9d5f9ee93d25719e43247372abb1acc414b45
Instruction Fuzzy Hash: 3B11D3313185829BE729CB2DC480B3AB7B9FF41729F15C869F00ACB655D731D841C761

Uniqueness

Uniqueness Score: -1.00%

Function 6DF49240, Relevance: 10.6, APIs: 7, Instructions: 63
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DF49240(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x6e01f708);
				E6DF9D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E6DF895D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E6DF895D0();
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000,  *(_t65 + 0x10));
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000,  *(_t65 + 0x1c));
				E6DF62280(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000,  *(_t65 + 0x20)), 0x6e0386b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_push( *(_t66 + 0x14));
					E6DF895D0();
					_push( *(_t66 + 0x10));
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E6DF895D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E6DF49325();
					return E6DF9D0D1(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000, _t65));
				}
			}

0x6df49240
0x6df49242
0x6df49247
0x6df4924c
0x6df4924e
0x6df49255
0x6df49257
0x6df4925a
0x6df4925f
0x6df4925f
0x6df49266
0x6df49271
0x6df49276
0x6df49279
0x6df49295
0x6df492b1
0x6df492d7
0x6df492dc
0x6df492e0
0x6df492e6
0x6df492e8
0x6df492ee
0x6df49332
0x6df49333
0x6df49337
0x6df49338
0x6df4933a
0x6df4933d
0x6df49342
0x6df49345
0x6df49349
0x6df4934e
0x6df49352
0x6df49357
0x6df492f4
0x6df492f4
0x6df492f6
0x6df492f9
0x6df49300
0x6df49324
0x6df49324

APIs

ZwClose.9419(00000000,6E01F708,0000000C,6DF49219), ref: 6DF4925A
ZwClose.9419(00000000,6E01F708,0000000C,6DF49219), ref: 6DF49279
RtlFreeHeap.9419(?,?,?,00000000,6E01F708,0000000C,6DF49219), ref: 6DF49295
RtlFreeHeap.9419(?,?,00000000,?,?,?,00000000,6E01F708,0000000C,6DF49219), ref: 6DF492B1
RtlFreeHeap.9419(?,?,?,?,?,00000000,?,?,?,00000000,6E01F708,0000000C,6DF49219), ref: 6DF492CD
RtlAcquireSRWLockExclusive.9419(6E0386B4,?,?,?,?,?,00000000,?,?,?,00000000,6E01F708,0000000C,6DF49219), ref: 6DF492D7
RtlFreeHeap.9419(?,?,?,6E0386B4,?,?,?,?,?,00000000,?,?,?,00000000,6E01F708,0000000C), ref: 6DF4931A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$Close$AcquireExclusiveLock
String ID:
API String ID: 3557490396-0
Opcode ID: 610df829af1cd70d77be37ef67695e791fb78f31efc9705fbc4f5082f7eef7da
Instruction ID: 03e8b8932a6ea7b1c36e3a2d4d141a3a55ce30ba5e6cd8f5ffa973fe87b837be
Opcode Fuzzy Hash: 610df829af1cd70d77be37ef67695e791fb78f31efc9705fbc4f5082f7eef7da
Instruction Fuzzy Hash: 70214A31555A41EFC721DF68CA00F15B7B9FF09308F1645ACA20A8BAA2CB34E941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6E014015, Relevance: 10.5, APIs: 7, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6E014015(signed int __eax, void* __ecx) {
				void* __ebx;
				void* __edi;
				char _t10;
				void* _t18;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t32 = __ecx + 0x1c;
					E6DF62280(_t10, __ecx + 0x1c);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E6DF62280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x6e0386ac);
					L6DF4F900(0x6e0386d4, _t28);
					E6DF5FFB0(0x6e0386ac, _t28, 0x6e0386ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E6DF5FFB0(0, _t28, _t32);
					_t18 =  *(_t28 + 0x94);
					if(_t18 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t18);
					}
					_t10 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t28);
				}
				return _t10;
			}

0x6e01401a
0x6e01401e
0x6e014023
0x6e014028
0x6e014029
0x6e01402b
0x6e01402f
0x6e014043
0x6e014046
0x6e014051
0x6e014057
0x6e01405f
0x6e014062
0x6e014067
0x6e01406f
0x6e01407c
0x6e01407c
0x6e01408c
0x6e01408c
0x6e014097

APIs

RtlAcquireSRWLockExclusive.9419(00000001,?,000000A0,?,?,?,6DFB6D7C,00000001,00000001,00000000,?,?,6DF74E1B,0000000F), ref: 6E01402F
RtlAcquireSRWLockExclusive.9419(6E0386AC,00000001,?,000000A0,?,?,?,6DFB6D7C,00000001,00000001,00000000,?,?,6DF74E1B,0000000F), ref: 6E014046

Part of subcall function 6DF62280: RtlDllShutdownInProgress.9419(00000000), ref: 6DF622BA
Part of subcall function 6DF62280: ZwWaitForAlertByThreadId.9419(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6DF623A3

RtlRbRemoveNode.9419(6E0386D4,?,6E0386AC,00000001,?,000000A0,?,?,?,6DFB6D7C,00000001,00000001,00000000,?,?,6DF74E1B), ref: 6E014051
RtlReleaseSRWLockExclusive.9419(6E0386AC,6E0386D4,?,6E0386AC,00000001,?,000000A0,?,?,?,6DFB6D7C,00000001,00000001,00000000,?,?), ref: 6E014057
RtlReleaseSRWLockExclusive.9419(00000001,6E0386AC,6E0386D4,?,6E0386AC,00000001,?,000000A0,?,?,?,6DFB6D7C,00000001,00000001,00000000,?), ref: 6E014062
RtlFreeHeap.9419(?,00000000,?,00000001,6E0386AC,6E0386D4,?,6E0386AC,00000001,?,000000A0,?,?,?,6DFB6D7C,00000001), ref: 6E01407C
RtlFreeHeap.9419(?,00000000,?,00000001,6E0386AC,6E0386D4,?,6E0386AC,00000001,?,000000A0,?,?,?,6DFB6D7C,00000001), ref: 6E01408C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease$AlertNodeProgressRemoveShutdownThreadWait
String ID:
API String ID: 83280457-0
Opcode ID: ace78f1753d36282a9d1a6f8f49ad219ce9abfedb02a4cb036c06c0d56d2168b
Instruction ID: 32f860d13f3b51612678463fdf1ae0b8dc31590d1eed947c6fe2963278f33269
Opcode Fuzzy Hash: ace78f1753d36282a9d1a6f8f49ad219ce9abfedb02a4cb036c06c0d56d2168b
Instruction Fuzzy Hash: EB018F72605986BFD2519FADCD80E53B7ACEF45768B010269B60887E62CB38EC11C6F4

Uniqueness

Uniqueness Score: -1.00%

Function 6DFDFF10, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.9419(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6E0209B0,00000014,6DF5EBD8,?,?,?,00000000,?,6DF41E03,?), ref: 6DFDFF69
RtlDecodePointer.9419(6E0209B0,00000014,6DF5EBD8,?,?,?,00000000,?,6DF41E03,?,6DF41D6E,?), ref: 6DFDFF78
RtlRaiseStatus.9419(C0000264,6E0209B0,00000014,6DF5EBD8,?,?,?,00000000,?,6DF41E03,?,6DF41D6E,?), ref: 6DFDFF89
RtlDebugPrintTimes.9419(?,C0000264,6E0209B0,00000014,6DF5EBD8,?,?,?,00000000,?,6DF41E03,?,6DF41D6E,?), ref: 6DFDFF9A
RtlpNotOwnerCriticalSection.9419 ref: 6DFDFFB1

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6DFDFF60

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CriticalDebugDecodeOwnerPointerRaiseRtlpSectionStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 2675442896-1911121157
Opcode ID: 80a88dd49de8125a8bcdfefb233b10783346c354c4790144f30b3b84c9294999
Instruction ID: c5ea1410309ae811bc5b475660c9bf277ccd14a0f5b07a1e475850677824ad97
Opcode Fuzzy Hash: 80a88dd49de8125a8bcdfefb233b10783346c354c4790144f30b3b84c9294999
Instruction Fuzzy Hash: 301100719105C9EFDB92CF58CD44FA8B7B1FF09308F2A8154E6086B2A1C7399980CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7DA88, Relevance: 9.3, APIs: 6, Instructions: 253
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DF7DA88(void* __ebx, signed int __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t111;
				signed int _t116;
				void* _t120;
				signed int* _t124;
				signed int _t125;
				signed int* _t126;
				void* _t132;
				signed int* _t135;
				signed int _t140;
				intOrPtr _t148;
				signed int _t150;
				signed char _t158;
				signed int _t159;
				signed short* _t160;
				void* _t162;
				signed int _t166;
				signed short* _t167;
				void* _t168;
				signed int _t170;
				intOrPtr* _t171;
				signed int* _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t179;
				void* _t183;
				signed int _t185;
				signed int _t187;
				signed int _t188;
				signed int _t189;
				signed int _t190;
				void* _t191;

				_push(0x20);
				_push(0x6e020268);
				E6DF9D08C(__ebx, __edi, __esi);
				 *(_t191 - 0x1c) = __edx;
				 *(_t191 - 0x24) = __ecx;
				if(__ecx == 0) {
					L23:
					_t111 = 0;
					L22:
					return E6DF9D0D1(_t111);
				}
				_t158 =  *(_t191 + 0x14);
				if((_t158 & 0xffffffcc) != 0 || (_t158 & 0x00000003) == 3) {
					goto L23;
				} else {
					_t116 = _t158 & 0x00000001;
					 *(_t191 - 0x28) = _t116;
					if(_t116 != 0) {
						if(__edx != 0) {
							goto L4;
						} else {
							goto L23;
						}
					}
					L4:
					E6DF62280(_t116, 0x6e03861c);
					_t185 = 0;
					 *((intOrPtr*)(_t191 - 4)) = 0;
					_t187 = 0;
					while(1) {
						 *(_t191 - 0x20) = _t187;
						if(_t187 >=  *0x6e036da4) {
							break;
						}
						_t170 = _t187 << 5;
						 *(_t191 - 0x2c) = _t170;
						_t171 =  *0x6e036da0 + _t170;
						if( *((intOrPtr*)(_t171 + 4)) ==  *(_t191 - 0x24)) {
							if((_t158 & 0x00000002) != 0) {
								if( *((intOrPtr*)(_t171 + 8)) != _t185) {
									L21:
									 *((intOrPtr*)(_t191 - 4)) = 0xfffffffe;
									E6DF7DCE8();
									_t111 = 1;
									goto L22;
								}
							}
							if( *(_t191 - 0x28) == 0 ||  *(_t171 + 0x10) == 0) {
								goto L8;
							} else {
								_t148 =  *((intOrPtr*)(_t191 + 0x10));
								if(_t148 == 0 ||  *_t171 != _t148) {
									goto L8;
								} else {
									_t150 =  *( *(_t191 - 0x1c));
									if(_t150 == 0xffffffff) {
										L57:
										_t183 =  *0x6e036da0;
										_t190 =  *(_t191 - 0x2c);
										 *( *(_t191 - 0x1c)) =  *(_t190 + _t183 + 0x10);
										_t173 =  *(_t191 + 8);
										if(_t173 != 0) {
											 *_t173 =  *(_t190 + _t183 + 0x14);
										}
										goto L21;
									} else {
										if((_t158 & 0x00000020) == 0) {
											_push(_t150 & 0xfffffffc);
											_push(0xffffffff);
											E6DF897A0();
											_t174 =  *(_t191 + 8);
											if(_t174 != 0) {
												_push( *_t174);
												E6DF895D0();
											}
											goto L57;
										}
										if( *(_t171 + 0x10) == 0xffffffff) {
											 *(_t171 + 0x10) = _t185;
										}
										break;
									}
									L32:
									if((_t158 & 0x00000002) != 0) {
										if(_t167[4] != _t185) {
											goto L33;
										}
										_t167[4] =  *(_t191 + 0xc);
										_t167[0xe] =  *(_t191 + 0x18);
										goto L21;
									}
									L33:
									if((_t158 & 0x00000001) == 0 || _t167[8] != _t185) {
										L15:
										_t188 = _t188 + 1;
										while(1) {
											L13:
											 *(_t191 - 0x20) = _t188;
											if(_t188 >=  *0x6e036da4) {
												RtlImageNtHeader(_t176 & 0xfffffffc);
												if(_t120 != 0) {
													 *(_t191 - 0x2c) =  *(_t120 + 0x58);
													_t179 =  *0x6e036da4 << 5;
													_t162 =  *0x6e036da0;
													 *(_t179 + _t162 + 4) =  *(_t191 - 0x24);
													 *(_t179 + _t162 + 8) =  *(_t191 + 0xc);
													_t159 = _t158 & 0x00000001;
													if(_t159 != 0) {
														_t124 =  *(_t191 - 0x1c);
														if(_t124 == 0) {
															_t125 = _t185;
														} else {
															_t125 =  *_t124;
														}
														 *(_t179 + _t162 + 0x10) = _t125;
														_t126 =  *(_t191 + 8);
														if(_t126 != 0) {
															_t185 =  *_t126;
														}
														 *(_t179 + _t162 + 0x14) = _t185;
														 *(_t179 + _t162 + 0x18) =  *(_t191 + 0x1c);
													} else {
														 *(_t179 + _t162 + 0x10) = _t185;
														 *(_t179 + _t162 + 0x14) = _t185;
														 *(_t179 + _t162 + 0x18) = _t185;
													}
													 *((short*)(_t162 + _t179)) =  *((intOrPtr*)(_t191 + 0x10));
													 *(_t179 + _t162 + 0xc) =  *(_t191 - 0x2c);
													 *(_t179 + _t162 + 0x1c) =  *(_t191 + 0x18);
													if( *0x6e036db0 != 0) {
														if(_t159 != 0) {
															_t189 = _t188 << 5;
															if(E6DFD6652(_t162 + _t189, 1) >= 0 && ( *0x6e036db0 & 0x00000002) != 0) {
																_t132 =  *0x6e036da0;
																if( *((intOrPtr*)(_t189 + _t132 + 0x1c)) == 0xc0000019) {
																	 *( *(_t191 - 0x1c)) =  *(_t189 + _t132 + 0x10);
																}
															}
														}
													}
													 *0x6e036da4 =  *0x6e036da4 + 1;
												}
												goto L21;
											}
											_t166 = _t188 << 5;
											 *(_t191 - 0x2c) = _t166;
											_t167 =  *0x6e036da0 + _t166;
											if(_t167[2] == _t176) {
												goto L32;
											}
											goto L15;
										}
										goto L21;
									} else {
										_t120 =  *_t167 & 0x0000ffff;
										if(_t120 ==  *((intOrPtr*)(_t191 + 0x10)) || _t120 == 0) {
											_t160 =  *(_t191 - 0x1c);
											_t167[8] =  *_t160;
											_t135 =  *(_t191 + 8);
											if(_t135 != 0) {
												_t185 =  *_t135;
											}
											_t167[0xa] = _t185;
											 *_t167 =  *((intOrPtr*)(_t191 + 0x10));
											_t167[0xe] =  *(_t191 + 0x18);
											_t167[0xc] =  *(_t191 + 0x1c);
											if( *0x6e036db0 != 0 && E6DFD6652(_t167, 1) >= 0 && ( *0x6e036db0 & 0x00000002) != 0) {
												_t168 =  *0x6e036da0;
												_t140 =  *(_t191 - 0x2c);
												if( *((intOrPtr*)(_t140 + _t168 + 0x1c)) == 0xc0000019) {
													 *_t160 =  *(_t140 + _t168 + 0x10);
												}
											}
											goto L21;
										} else {
											goto L15;
										}
									}
								}
							}
						} else {
							if((_t158 & 0x00000010) != 0) {
								if( *0x6e036db0 != 0 &&  *((intOrPtr*)(_t171 + 0x14)) != 0 &&  *((intOrPtr*)(_t171 + 0x14)) != 0xffffffff) {
									E6DFD6652(_t171, 0);
								}
							}
							L8:
							_t187 = _t187 + 1;
							continue;
						}
					}
					if((_t158 & 0x00000010) != 0) {
						goto L21;
					}
					if( *0x6e036da0 == 0) {
						_t120 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x400);
						if(_t120 == 0) {
							goto L21;
						} else {
							 *0x6e036da0 = _t120;
							 *0x6e036da8 = 0x20;
							L12:
							_t188 = _t185;
							_t176 =  *(_t191 - 0x24);
							goto L13;
						}
					}
					_t120 =  *0x6e036da8;
					if( *0x6e036da4 >= _t120) {
						_t120 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *0x6e036da0, _t120 + 0x20 << 5);
						if(_t120 == 0) {
							goto L21;
						}
						 *0x6e036da0 = _t120;
						 *0x6e036da8 =  *0x6e036da8 + 0x20;
					}
					goto L12;
				}
			}

0x6df7da88
0x6df7da8a
0x6df7da8f
0x6df7da94
0x6df7da99
0x6df7da9e
0x6df7dbe5
0x6df7dbe5
0x6df7dbdd
0x6df7dbe2
0x6df7dbe2
0x6df7daa4
0x6df7daad
0x00000000
0x6df7dac0
0x6df7dac2
0x6df7dac5
0x6df7dac8
0x6df7dbeb
0x00000000
0x6df7dbf1
0x00000000
0x6df7dbf1
0x6df7dbeb
0x6df7dace
0x6df7dad3
0x6df7dad8
0x6df7dada
0x6df7dadd
0x6df7dadf
0x6df7dadf
0x6df7dae8
0x00000000
0x00000000
0x6df7daec
0x6df7daef
0x6df7daf2
0x6df7dafe
0x6df7dbf6
0x6dfbb245
0x6df7dbcf
0x6df7dbcf
0x6df7dbd6
0x6df7dbdb
0x00000000
0x6df7dbdb
0x6dfbb24b
0x6df7dc00
0x00000000
0x6df7dc10
0x6df7dc10
0x6df7dc17
0x00000000
0x6df7dc26
0x6dfbb253
0x6dfbb258
0x6dfbb28a
0x6dfbb28a
0x6dfbb290
0x6dfbb29a
0x6dfbb29c
0x6dfbb2a1
0x6dfbb2ab
0x6dfbb2ab
0x00000000
0x6dfbb25a
0x6dfbb25d
0x6dfbb274
0x6dfbb275
0x6dfbb277
0x6dfbb27c
0x6dfbb281
0x6dfbb283
0x6dfbb285
0x6dfbb285
0x00000000
0x6dfbb281
0x6dfbb263
0x6dfbb269
0x6dfbb269
0x00000000
0x6dfbb263
0x6df7dc2b
0x6df7dc2e
0x6dfbb318
0x00000000
0x00000000
0x6dfbb321
0x6dfbb327
0x00000000
0x6dfbb327
0x6df7dc34
0x6df7dc37
0x6df7db5e
0x6df7db5e
0x6df7db3c
0x6df7db3c
0x6df7db3c
0x6df7db45
0x6df7db65
0x6df7db6c
0x6df7db71
0x6df7db7a
0x6df7db7d
0x6df7db86
0x6df7db8d
0x6df7db91
0x6df7db94
0x6df7dcc2
0x6df7dcc7
0x6df7dcf3
0x6df7dcc9
0x6df7dcc9
0x6df7dcc9
0x6df7dccb
0x6df7dccf
0x6df7dcd4
0x6df7dcd6
0x6df7dcd6
0x6df7dcd8
0x6df7dcdf
0x6df7db9a
0x6df7db9a
0x6df7db9e
0x6df7dba2
0x6df7dba2
0x6df7dbaa
0x6df7dbb1
0x6df7dbb8
0x6df7dbc3
0x6dfbb36f
0x6dfbb375
0x6dfbb383
0x6dfbb396
0x6dfbb3a3
0x6dfbb3b0
0x6dfbb3b0
0x6dfbb3a3
0x6dfbb383
0x6dfbb36f
0x6df7dbc9
0x6df7dbc9
0x00000000
0x6df7db6c
0x6df7db49
0x6df7db4c
0x6df7db4f
0x6df7db58
0x00000000
0x00000000
0x00000000
0x6df7db58
0x00000000
0x6df7dc46
0x6df7dc46
0x6df7dc4d
0x6df7dc58
0x6df7dc5d
0x6df7dc60
0x6df7dc65
0x6df7dc67
0x6df7dc67
0x6df7dc69
0x6df7dc70
0x6df7dc76
0x6df7dc7c
0x6df7dc86
0x6dfbb34b
0x6dfbb351
0x6dfbb35c
0x6dfbb366
0x6dfbb366
0x6dfbb35c
0x00000000
0x00000000
0x00000000
0x00000000
0x6df7dc4d
0x6df7dc37
0x6df7dc17
0x6df7db04
0x6df7db07
0x6dfbb2b9
0x6dfbb2d5
0x6dfbb2d5
0x6dfbb2b9
0x6df7db0d
0x6df7db0d
0x00000000
0x6df7db0d
0x6df7dafe
0x6df7db13
0x00000000
0x00000000
0x6df7db20
0x6df7dca1
0x6df7dca8
0x00000000
0x6df7dcae
0x6df7dcae
0x6df7dcb3
0x6df7db37
0x6df7db37
0x6df7db39
0x00000000
0x6df7db39
0x6df7dca8
0x6df7db26
0x6df7db31
0x6dfbb2f7
0x6dfbb2fe
0x00000000
0x00000000
0x6dfbb304
0x6dfbb309
0x6dfbb309
0x00000000
0x6df7db31

APIs

RtlAcquireSRWLockExclusive.9419(6E03861C,6E020268,00000020,6DF5BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6DF7DAD3
RtlImageNtHeader.9419(00000001,6E03861C,6E020268,00000020,6DF5BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6DF7DB65
RtlAllocateHeap.9419(?,00000008,00000400,6E03861C,6E020268,00000020,6DF5BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?), ref: 6DF7DCA1

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireAllocateExclusiveHeaderHeapImageLock
String ID:
API String ID: 1783064793-0
Opcode ID: eb30833623cd8a1d5dfdd474787b7184f6c23eebf565fb9dbf9805f96515a10e
Instruction ID: b31f5873abee1a4c78c767122b3ea2092b4925a065ef11f681ad6211ddb963e6
Opcode Fuzzy Hash: eb30833623cd8a1d5dfdd474787b7184f6c23eebf565fb9dbf9805f96515a10e
Instruction Fuzzy Hash: 6DA1A174908606CFDF25CF6CE8807E9B7B0BF89369FA4455AD8689B291D371D842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF45AC0, Relevance: 9.2, APIs: 6, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DF45AC0(signed char _a4, long _a8, signed int _a12, void* _a16, void* _a20) {
				signed int _v8;
				void _v1036;
				char _v1037;
				char _v1038;
				signed int _v1044;
				long _v1048;
				char _v1052;
				signed int _v1056;
				void* _v1060;
				void* _v1064;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				signed int _t81;
				void* _t92;
				signed int _t111;
				signed char _t122;
				void* _t135;
				signed int _t136;
				void* _t144;
				long _t145;
				signed int _t147;

				_v8 =  *0x6e03d360 ^ _t147;
				_t76 = _a16;
				_t140 = _a12;
				_t145 = _a8;
				_v1064 = _t76;
				_t144 = _a20;
				_v1060 = _t144;
				if(_t145 == 0 || _t144 == 0 ||  *_t144 < 0 || _t140 < 0xffffffff ||  *_t144 > 0 && _t76 == 0) {
					L46:
					_t77 = 0xc000000d;
					goto L18;
				} else {
					_t122 = _a4;
					if((_t122 & 0xfffffff0) != 0) {
						goto L46;
					}
					if(_t140 == 0xffffffff) {
						_t140 = 0x203;
						if(E6DF5347D(_t145, 0x203,  &_v1056) < 0) {
							L23:
							_t77 = 0xc0000716;
							L18:
							return E6DF8B640(_t77, _t122, _v8 ^ _t147, _t140, _t144, _t145);
						}
						_t140 = _v1056 + 1;
					}
					_t81 =  *(_t145 + _t140 * 2 - 2) & 0x0000ffff;
					_v1044 = _t81;
					if(_t81 == 0) {
						_t140 = _t140 - 1;
					}
					_v1048 = 0x1ff;
					_v1056 = _t122 & 0x00000004;
					if(E6DF45C07(_t145, _t140,  &_v1036,  &_v1048, (_t122 >> 0x00000001 & 0 | (_t122 & 0x00000004) != 0x00000000) & 0x000000ff, _t122 >> 0x00000001 & 1,  &_v1038,  &_v1052) < 0) {
						goto L18;
					} else {
						_t145 = _v1048;
						if(_v1044 == 0) {
							if(_t145 >= 0x1ff) {
								goto L23;
							}
							_t92 = _t145 + _t145;
							_t145 = _t145 + 1;
							_v1048 = _t145;
							if(_t92 >= 0x3fe) {
								E6DF8B75A();
								L29:
								if(_v1056 == 0 || E6DFFB0D0( &_v1036, 1,  &_v1036, _v1052 -  &_v1036 >> 1,  &_v1037) >= 0 && _v1037 != 0) {
									_t140 = _v1052 -  &_v1036 >> 1;
									if(_t140 >= _t145 - (0 | _v1044 == 0x00000000)) {
										L13:
										_t135 = _v1064;
										if(_t135 == 0 ||  *_t144 == 0) {
											L17:
											 *_t144 = _t145;
											_t77 = 0;
											goto L18;
										} else {
											if(_t145 >  *_t144) {
												_t77 = 0xc0000023;
												goto L18;
											}
											memcpy(_t135,  &_v1036, _t145 + _t145);
											goto L17;
										}
									}
									_t145 = _t145 - (0 | _v1044 == 0x00000000) + 1 - _t140;
									_v1044 = _v1052 + 2;
									_t144 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t145);
									if(_t144 != 0) {
										_t140 = _v1044;
										_t136 = 0;
										if(_t145 <= 0) {
											L39:
											if(E6DFFB0D0(_t136, _t122, _t140, _t145,  &_v1037) < 0 || _v1037 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
												goto L23;
											} else {
												_t111 = 0;
												if(_t145 <= 0) {
													L45:
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
													_t145 = _v1048;
													_t144 = _v1060;
													goto L13;
												} else {
													goto L42;
												}
												do {
													L42:
													if( *((char*)(_t144 + _t111)) == 1) {
														_t140 = 0xffe0;
														 *((intOrPtr*)(_v1044 + _t111 * 2)) =  *((intOrPtr*)(_v1044 + _t111 * 2)) + 0xffe0;
													}
													_t111 = _t111 + 1;
												} while (_t111 < _t145);
												goto L45;
											}
										} else {
											goto L36;
										}
										do {
											L36:
											if(( *(_t140 + _t136 * 2) & 0x0000ffff) + 0xffffffbf <= 0x19) {
												 *(_t140 + _t136 * 2) =  *(_t140 + _t136 * 2) + 0x20;
												 *((char*)(_t144 + _t136)) = 1;
											}
											_t136 = _t136 + 1;
										} while (_t136 < _t145);
										goto L39;
									}
									_t77 = 0xc0000017;
									goto L18;
								} else {
									goto L23;
								}
							}
							 *((short*)(_t147 + _t92 - 0x408)) = 0;
						}
						if((_t122 & 0x00000008) != 0 || _v1038 != 0) {
							goto L13;
						} else {
							goto L29;
						}
					}
				}
			}

0x6df45ad2
0x6df45ad5
0x6df45ad8
0x6df45add
0x6df45ae0
0x6df45ae7
0x6df45aea
0x6df45af2
0x6dfa12e6
0x6dfa12e6
0x00000000
0x6df45b1f
0x6df45b1f
0x6df45b28
0x00000000
0x00000000
0x6df45b31
0x6dfa1142
0x6dfa1151
0x6dfa1170
0x6dfa1170
0x6df45bed
0x6df45bfd
0x6df45bfd
0x6dfa1159
0x6dfa1159
0x6df45b37
0x6df45b3e
0x6df45b47
0x6dfa117a
0x6dfa117a
0x6df45b53
0x6df45b70
0x6df45b9a
0x00000000
0x6df45b9c
0x6df45ba4
0x6df45baa
0x6dfa1186
0x00000000
0x00000000
0x6dfa1188
0x6dfa118b
0x6dfa118c
0x6dfa1197
0x6dfa11a8
0x6dfa11ad
0x6dfa11b4
0x6dfa11f5
0x6dfa1207
0x6df45bc2
0x6df45bc2
0x6df45bca
0x6df45be9
0x6df45be9
0x6df45beb
0x00000000
0x6df45bd1
0x6df45bd3
0x6df45c00
0x00000000
0x6df45c00
0x6df45be1
0x00000000
0x6df45be6
0x6df45bca
0x6dfa1225
0x6dfa1227
0x6dfa123e
0x6dfa1242
0x6dfa124e
0x6dfa1254
0x6dfa1258
0x6dfa1275
0x6dfa1291
0x6dfa116b
0x00000000
0x6dfa12a4
0x6dfa12a4
0x6dfa12a8
0x6dfa12c4
0x6dfa12d0
0x6dfa12d5
0x6dfa12db
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfa12aa
0x6dfa12aa
0x6dfa12ae
0x6dfa12b6
0x6dfa12bb
0x6dfa12bb
0x6dfa12bf
0x6dfa12c0
0x00000000
0x6dfa12aa
0x00000000
0x00000000
0x00000000
0x6dfa125a
0x6dfa125a
0x6dfa1265
0x6dfa1267
0x6dfa126c
0x6dfa126c
0x6dfa1270
0x6dfa1271
0x00000000
0x6dfa125a
0x6dfa1244
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfa11b4
0x6dfa119b
0x6dfa119b
0x6df45bb3
0x00000000
0x00000000
0x00000000
0x00000000
0x6df45bb3
0x6df45b9a

APIs

memcpy.9419(?,?,00000200,?,000001FF,?,?,?,?), ref: 6DF45BE1

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: a5e28beb08c6a27f51bc4cf8c0b0bbb582bc4dffd608b889b5379c45b261ed89
Instruction ID: 56215dbdb28dc15dc7be76d00f73b78d0fccf7cd44b67d70159ef1cd319361bd
Opcode Fuzzy Hash: a5e28beb08c6a27f51bc4cf8c0b0bbb582bc4dffd608b889b5379c45b261ed89
Instruction Fuzzy Hash: 3681D8B1A0412ADBDB21CA2CCD40BFA77B8EF45314F0585A9DA19E3281EB74DDC5CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6E012EF7, Relevance: 9.2, APIs: 6, Instructions: 183
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E6E012EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x6e03d360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E6DF8D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E6DF8D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E6DF62280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x6e03b1e0();
						 *( *(_t106 + 0x30) ^  *0x6e036110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x6e03b1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x6e036110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E6DF5FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E6DF8B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x6df2ac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x6df2ac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x6e012efc
0x6e012efd
0x6e012eff
0x6e012f03
0x6e012f0a
0x6e012f0c
0x6e012f15
0x6e012fba
0x6e012fbb
0x6e012fc5
0x6e012fcd
0x6e012fcf
0x6e012fd3
0x6e012fd4
0x6e012fd5
0x6e012fd7
0x6e012fda
0x6e012fdb
0x6e012fdd
0x6e012fe0
0x6e012fe2
0x6e012ffc
0x6e012fe4
0x6e012fe4
0x6e012fea
0x6e012fed
0x6e012fef
0x6e012ff6
0x6e012ff1
0x6e012ff1
0x6e012ff1
0x6e012fef
0x6e012fff
0x6e013001
0x6e01301b
0x6e013003
0x6e013003
0x6e01300e
0x6e013015
0x6e013010
0x6e013010
0x6e013010
0x6e013010
0x6e01300e
0x6e01302c
0x6e013035
0x6e01303c
0x6e013046
0x6e01304e
0x6e013056
0x6e01305a
0x6e01305e
0x6e013063
0x6e013067
0x6e01306b
0x6e01306f
0x6e013072
0x6e0130af
0x6e0130b5
0x6e0130c1
0x6e0130c9
0x6e0130c9
0x6e0130c9
0x00000000
0x6e013074
0x6e013081
0x6e013089
0x6e01308b
0x6e01308d
0x6e013093
0x6e01309a
0x6e0130ce
0x6e0130d1
0x6e0130d5
0x6e0130d5
0x6e0130d5
0x6e01308d
0x6e0130db
0x6e0130e6
0x6e0130e7
0x6e0130e8
0x6e0130e9
0x6e0130f3
0x6e012f27
0x6e012f29
0x6e012f2b
0x6e012f2d
0x6e012f36
0x6e012f3d
0x6e012f4c
0x6e012f58
0x6e012fad
0x6e012fb7
0x6e012fb7

APIs

_allshl.9419(?,00000000,00000000,00000000,?,?,?,?,6E00B632,?,00000000), ref: 6E01303C
_allshl.9419(?,00000000,00000000,00000000,?,?,?,?,6E00B632,?,00000000), ref: 6E013049
RtlAcquireSRWLockExclusive.9419(?,?,00000000,00000000,00000000,?,?,?,?,6E00B632,?,00000000), ref: 6E01305E
RtlDebugPrintTimes.9419(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6E013081
RtlDebugPrintTimes.9419(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6E0130AF
RtlReleaseSRWLockExclusive.9419(?), ref: 6E0130DB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: a7d2f2011049b789aca6d387de1c6abcfdbbf87fc1caff3bbccd67d9821d3fe4
Instruction ID: 1646d7dacba06b74e4d28627ac3324cfa230e8175e4813bfc74cfd19bc95f893
Opcode Fuzzy Hash: a7d2f2011049b789aca6d387de1c6abcfdbbf87fc1caff3bbccd67d9821d3fe4
Instruction Fuzzy Hash: 62511D326082558FC704CFAAC85056ABBE5FFCA321B46866DE894DB281DB34DD15CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4B171, Relevance: 9.2, APIs: 6, Instructions: 166
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6DF4B171(signed short __ebx, void* __ecx, void* __edx, void* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				int _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				void* _t106;
				void* _t110;
				int _t111;
				void* _t114;
				void* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x6e01f7a8);
				E6DF9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *(_t114 - 0x84) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E6DF9D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E6DF8D000(0x80);
						 *(_t114 - 0x18) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *(_t114 - 0x84);
						_t110 = _t106;
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						memcpy(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t108 + _t111;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *(_t114 - 0x5c) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E6DF9DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E6DF8B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E6DF8B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E6DF8E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E6DF8A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x6df4b171
0x6df4b171
0x6df4b171
0x6df4b171
0x6df4b171
0x6df4b176
0x6df4b17b
0x6df4b180
0x6df4b186
0x6df4b18f
0x6df4b198
0x6df4b1a4
0x6df4b1aa
0x6dfa4802
0x6dfa4802
0x6dfa4805
0x6dfa480c
0x6dfa480e
0x6df4b1d1
0x6df4b1d3
0x6df4b1de
0x6df4b1de
0x6dfa4817
0x6dfa481e
0x6dfa4820
0x6dfa4822
0x6dfa4822
0x6dfa4824
0x6dfa4824
0x6dfa482a
0x00000000
0x00000000
0x6dfa4835
0x6dfa483a
0x6dfa483d
0x6dfa483f
0x6dfa4842
0x6dfa4842
0x6dfa4842
0x6dfa4846
0x6dfa484c
0x6dfa484e
0x6dfa4851
0x6dfa4851
0x6dfa4853
0x6dfa4854
0x6dfa4854
0x6dfa4858
0x6dfa485a
0x6dfa485a
0x6dfa485d
0x6dfa485f
0x6dfa4861
0x6dfa4861
0x6dfa4866
0x6dfa486b
0x6dfa486e
0x6dfa4871
0x6dfa4876
0x6dfa4876
0x6dfa4878
0x6dfa487b
0x6dfa4884
0x6dfa4884
0x00000000
0x6dfa487d
0x6dfa487d
0x6dfa4882
0x6dfa4889
0x6dfa4889
0x6dfa488f
0x6dfa4891
0x6dfa48e0
0x6dfa48e2
0x6dfa48e4
0x6dfa48e4
0x6dfa48e7
0x6dfa48e7
0x6dfa48ed
0x6dfa48f4
0x6dfa48f6
0x6dfa4951
0x6dfa4951
0x6dfa4953
0x6dfa4953
0x6dfa4956
0x6dfa4956
0x6dfa4958
0x6dfa4959
0x6dfa4959
0x6dfa495d
0x6dfa495d
0x6dfa495f
0x6dfa495f
0x6dfa4965
0x6dfa4969
0x6dfa49ba
0x6dfa49ba
0x6dfa49c1
0x6dfa49c5
0x6dfa49cc
0x6dfa49d4
0x6dfa49d7
0x6dfa49da
0x6dfa49e4
0x6dfa49e5
0x6dfa49f3
0x6dfa4a02
0x00000000
0x6dfa4a02
0x6dfa4972
0x6dfa4974
0x00000000
0x00000000
0x6dfa4976
0x6dfa4979
0x6dfa4982
0x6dfa4983
0x6dfa4984
0x6dfa498b
0x6dfa498d
0x6dfa4991
0x6dfa4993
0x6dfa4999
0x6dfa499d
0x6dfa49a2
0x6dfa49a2
0x6dfa49a2
0x6dfa4999
0x6dfa49ac
0x00000000
0x6dfa49b3
0x6dfa48f8
0x6dfa48fe
0x00000000
0x00000000
0x00000000
0x6dfa48fe
0x6dfa4895
0x6dfa489c
0x6dfa48ad
0x6dfa48b2
0x6dfa48b5
0x6dfa48b7
0x6dfa48ba
0x6dfa48bc
0x6dfa48c6
0x6dfa48c6
0x6dfa48cb
0x6dfa48d1
0x6dfa48d4
0x6dfa48d8
0x6dfa48d8
0x00000000
0x6dfa48d8
0x6dfa48be
0x6dfa48c0
0x00000000
0x00000000
0x6dfa48c2
0x00000000
0x00000000
0x00000000
0x6dfa48c4
0x00000000
0x6dfa4882
0x6dfa487b
0x6dfa4904
0x6dfa4906
0x00000000
0x00000000
0x6dfa4908
0x6dfa490e
0x00000000
0x00000000
0x6dfa4910
0x6dfa4917
0x6dfa4917
0x00000000
0x6dfa4917
0x6df4b1ba
0x6dfa47f9
0x6dfa47fc
0x00000000
0x00000000
0x00000000
0x6dfa47fc
0x6df4b1c0
0x6df4b1c0
0x6df4b1c3
0x6df4b1cb
0x00000000
0x00000000
0x00000000

APIs

ZwQueryDebugFilterState.9419(?,6DF8B627,6E01F7A8,00000090,6DF4B16E,00000003,6DF8B627,0000000A,00000001,00000000,0000000A,6DF8B627,Invalid parameter passed to C runtime function.), ref: 6DF4B1C4
_alloca_probe_16.9419(6E01F7A8,00000090,6DF4B16E,00000003,6DF8B627,0000000A,00000001,00000000,0000000A,6DF8B627,Invalid parameter passed to C runtime function.), ref: 6DFA4835
memcpy.9419(?,?,?,6E01F7A8,00000090,6DF4B16E,00000003,6DF8B627,0000000A,00000001,00000000,0000000A,6DF8B627), ref: 6DFA4866
_vsnprintf.9419(?,-00000081,?,?,0000000A,6DF8B627), ref: 6DFA48AD
ZwWow64DebuggerCall.9419(00000001,00000000,7FFE02D4,?,6DF8B627,6E01F7A8,00000090,6DF4B16E,00000003,6DF8B627,0000000A,00000001,00000000,0000000A,6DF8B627,Invalid parameter passed to C runtime function.), ref: 6DFA4986

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebugDebuggerFilterQueryStateWow64_alloca_probe_16_vsnprintfmemcpy
String ID:
API String ID: 1346858437-0
Opcode ID: 0b2ad3bc5c5154792ac90bde7e3746af873481dcff32f04c304f6802aef14c13
Instruction ID: ba1619257973a1b2e211e1b8d33ea79c3fd1e62d3bf6d8d2cdf2b7f5cc3d6d2a
Opcode Fuzzy Hash: 0b2ad3bc5c5154792ac90bde7e3746af873481dcff32f04c304f6802aef14c13
Instruction Fuzzy Hash: DF511471D0425ACEDB21CF6CC840BAEBBB0BF49714F2581ADD86DAB282CB344D45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E01740D, Relevance: 9.1, APIs: 6, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6E01740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E6DF9D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E6DF8F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					memcpy(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x6e01740d
0x6e017412
0x6e017413
0x6e017416
0x6e017418
0x6e01741c
0x6e01741f
0x6e017422
0x6e017422
0x6e017428
0x6e01742a
0x6e01742a
0x6e017451
0x6e017432
0x6e01744f
0x6e01744f
0x00000000
0x6e017434
0x6e017438
0x6e017443
0x6e017517
0x6e017517
0x6e01751a
0x6e017535
0x6e017520
0x6e017527
0x6e01752c
0x6e017531
0x6e017533
0x00000000
0x6e017533
0x00000000
0x6e017531
0x6e01754b
0x6e01754f
0x6e01755c
0x6e01755c
0x6e01755f
0x6e017560
0x6e017561
0x6e017562
0x6e017563
0x6e017568
0x6e01756a
0x6e01756c
0x6e01756d
0x6e01756d
0x6e01756f
0x6e017572
0x6e017574
0x6e017577
0x6e01757c
0x6e01757f
0x00000000
0x6e017551
0x6e017551
0x6e017551
0x6e017553
0x6e017553
0x6e017449
0x6e017449
0x6e01744c
0x6e01744c
0x00000000
0x6e01744c
0x6e017443
0x6e01750e
0x6e017514
0x6e017514
0x6e017455
0x6e017469
0x6e01746d
0x00000000
0x6e017473
0x6e017473
0x6e017476
0x6e017480
0x6e017484
0x6e01748e
0x6e017493
0x6e017493
0x6e017496
0x6e017499
0x6e0174a1
0x6e0174b1
0x6e0174b5
0x00000000
0x6e0174bb
0x6e0174c1
0x6e0174c1
0x6e0174c4
0x6e0174c5
0x6e0174c6
0x6e0174c7
0x6e0174c8
0x6e0174cd
0x00000000
0x6e0174d3
0x6e0174d3
0x6e0174d6
0x6e0174d8
0x6e0174db
0x6e0174dd
0x6e0174e0
0x6e0174e7
0x6e0174ee
0x6e0174ee
0x6e0174f4
0x6e0174f9
0x00000000
0x6e0174fb
0x6e0174fb
0x6e0174fd
0x6e017500
0x6e017503
0x6e017505
0x6e017505
0x6e0174f9
0x00000000
0x6e0174cd
0x6e0174b5
0x00000000

APIs

RtlCompareMemory.9419(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6DFC14C4,0000000C,?,?,00000000,00000066,00000000), ref: 6E01743C
RtlAllocateHeap.9419(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6DFC14C4,0000000C,?,?,00000000,00000066,00000000), ref: 6E017464
memcpy.9419(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6DFC14C4,0000000C,?,?), ref: 6E017484
RtlAllocateHeap.9419(?,00000008,00000018,00000000,00000066,00000000), ref: 6E0174AC
memcmp.9419(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6DFC14C4,0000000C,?,?), ref: 6E017527
RtlAllocateHeap.9419(?,00000008,00000018,00000000,00000066,00000000), ref: 6E017546

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: 895fbab86b5d2eadad0cfaff1fa7973edc23d808d28e66988c672b30070708c6
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: 1F51AF71604606EFDB15CF98C580B86BBF5FF46304F19C0AAE9089F256E3B1E945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF50100, Relevance: 9.1, APIs: 6, Instructions: 122
nativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DF50100(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				char _t38;
				void* _t42;
				signed int* _t43;
				signed int _t44;
				signed int _t49;
				char _t59;
				intOrPtr* _t61;
				void* _t62;
				signed int _t65;
				intOrPtr _t67;
				signed int _t70;
				signed int _t72;
				void* _t73;

				_push(0x1c);
				_push(0x6e01f848);
				_t37 = E6DF9D08C(__ebx, __edi, __esi);
				_t59 = 0;
				 *((char*)(_t73 - 0x19)) = 0;
				if( *((intOrPtr*)(_t73 + 8)) == 0) {
					_t38 = 0;
					L7:
					return E6DF9D0D1(_t38);
				}
				E6DF62280(_t37, 0x6e03861c);
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t72 =  *0x6e036da4;
				if(_t72 == 0) {
					_t59 = 1;
					L26:
					 *((char*)(_t73 - 0x19)) = _t59;
					L6:
					 *(_t73 - 4) = 0xfffffffe;
					E6DF5021A();
					_t38 = _t59;
					goto L7;
				}
				_t70 = _t72;
				 *(_t73 - 0x24) = _t70;
				_t42 =  *0x6e036da0;
				 *(_t73 - 0x20) = _t42;
				while(_t70 > 0) {
					_t65 = _t70 << 5;
					if( *((intOrPtr*)(_t65 + _t42 - 0x1c)) ==  *((intOrPtr*)(_t73 + 8))) {
						_t61 = _t42 - 0x20 + _t65;
						 *((intOrPtr*)(_t73 - 0x28)) = _t61;
						_t14 = _t61 + 0x10; // 0x10f
						_t43 = _t14;
						 *(_t73 - 0x2c) = _t43;
						_t44 =  *_t43;
						if(_t44 == 0) {
							L21:
							_t62 =  *(_t73 - 0x20);
							L16:
							if(_t70 != _t72) {
								E6DF49FF0(_t70 - 1);
							}
							_t72 = _t72 - 1;
							 *0x6e036da4 = _t72;
							if(_t72 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t62);
								_t42 = 0;
								 *(_t73 - 0x20) = 0;
								 *0x6e036da0 = 0;
								 *0x6e036da8 =  *0x6e036da8 & 0;
								L32:
								_t70 =  *(_t73 - 0x24);
								_t72 =  *0x6e036da4;
								L20:
								_t59 = 1;
								 *((char*)(_t73 - 0x19)) = 1;
								goto L5;
							}
							_t49 =  *0x6e036da8 + 0xffffffe0;
							if(_t72 < _t49) {
								_t42 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t62, _t49 << 5);
								 *(_t73 - 0x20) = _t42;
								if(_t42 != 0) {
									 *0x6e036da0 = _t42;
									 *0x6e036da8 =  *0x6e036da8 - 0x20;
									goto L32;
								}
								_t59 = 0;
								goto L26;
							}
							_t42 =  *(_t73 - 0x20);
							goto L20;
						}
						_t67 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t67 != 0) {
							if(_t67 !=  *_t61) {
								goto L21;
							}
						}
						if(_t44 == 0xffffffff) {
							goto L21;
						}
						_push(_t44 & 0xfffffffc);
						if( *((intOrPtr*)(_t61 + 0x1c)) == 0xc0000019) {
							_push(0);
							RtlFreeHeap( *( *[fs:0x30] + 0x18));
							_t70 =  *(_t73 - 0x24);
							_t61 =  *((intOrPtr*)(_t73 - 0x28));
						} else {
							_push(0xffffffff);
							E6DF897A0();
						}
						if( *(_t61 + 0x14) != 0) {
							_push( *(_t61 + 0x14));
							E6DF895D0();
							 *(_t61 + 0x14) =  *(_t61 + 0x14) & 0x00000000;
						}
						 *( *(_t73 - 0x2c)) =  *( *(_t73 - 0x2c)) & 0x00000000;
						_t72 =  *0x6e036da4;
						_t62 =  *0x6e036da0;
						 *(_t73 - 0x20) = _t62;
						goto L16;
					}
					L5:
					_t70 = _t70 - 1;
					 *(_t73 - 0x24) = _t70;
				}
				goto L6;
			}

0x6df50100
0x6df50102
0x6df50107
0x6df5010c
0x6df5010e
0x6df50115
0x6dfa6127
0x6df5016a
0x6df5016f
0x6df5016f
0x6df50120
0x6df50125
0x6df50129
0x6df50131
0x6dfa612e
0x6dfa6134
0x6dfa6134
0x6df5015c
0x6df5015c
0x6df50163
0x6df50168
0x00000000
0x6df50168
0x6df50137
0x6df50139
0x6df5013c
0x6df50141
0x6df50144
0x6df5014a
0x6df50154
0x6df50175
0x6df50177
0x6df5017a
0x6df5017a
0x6df5017d
0x6df50180
0x6df50184
0x6df5020b
0x6df5020b
0x6df501db
0x6df501dd
0x6df50213
0x6df50213
0x6df501df
0x6df501e2
0x6df501e8
0x6dfa6171
0x6dfa6176
0x6dfa6178
0x6dfa617b
0x6dfa6180
0x6dfa6194
0x6dfa6194
0x6dfa6197
0x6df50201
0x6df50201
0x6df50203
0x00000000
0x6df50203
0x6df501f3
0x6df501f8
0x6dfa61b2
0x6dfa61b7
0x6dfa61bc
0x6dfa6188
0x6dfa618d
0x00000000
0x6dfa618d
0x6dfa6132
0x00000000
0x6dfa6132
0x6df501fe
0x00000000
0x6df501fe
0x6df5018a
0x6df50191
0x6dfa613f
0x00000000
0x00000000
0x6dfa6145
0x6df5019a
0x00000000
0x00000000
0x6df5019f
0x6df501a7
0x6dfa614a
0x6dfa6155
0x6dfa615a
0x6dfa615d
0x6df501ad
0x6df501ad
0x6df501af
0x6df501af
0x6df501b8
0x6df501ba
0x6df501bd
0x6df501c2
0x6df501c2
0x6df501c9
0x6df501cc
0x6df501d2
0x6df501d8
0x00000000
0x6df501d8
0x6df50156
0x6df50156
0x6df50157
0x6df50157
0x00000000

APIs

RtlAcquireSRWLockExclusive.9419(6E03861C,6E01F848,0000001C,6DF4F66C,?,00000000,6E0352D8), ref: 6DF50120
ZwUnmapViewOfSection.9419(000000FF,?,6E03861C,6E01F848,0000001C,6DF4F66C,?,00000000,6E0352D8), ref: 6DF501AF
ZwClose.9419(?,000000FF,?,6E03861C,6E01F848,0000001C,6DF4F66C,?,00000000,6E0352D8), ref: 6DF501BD

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLockSectionUnmapView
String ID:
API String ID: 1629747488-0
Opcode ID: 97a1ca53be454f7ec6ee8c9ab30cd831918b12789e41b05a5a382ffc89892b57
Instruction ID: a0aaee1fb7a7da568f37b2b2ef49a3d546c899d5d31f499caee92178f93d61bb
Opcode Fuzzy Hash: 97a1ca53be454f7ec6ee8c9ab30cd831918b12789e41b05a5a382ffc89892b57
Instruction Fuzzy Hash: 4941E232959606EFCF51CFACC9907AA7BB0FF16719F154115E820AB292D3748950CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFC5623, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DFC5623(signed int __edx) {
				void* _t21;
				signed int _t22;
				void* _t23;
				signed int _t24;
				intOrPtr _t26;
				signed int _t27;
				signed char* _t39;
				signed int _t45;
				signed int _t51;
				signed int _t54;
				signed int _t63;

				_t51 = __edx;
				_t21 = E6DF67D50();
				_t45 = 0x7ffe0384;
				if(_t21 == 0) {
					_t22 = 0x7ffe0384;
				} else {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				_t54 = 0x7ffe0385;
				if( *_t22 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6DF67D50() == 0) {
						_t39 = 0x7ffe0385;
					} else {
						_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t39 & 0x00000020) != 0) {
						_t51 = _t51 | 0xffffffff;
						_t63 = _t51;
						L6DFC7016(0x1480, _t51, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				_t23 = E6DF76900(_t63, 0x6e035350);
				_t24 = E6DF67D50();
				if(_t23 == 0) {
					__eflags = _t24;
					if(_t24 != 0) {
						_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						__eflags = _t45;
					}
					__eflags =  *_t45;
					if( *_t45 != 0) {
						_t26 =  *[fs:0x30];
						__eflags =  *(_t26 + 0x240) & 0x00000004;
						if(( *(_t26 + 0x240) & 0x00000004) != 0) {
							_t27 = E6DF67D50();
							__eflags = _t27;
							if(_t27 != 0) {
								_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								__eflags = _t54;
							}
							__eflags =  *_t54 & 0x00000020;
							if(( *_t54 & 0x00000020) != 0) {
								__eflags = _t51 | 0xffffffff;
								L6DFC7016(0x1482, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					__eflags = 0;
					return 0;
				}
				if(_t24 != 0) {
					_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t45 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6DF67D50() != 0) {
						_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t54 & 0x00000020) != 0) {
						L6DFC7016(0x1481, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				return 1;
			}

0x6dfc5623
0x6dfc5628
0x6dfc562d
0x6dfc5634
0x6dfc5646
0x6dfc5636
0x6dfc563f
0x6dfc563f
0x6dfc564b
0x6dfc5650
0x6dfc5668
0x6dfc567a
0x6dfc566a
0x6dfc5673
0x6dfc5673
0x6dfc567f
0x6dfc5689
0x6dfc5689
0x6dfc5691
0x6dfc5691
0x6dfc567f
0x6dfc569b
0x6dfc56a2
0x6dfc56a9
0x6dfc5708
0x6dfc570a
0x6dfc5715
0x6dfc5715
0x6dfc5715
0x6dfc571b
0x6dfc571e
0x6dfc5720
0x6dfc5726
0x6dfc572d
0x6dfc572f
0x6dfc5734
0x6dfc5736
0x6dfc5741
0x6dfc5741
0x6dfc5741
0x6dfc5747
0x6dfc574a
0x6dfc5754
0x6dfc575c
0x6dfc575c
0x6dfc574a
0x6dfc572d
0x6dfc5761
0x00000000
0x6dfc5761
0x6dfc56ad
0x6dfc56b8
0x6dfc56b8
0x6dfc56c1
0x6dfc56d9
0x6dfc56e4
0x6dfc56e4
0x6dfc56ed
0x6dfc56ff
0x6dfc56ff
0x6dfc56ed
0x00000000

APIs

RtlGetCurrentServiceSessionId.9419(00000000,00000002,?,6DFBE4BC,6E0203D0,0000000C,6DFB9687,00000000,00000000,00000001,?,?,7FFE0386,?,6DF46778,00000001), ref: 6DFC5628
RtlGetCurrentServiceSessionId.9419 ref: 6DFC5661
RtlTryEnterCriticalSection.9419(6E035350,00000000,00000002,?,6DFBE4BC,6E0203D0,0000000C,6DFB9687,00000000,00000000,00000001,?,?,7FFE0386,?,6DF46778), ref: 6DFC569B
RtlGetCurrentServiceSessionId.9419(6E035350,00000000,00000002,?,6DFBE4BC,6E0203D0,0000000C,6DFB9687,00000000,00000000,00000001,?,?,7FFE0386,?,6DF46778), ref: 6DFC56A2
RtlGetCurrentServiceSessionId.9419 ref: 6DFC56D2
RtlGetCurrentServiceSessionId.9419 ref: 6DFC572F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 95e9dbc85c2388c8872ed4091dcb6040d97e3298bdc08cedcb6455cb90343c00
Instruction ID: 3f7872671fb4bce5e5b94b56d0ac414c6e486e9684d5ac63944e52ae5e28fa23
Opcode Fuzzy Hash: 95e9dbc85c2388c8872ed4091dcb6040d97e3298bdc08cedcb6455cb90343c00
Instruction Fuzzy Hash: 053198317597839BF712876CDD54F3637D4AF41768F2907A0EA308B7E2DB689860C612

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF3D40, Relevance: 9.1, APIs: 6, Instructions: 98
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6DFF3D40(intOrPtr __ecx, void** __edx) {
				signed int _v8;
				void** _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				void* _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t34;
				void* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				void** _t55;
				void _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				void** _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x6e03d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E6DF62280(_t34, 0x6e038a6c);
				_t64 =  *0x6e035768; // 0x6e035768
				if(_t64 != 0x6e035768) {
					while(1) {
						_t8 = _t64 + 8; // 0x6e035770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E6DF5FFB0(_t53, _t64, 0x6e038a6c);
						_t10 = _t64 + 0xc; // 0x6df3e2b8
						 *0x6e03b1e0(_v24, _t67);
						if( *((intOrPtr*)( *_t10))() != 0) {
							_v37 = 1;
						}
						E6DF62280(_t45, 0x6e038a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t15 = _t53 + 4; // 0x6e035768
							_t48 =  *_t15;
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x6e035768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E6DF5FFB0(_t51, _t64, 0x6e038a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E6DF8B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x6dff3d40
0x6dff3d48
0x6dff3d52
0x6dff3d59
0x6dff3d5d
0x6dff3d61
0x6dff3d63
0x6dff3d67
0x6dff3d69
0x6dff3d72
0x6dff3d76
0x6dff3d7a
0x6dff3d7f
0x6dff3d8b
0x6dff3d91
0x6dff3d91
0x6dff3d91
0x6dff3d94
0x6dff3d96
0x6dff3d9d
0x6dff3da1
0x6dff3da7
0x6dff3db0
0x6dff3dba
0x6dff3dbc
0x6dff3dbc
0x6dff3dc6
0x6dff3dcb
0x6dff3dcf
0x6dff3dd1
0x6dff3dd4
0x00000000
0x00000000
0x6dff3dd9
0x6dff3e0c
0x6dff3e0c
0x6dff3e0f
0x6dff3ddb
0x6dff3ddb
0x6dff3ddb
0x6dff3de0
0x00000000
0x6dff3de2
0x6dff3de2
0x6dff3de4
0x6dff3de8
0x6dff3deb
0x6dff3df1
0x00000000
0x6dff3df3
0x6dff3df3
0x6dff3df5
0x6dff3df8
0x6dff3dfa
0x00000000
0x6dff3dfa
0x6dff3df1
0x6dff3de0
0x6dff3e11
0x6dff3e11
0x00000000
0x6dff3dfe
0x6dff3e04
0x6dff3e06
0x00000000
0x6dff3e06
0x00000000
0x6dff3e04
0x6dff3d91
0x6dff3e15
0x6dff3e1a
0x6dff3e1f
0x6dff3e1f
0x6dff3e23
0x6dff3e29
0x00000000
0x00000000
0x6dff3e2e
0x00000000
0x6dff3e30
0x6dff3e30
0x6dff3e35
0x00000000
0x6dff3e37
0x6dff3e3e
0x6dff3e42
0x6dff3e48
0x6dff3e4e
0x00000000
0x6dff3e4e
0x6dff3e35
0x00000000
0x6dff3e2e
0x6dff3e5b
0x6dff3e5c
0x6dff3e5d
0x6dff3e68
0x00000000

APIs

RtlAcquireSRWLockExclusive.9419(6E038A6C,?,00000000,00000000,?,?,?,?,?,?,6DFF3CAA,00000000,00008000,?), ref: 6DFF3D7A
RtlReleaseSRWLockExclusive.9419(6E038A6C,6E038A6C,?,00000000,00000000,?,?,?,?,?,?,6DFF3CAA,00000000,00008000,?), ref: 6DFF3DA1
RtlDebugPrintTimes.9419(?,?,6E038A6C,6E038A6C,?,00000000,00000000,?,?,?,?,?,?,6DFF3CAA,00000000,00008000), ref: 6DFF3DB0
RtlAcquireSRWLockExclusive.9419(6E038A6C,?,?,?,?,?,?,6DFF3CAA,00000000,00008000,?), ref: 6DFF3DC6
RtlReleaseSRWLockExclusive.9419(6E038A6C,6E038A6C,?,00000000,00000000,?,?,?,?,?,?,6DFF3CAA,00000000,00008000,?), ref: 6DFF3E1A
RtlFreeHeap.9419(?,00000000,6E038A6C,6E038A6C,6E038A6C,6E038A6C,?,00000000,00000000,?,?,?,?,?,?,6DFF3CAA), ref: 6DFF3E4E

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$DebugFreeHeapPrintTimes
String ID:
API String ID: 1017367878-0
Opcode ID: 943f1cdca3e26f96bc928a54f5b941b1ebcb9f02d916c12d35975706aaabaeaf
Instruction ID: 264c6ea0026fed7557a49dba4776f90f6d624117a4834fdf96037577d285781c
Opcode Fuzzy Hash: 943f1cdca3e26f96bc928a54f5b941b1ebcb9f02d916c12d35975706aaabaeaf
Instruction Fuzzy Hash: 8F3148B1509742DFC710CF58D58095ABBE1FF85704F4589AEE8989B361D730DD0ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E00A189, Relevance: 9.1, APIs: 6, Instructions: 96
nativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E00A189(signed int __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* __ebx;
				void* __edi;
				intOrPtr _t29;
				void** _t30;
				intOrPtr _t40;
				void* _t44;
				signed int _t50;
				void* _t51;
				intOrPtr _t52;

				_v20 = __edx;
				_t50 = __ecx;
				if(__edx != 0) {
					E6DF62280(__edx, 0x6e036220);
					_t42 = _t50;
					_t40 = E6E00A166(_t50);
					if(_t40 != 0) {
						L15:
						E6DF5FFB0(_t40, _t50, 0x6e036220);
						 *_v20 = _t40;
						return 0;
					}
					_t44 = E6E00A166(_t42 ^ 0x00000100);
					if(_t44 != 0) {
						_v12 =  *((intOrPtr*)(_t44 + 4));
						_v8 =  *((intOrPtr*)(_t44 + 8));
						L7:
						_t51 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0x50);
						if(_t51 != 0) {
							_t10 = _t51 + 0xc; // 0xc
							_t40 = _t10;
							_t29 = E6DFFA708(_t50, _v12, _v8, _t40);
							_v16 = _t29;
							if(_t29 >= 0) {
								 *(_t51 + 8) = _t50;
								_t30 =  *0x6e0353d4; // 0x6e0353d0
								if( *_t30 != 0x6e0353d0) {
									0x6e0353d0 = 3;
									asm("int 0x29");
								}
								 *_t51 = 0x6e0353d0;
								 *(_t51 + 4) = _t30;
								 *_t30 = _t51;
								 *0x6e0353d4 = _t51;
								goto L15;
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t51);
							_t52 = _v16;
							L11:
							E6DF5FFB0(_t40, _t50, 0x6e036220);
							return _t52;
						}
						_t52 = 0xc0000017;
						goto L11;
					}
					_push( &_v8);
					_push( &_v12);
					_push(_t44);
					_push(_t50 & 0xfffffeff);
					_push(0xc);
					_t52 = E6DF8A420();
					if(_t52 >= 0) {
						goto L7;
					}
					goto L11;
				}
				return 0xc00000f0;
			}

0x6e00a194
0x6e00a199
0x6e00a19d
0x6e00a1ae
0x6e00a1b3
0x6e00a1ba
0x6e00a1be
0x6e00a27e
0x6e00a283
0x6e00a28b
0x00000000
0x6e00a28d
0x6e00a1cf
0x6e00a1d3
0x6e00a1f8
0x6e00a1fe
0x6e00a201
0x6e00a213
0x6e00a217
0x6e00a223
0x6e00a223
0x6e00a22c
0x6e00a231
0x6e00a236
0x6e00a25b
0x6e00a263
0x6e00a26a
0x6e00a26e
0x6e00a26f
0x6e00a26f
0x6e00a271
0x6e00a273
0x6e00a276
0x6e00a278
0x00000000
0x6e00a278
0x6e00a245
0x6e00a24a
0x6e00a24d
0x6e00a252
0x00000000
0x6e00a257
0x6e00a219
0x00000000
0x6e00a219
0x6e00a1d8
0x6e00a1dc
0x6e00a1dd
0x6e00a1e5
0x6e00a1e6
0x6e00a1ed
0x6e00a1f1
0x00000000
0x00000000
0x00000000
0x6e00a1f3
0x00000000

APIs

RtlAcquireSRWLockExclusive.9419(6E036220,00000000,?,?,?), ref: 6E00A1AE
ZwGetNlsSectionPtr.9419(0000000C,?,00000000,?,?,6E036220,00000000,?,?,?), ref: 6E00A1E8
RtlReleaseSRWLockExclusive.9419(6E036220,?,00000000,00000000,?,0000000C,?,00000000,00000050,6E036220,00000000,?,?,?), ref: 6E00A252

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSection
String ID:
API String ID: 1496884002-0
Opcode ID: 16bf659a482cbf854a473c9618967cdd1b5da1a049db08d2743f350e4e3ae286
Instruction ID: 025ab22411b0aba0d4acbd02234557fead9af259e553501a30f9cf113566ffb8
Opcode Fuzzy Hash: 16bf659a482cbf854a473c9618967cdd1b5da1a049db08d2743f350e4e3ae286
Instruction Fuzzy Hash: A431F131A08606AFE7118FDDD850B9EBBF8AF55314F2100B9E604EB350DB71DD008790

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4F7C0, Relevance: 9.1, APIs: 6, Instructions: 64
nativeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6DF4F7C0(void* __ecx, signed char _a4, signed short _a8, intOrPtr* _a12) {
				void* __ebx;
				void* __edi;
				void* _t16;
				signed char _t29;
				intOrPtr* _t37;
				signed int _t39;

				_t39 = _a8 & 0x0000ffff;
				if(_t39 == 0) {
					L13:
					E6DF4CC50(6);
					_t16 = 6;
					return _t16;
				}
				_t29 = _a4;
				if((_t29 & 0x00000001) != 0) {
					goto L13;
				}
				_t5 = _t29 + 0x34; // 0x64
				_t17 = _t5;
				if(_t39 !=  *_t5 || _t29 ==  *0x6e0360d8) {
					goto L13;
				} else {
					_t6 = _t29 + 0x28; // 0x58
					_t38 = _t6;
					E6DF62280(_t17, _t6);
					asm("lock cmpxchg [edx], cx");
					if(_t39 != _t39) {
						E6DF5FFB0(_t29, _t38, _t38);
						goto L13;
					}
					E6DF4F8C8(_t29);
					E6DF5FFB0(_t29, _t38, _t38);
					_t24 =  *(_t29 + 0x36) & 0x00003fff;
					if(( *(_t29 + 0x36) & 0x00003fff) != 0xa) {
						_push( *((intOrPtr*)(_t29 + 0x30)));
						_t24 = E6DF895D0();
					}
					_t34 =  *(_t29 + 0xc8);
					if( *(_t29 + 0xc8) != 0) {
						E6E014015(_t24, _t34);
						 *(_t29 + 0xc8) =  *(_t29 + 0xc8) & 0x00000000;
					}
					_t37 = _a12;
					if(_t37 != 0) {
						 *_t37 =  *((intOrPtr*)(_t29 + 0x20));
					}
					E6DF4F871(_t29);
					return 0;
				}
			}

0x6df4f7c7
0x6df4f7cf
0x6df4f865
0x6df4f867
0x6df4f86e
0x00000000
0x6df4f86e
0x6df4f7d5
0x6df4f7db
0x00000000
0x00000000
0x6df4f7e1
0x6df4f7e1
0x6df4f7e7
0x00000000
0x6df4f7f1
0x6df4f7f1
0x6df4f7f1
0x6df4f7f5
0x6df4f802
0x6df4f80a
0x6df4f860
0x00000000
0x6df4f860
0x6df4f80e
0x6df4f814
0x6df4f822
0x6df4f829
0x6df4f82b
0x6df4f82e
0x6df4f82e
0x6df4f833
0x6df4f83b
0x6dfa5d50
0x6dfa5d55
0x6dfa5d55
0x6df4f841
0x6df4f846
0x6df4f85b
0x6df4f85b
0x6df4f84a
0x00000000
0x6df4f84f

APIs

RtlAcquireSRWLockExclusive.9419(00000058,00000000,00000000,00000000,?,6DFB76A7,?,?,00000000,6DF267CC,00000000,00000000,?,00000040), ref: 6DF4F7F5
RtlReleaseSRWLockExclusive.9419(00000058,00000058,00000000,00000000,00000000,?,6DFB76A7,?,?,00000000,6DF267CC,00000000,00000000,?,00000040), ref: 6DF4F860

Part of subcall function 6DF4F8C8: RtlAcquireSRWLockExclusive.9419(6E0386AC,00000058,?,00000030,6DF4F813,00000058,00000000,00000000,00000000,?,6DFB76A7,?,?,00000000,6DF267CC,00000000), ref: 6DF4F8D5
Part of subcall function 6DF4F8C8: RtlRbRemoveNode.9419(6E0386DC,00000030,6E0386AC,00000058,?,00000030,6DF4F813,00000058,00000000,00000000,00000000,?,6DFB76A7,?,?,00000000), ref: 6DF4F8E0
Part of subcall function 6DF4F8C8: RtlReleaseSRWLockExclusive.9419(6E0386AC,6E0386DC,00000030,6E0386AC,00000058,?,00000030,6DF4F813,00000058,00000000,00000000,00000000,?,6DFB76A7,?,?), ref: 6DF4F8EE

RtlReleaseSRWLockExclusive.9419(00000058,00000058,00000000,00000000,00000000,?,6DFB76A7,?,?,00000000,6DF267CC,00000000,00000000,?,00000040), ref: 6DF4F814
ZwClose.9419(?,00000058,00000058,00000000,00000000,00000000,?,6DFB76A7,?,?,00000000,6DF267CC,00000000,00000000,?,00000040), ref: 6DF4F82E
RtlSetLastWin32Error.9419(00000006,00000000,00000000,00000000,?,6DFB76A7,?,?,00000000,6DF267CC,00000000,00000000,?,00000040), ref: 6DF4F867

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: e96faa4352743cca55f74a323eddff241b842b2a3142b1db95f5d1166197793c
Instruction ID: 0c62e3e4da73404bd21a84f4f79921a5833bd4294affdcb7529c98cec9d3c108
Opcode Fuzzy Hash: e96faa4352743cca55f74a323eddff241b842b2a3142b1db95f5d1166197793c
Instruction Fuzzy Hash: B011B63628510697EBC19F58C8C0BBA3B65BF51B14F41D129DE184F247DB2098858760

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1242, Relevance: 9.0, APIs: 6, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6DFD1242(intOrPtr __ebx) {
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;

				_t18 = __ebx;
				_t19 =  *((intOrPtr*)(_t20 - 0x48));
				if(_t19 != 0) {
					_push(_t19);
					_push(0xffffffff);
					E6DF897A0();
					if( *((intOrPtr*)(_t20 - 0x40)) != 0) {
						_push( *((intOrPtr*)(_t20 - 0x40)));
						E6DF895D0();
					}
					_t14 =  *((intOrPtr*)(_t20 - 0x4c));
					if(_t14 != 0) {
						_push(_t14);
						_t14 = E6DF895D0();
					}
				}
				if( *((intOrPtr*)(_t20 - 0x38)) != 0) {
					_push( *((intOrPtr*)(_t20 - 0x38)));
					_t14 = E6DF895D0();
					 *((intOrPtr*)(_t20 - 0x38)) = _t18;
				}
				if( *((intOrPtr*)(_t20 - 0x3c)) != 0) {
					_push( *((intOrPtr*)(_t20 - 0x3c)));
					_t14 = E6DF895D0();
					 *((intOrPtr*)(_t20 - 0x3c)) = _t18;
				}
				if( *((intOrPtr*)(_t20 - 0x34)) == 0) {
					return _t14;
				} else {
					_push( *((intOrPtr*)(_t20 - 0x34)));
					_t15 = E6DF895D0();
					 *((intOrPtr*)(_t20 - 0x34)) = _t18;
					return _t15;
				}
			}

0x6dfd1242
0x6dfd1242
0x6dfd1247
0x6dfd1249
0x6dfd124a
0x6dfd124c
0x6dfd1255
0x6dfd1257
0x6dfd125a
0x6dfd125a
0x6dfd125f
0x6dfd1264
0x6dfd1266
0x6dfd1267
0x6dfd1267
0x6dfd1264
0x6dfd1270
0x6dfd1272
0x6dfd1275
0x6dfd127a
0x6dfd127a
0x6dfd1281
0x6dfd1283
0x6dfd1286
0x6dfd128b
0x6dfd128b
0x6dfd1292
0x6dfd129f
0x6dfd1294
0x6dfd1294
0x6dfd1297
0x6dfd129c
0x00000000
0x6dfd129c

APIs

ZwUnmapViewOfSection.9419(000000FF,?,6DFD122C,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000,?,?,?,6DFFB56B,00000000,?), ref: 6DFD124C
ZwClose.9419(?,000000FF,?,6DFD122C,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000,?,?,?,6DFFB56B,00000000), ref: 6DFD125A
ZwClose.9419(?,000000FF,?,6DFD122C,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000,?,?,?,6DFFB56B,00000000), ref: 6DFD1267
ZwClose.9419(?,6DFD122C,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000,?,?,?,6DFFB56B,00000000,?,00000000), ref: 6DFD1275
ZwClose.9419(?,6DFD122C,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000,?,?,?,6DFFB56B,00000000,?,00000000), ref: 6DFD1286
ZwClose.9419(?,6DFD122C,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000,?,?,?,6DFFB56B,00000000,?,00000000), ref: 6DFD1297

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$SectionUnmapView
String ID:
API String ID: 682624529-0
Opcode ID: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction ID: 02c4f521a8429dde3c0432f80737419bbe69410ef95241fdefac228e1ba97508
Opcode Fuzzy Hash: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction Fuzzy Hash: 09F01D70D0510DEADF45AFB8E8807ADBBB1AF0031AF141128F522755A5DF714890CB01

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DF44439(intOrPtr* __ecx, void* __edx) {
				signed int _v8;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				signed int _v84;
				void* _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t64;
				signed int _t68;
				intOrPtr* _t72;
				signed int _t74;
				void* _t77;
				signed int _t83;
				signed int _t84;

				_t79 = __edx;
				_t54 =  *0x6e03d360 ^ _t84;
				_v8 =  *0x6e03d360 ^ _t84;
				_t82 = __ecx;
				_v96 = __edx;
				_t74 = __edx;
				if(__edx != 0 && ( *(__edx + 8) & 0x00000004) == 0) {
					_t82 = __ecx + 4;
					_t72 =  *_t82;
					while(_t72 != _t82) {
						_t83 = _t72 - 8;
						_t79 = 1;
						if( *_t83 != 0x74736c46) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = 1;
							_v68 = 1;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = 1;
							E6DF9DEF0(_t74, 1);
							_t74 = _v96;
							_t79 = 1;
						}
						if( *(_t83 + 0x14) !=  !( *(_t83 + 4))) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = _t79;
							_v68 = 2;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = _t79;
							E6DF9DEF0(_t74, _t79);
							_t74 = _v96;
						}
						_t9 = _t83 + 0x18; // 0x1c
						_t54 = _t9;
						if(_t74 < _t9) {
							L13:
							_t72 =  *_t72;
							continue;
						} else {
							_t10 = _t83 + 0x618; // 0x61c
							_t54 = _t10;
							if(_t74 >= _t10) {
								goto L13;
							} else {
								_v96 = 0x30;
								_t64 = _t74 - _t83 - 0x18;
								asm("cdq");
								_t79 = _t64 % _v96;
								_t54 = 0x18 + _t64 / _v96 * 0x30 + _t83;
								if(_t74 == 0x18 + _t64 / _v96 * 0x30 + _t83) {
									_t54 =  *(_t83 + 4);
									if(_t54 != 0) {
										_t68 = _t54 - 1;
										 *(_t83 + 4) = _t68;
										_t54 =  !_t68;
										 *(_t83 + 0x14) =  !_t68;
										 *((intOrPtr*)(_t74 + 8)) = 4;
										if( *(_t83 + 4) == 0) {
											_t54 =  *(_t72 + 4);
											if(_t54 != _t82) {
												do {
													_t83 =  *(_t54 + 4);
													_t79 = _t54 - 8;
													if( *((intOrPtr*)(_t79 + 4)) == 0) {
														_t77 =  *_t54;
														if( *(_t77 + 4) != _t54 ||  *_t83 != _t54) {
															_push(3);
															asm("int 0x29");
															return 0x3e5;
														}
														 *_t83 = _t77;
														 *(_t77 + 4) = _t83;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t79);
													}
													_t54 = _t83;
												} while (_t83 != _t82);
											}
										}
									}
								}
							}
						}
						goto L12;
					}
				}
				L12:
				return E6DF8B640(_t54, _t72, _v8 ^ _t84, _t79, _t82, _t83);
			}

0x6df44439
0x6df44446
0x6df44448
0x6df4444e
0x6df44450
0x6df44453
0x6df44457
0x6df44467
0x6df4446a
0x6df4446c
0x6df44472
0x6df44475
0x6df4447c
0x6dfa080d
0x6dfa0814
0x6dfa0815
0x6dfa081c
0x6dfa081f
0x6dfa0822
0x6dfa0825
0x6dfa0828
0x6dfa082f
0x6dfa0832
0x6dfa0837
0x6dfa083c
0x6dfa083c
0x6df4448a
0x6dfa0842
0x6dfa0849
0x6dfa084a
0x6dfa0851
0x6dfa0854
0x6dfa085b
0x6dfa085e
0x6dfa0861
0x6dfa0868
0x6dfa086b
0x6dfa0870
0x6dfa0870
0x6df44490
0x6df44490
0x6df44495
0x6df444f8
0x6df444f8
0x00000000
0x6df44497
0x6df44497
0x6df44497
0x6df4449f
0x00000000
0x6df444a1
0x6df444a3
0x6df444ac
0x6df444af
0x6df444b0
0x6df444b9
0x6df444bd
0x6df444bf
0x6df444c4
0x6df444c6
0x6df444c7
0x6df444ca
0x6df444cc
0x6df444cf
0x6df444da
0x6df444dc
0x6df444e1
0x6dfa0878
0x6dfa0878
0x6dfa087b
0x6dfa0882
0x6dfa0884
0x6dfa0889
0x6dfa08b0
0x6dfa08b3
0x00000000
0x6dfa08b5
0x6dfa0896
0x6dfa089a
0x6dfa08a0
0x6dfa08a0
0x6dfa08a5
0x6dfa08a7
0x6dfa08ab
0x6df444e1
0x6df444da
0x6df444c4
0x6df444bd
0x6df4449f
0x00000000
0x6df44495
0x6df4446c
0x6df444e7
0x6df444f7

Strings

0, xrefs: 6DF444A3
Flst, xrefs: 6DF44476

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 822149c85e1000e70de1d71099aa68c0bef834a9af9529905a14784a4327ab94
Instruction ID: 26f5b71e5147e1436631803cd086a312fc9d8918c6a507c30d6a319cd83339a2
Opcode Fuzzy Hash: 822149c85e1000e70de1d71099aa68c0bef834a9af9529905a14784a4327ab94
Instruction Fuzzy Hash: 834196B1E04649CBDB14CF9DD8806ADFBF5FF88314F24C02AD449AB655D7B09A42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7D294, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E6DF7D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				long _v56;
				long _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				long _v84;
				void* _v88;
				char _v92;
				void* _v96;
				void* _v100;
				char _v104;
				char _v105;
				intOrPtr _v113;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t35;
				char _t38;
				long _t40;
				signed int _t44;
				long _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				void* _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6e03d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(L6DF64120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E6DF8B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E6DF898D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E6DF895D0();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), _t52, _t62);
					goto L4;
				} else {
					L4:
					RtlFreeHeap( *( *[fs:0x30] + 0x18), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v113 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x6df7d29c
0x6df7d2a6
0x6df7d2b1
0x6df7d2b5
0x6df7d2b6
0x6df7d2bc
0x6df7d2bd
0x6df7d2be
0x6df7d2bf
0x6df7d2c2
0x6df7d2c4
0x6df7d2cc
0x6df7d384
0x6df7d34b
0x6df7d34f
0x6df7d350
0x6df7d351
0x6df7d35c
0x6df7d35c
0x6df7d2d6
0x6df7d2da
0x6df7d2e1
0x6df7d361
0x6df7d369
0x6df7d36d
0x6df7d2e3
0x6df7d2e3
0x6df7d2e3
0x6df7d2e5
0x6df7d2ed
0x6df7d2f5
0x6df7d2fa
0x6df7d302
0x6df7d303
0x6df7d30b
0x6df7d30f
0x6df7d313
0x6df7d318
0x6df7d31c
0x6df7d320
0x6df7d379
0x6df7d37d
0x00000000
0x00000000
0x6dfbaffe
0x6dfbb001
0x6dfbb011
0x00000000
0x6df7d322
0x6df7d322
0x6df7d330
0x6df7d337
0x6df7d35d
0x6df7d339
0x6df7d33f
0x6df7d38c
0x6df7d38c
0x6df7d33f
0x6df7d349
0x00000000
0x6df7d349

APIs

ZwQueryAttributesFile.9419(?,?,?,?), ref: 6DF7D313
RtlFreeHeap.9419(?,00000000,?,?,?,?,?), ref: 6DF7D330
ZwClose.9419(00000000,?,?,?,?), ref: 6DFBB001
RtlFreeHeap.9419(?,00000000,?,00000000,?,?,?,?), ref: 6DFBB011

Strings

@, xrefs: 6DF7D303

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AttributesCloseFileQuery
String ID: @
API String ID: 2866988855-2766056989
Opcode ID: a97254a8dbfbeb9cc561af8215a2a99f41048b27c9ddebd4f21ab9de32eb88c8
Instruction ID: 862d23bb75daf91d756c90a663d7fbfa32f6ab72752ee284c29e0ae751d5b99a
Opcode Fuzzy Hash: a97254a8dbfbeb9cc561af8215a2a99f41048b27c9ddebd4f21ab9de32eb88c8
Instruction Fuzzy Hash: 7E317AB2558345EFC361CF2C9980ADBBBE8EBC9754F41092EF99483250D635DD44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DFCEA20, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6DFCEA20(intOrPtr* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t22;
				intOrPtr* _t23;
				void* _t30;
				void* _t32;
				intOrPtr* _t33;
				intOrPtr* _t35;
				void* _t36;
				signed int _t37;

				_push(__ecx);
				_v8 =  *0x6e03d360 ^ _t37;
				_t13 =  *[fs:0x30];
				_t35 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) == 0 ||  *0x6e03b238 == 0) {
					L10:
					_pop(_t32);
					_pop(_t36);
					_pop(_t22);
					return E6DF8B640(_t13, _t22, _v8 ^ _t37, _t30, _t32, _t36);
				} else {
					L6DF5EEF0(0x6e0370a0);
					if(E6DFCF625( *((intOrPtr*)(_t35 + 0x18))) == 0) {
						_t28 = _t35;
						if(E6DFCF2B7(_t35) < 0) {
							L9:
							_t13 = E6DF5EB70(_t28, 0x6e0370a0);
							goto L10;
						}
						_t33 =  *0x6e0370c0;
						while(_t33 != 0x6e0370c0) {
							_t23 =  *((intOrPtr*)(_t33 + 0x1c));
							_t33 =  *_t33;
							if(_t23 != 0) {
								_t28 = _t23;
								 *0x6e03b1e0( *((intOrPtr*)(_t35 + 0x30)),  *((intOrPtr*)(_t35 + 0x18)),  *((intOrPtr*)(_t35 + 0x20)), _t35);
								 *_t23();
							}
						}
						goto L9;
					}
					E6DF4B150("AVRF: AVrfDllUnloadNotification called for a provider (%p) \n", _t35);
					_pop(_t28);
					asm("int3");
					goto L9;
				}
			}

0x6dfcea25
0x6dfcea2d
0x6dfcea30
0x6dfcea40
0x6dfcea42
0x6dfceab5
0x6dfceab8
0x6dfceab9
0x6dfceabc
0x6dfceac5
0x6dfcea4d
0x6dfcea52
0x6dfcea61
0x6dfcea73
0x6dfcea7c
0x6dfceaab
0x6dfceab0
0x00000000
0x6dfceab0
0x6dfcea7e
0x6dfceaa3
0x6dfcea86
0x6dfcea89
0x6dfcea8d
0x6dfcea93
0x6dfcea9b
0x6dfceaa1
0x6dfceaa1
0x6dfcea8d
0x00000000
0x6dfceaa3
0x6dfcea69
0x6dfcea6f
0x6dfcea70
0x00000000
0x6dfcea70

APIs

RtlEnterCriticalSection.9419(6E0370A0,-00000054,?,00000000,-00000054,?,6DFA5D18), ref: 6DFCEA52
DbgPrint.9419(AVRF: AVrfDllUnloadNotification called for a provider (%p) ,-00000054,6E0370A0,-00000054,?,00000000,-00000054,?,6DFA5D18), ref: 6DFCEA69
RtlLeaveCriticalSection.9419(6E0370A0,6E0370A0,-00000054,?,00000000,-00000054,?,6DFA5D18), ref: 6DFCEAB0

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 6DFCEA64

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavePrint
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 1203512206-702105204
Opcode ID: 37042c758d89e4e25c9d30a2fc60973756645b75c6e3ccd633c56a37d4880622
Instruction ID: e83d2dc289408867a2b00e6b796354730ed262fbc6cbf47418e500976350cd83
Opcode Fuzzy Hash: 37042c758d89e4e25c9d30a2fc60973756645b75c6e3ccd633c56a37d4880622
Instruction Fuzzy Hash: 4211E57221460BEFDB21CFADCC81B6BB7A5FF85258B110119E9068B591CB21AC65CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6B944, Relevance: 7.7, APIs: 5, Instructions: 166
nativetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DF6B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				signed int _t67;
				intOrPtr _t68;
				char* _t73;
				signed int _t82;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6e03d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t105 = __ecx[3];
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t60 =  *__ecx | __ecx[1];
					if(( *__ecx | __ecx[1]) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E6DF67D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E6E018CD6(_t112);
						}
						_push(0);
						_push( *((intOrPtr*)(_t112 + 0x10)));
						_t60 = E6DF89E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E6DF8B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t67 = __ecx[2];
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E6DF8CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E6DF67D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E6E018F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_push( *((intOrPtr*)(_t112 + 0x10)));
						_t60 = E6DF8AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_v68 =  *0x6e038628;
								_v64 =  *0x6e03862c;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_v76 =  *0x6e03862c;
							_t117 = _v68;
						} while (_t117 !=  *0x6e038628 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x6df6b94c
0x6df6b956
0x6df6b95c
0x6df6b95e
0x6df6b964
0x6df6b969
0x6df6b96d
0x6df6b970
0x6df6b974
0x6df6b97a
0x6df6badf
0x6df6bae2
0x6df6bae4
0x6df6bae6
0x6df6baf0
0x6dfb2cb8
0x6df6baf6
0x6df6baf6
0x6df6baf6
0x6df6bafd
0x6df6bb1f
0x6df6bb1f
0x6df6baff
0x6df6bb00
0x6df6bb03
0x6df6bb03
0x6df6bacb
0x6df6bacf
0x6df6bad0
0x6df6bad1
0x6df6badc
0x6df6badc
0x6df6b980
0x6df6b988
0x6df6b98b
0x6df6b98d
0x6df6b990
0x6df6b993
0x6df6b999
0x6df6b99b
0x6df6b9a1
0x6df6b9a5
0x6df6b9aa
0x6df6b9b0
0x6df6b9bb
0x6df6b9c0
0x6df6b9c3
0x6df6b9ca
0x6df6b9cc
0x6df6b9cf
0x6df6b9d3
0x6df6b9d7
0x6df6ba94
0x6df6ba94
0x6df6ba98
0x6df6baa3
0x6dfb2ccb
0x6df6baa9
0x6df6baa9
0x6df6baa9
0x6df6bab1
0x6dfb2cd5
0x6dfb2cdd
0x6dfb2cdd
0x6df6babb
0x6df6babc
0x6df6bac2
0x6df6bac3
0x6df6bac6
0x00000000
0x6df6b9dd
0x6df6b9dd
0x6df6b9e7
0x6df6b9e7
0x6df6b9ec
0x6df6b9f1
0x6df6b9fa
0x6df6ba00
0x6df6ba0c
0x6df6ba10
0x6df6ba10
0x6df6ba12
0x6df6ba18
0x00000000
0x00000000
0x6df6bb26
0x6df6bb26
0x6df6ba1e
0x6df6ba1e
0x6df6ba23
0x6df6ba25
0x6df6ba2c
0x6df6ba30
0x6df6ba35
0x6df6ba35
0x6df6ba4c
0x6df6ba50
0x6df6ba54
0x6df6ba6a
0x6df6ba6e
0x6df6ba70
0x6df6ba74
0x6df6ba78
0x6df6ba7a
0x6df6ba7c
0x6df6ba8e
0x6df6ba90
0x6df6ba92
0x6df6bb14
0x6df6bb14
0x6df6bb16
0x6df6bb16
0x00000000
0x6df6ba7c
0x6df6bb0a
0x6df6bb0d
0x00000000
0x00000000
0x00000000
0x6df6bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(00000000,?,00002710,00000000,?,?,?), ref: 6DF6B9A5
RtlGetCurrentServiceSessionId.9419(00000000,?,00002710,00000000,?,?,?), ref: 6DF6BA9C
ZwSetTimer2.9419(00000000,?,00000000,?,00000000,?,00002710,00000000,?,?,?), ref: 6DF6BAC6
RtlGetCurrentServiceSessionId.9419(?,?,?), ref: 6DF6BAE9
ZwCancelTimer2.9419(00000000,00000000,?,?,?), ref: 6DF6BB03

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSessionTimer2$CancelUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1220516486-0
Opcode ID: f455fce5a8f0e4f6f9f5434438c18379fc584df6a2371974ab869abc00346de1
Instruction ID: b9c95c807e3d6ee2c2942008f7bfe0b8e25f9233cbaf831228744a5a363cf62c
Opcode Fuzzy Hash: f455fce5a8f0e4f6f9f5434438c18379fc584df6a2371974ab869abc00346de1
Instruction Fuzzy Hash: 55513671A18782CFC720CF6DC08092ABBF5BB89714F118D6EF9958B655D731E844CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF98BE8, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 657
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E6DF98BE8(void* __edi, void* __esi, intOrPtr _a4, signed int _a8, unsigned int _a12) {
				signed int _v8;
				char _v521;
				char _v1032;
				signed int _v1036;
				unsigned int _v1040;
				signed int _v1044;
				signed int _v1048;
				signed int _v1052;
				signed int _v1056;
				signed int _v1060;
				intOrPtr _v1064;
				signed int _v1068;
				signed int _v1072;
				signed char _v1075;
				signed char _v1076;
				short _v1078;
				short _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				intOrPtr _v1100;
				signed int _v1104;
				signed int __ebx;
				signed int _t227;
				signed int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t236;
				signed int _t239;
				signed int _t242;
				void* _t243;
				unsigned int _t245;
				intOrPtr _t246;
				signed short* _t249;
				signed int _t251;
				signed int _t255;
				signed int _t256;

				_t254 = __esi;
				_t252 = __edi;
				_v8 =  *0x6e03d360 ^ _t256;
				_t246 = _a4;
				_t251 = 0;
				_v1064 = _t246;
				_v1040 = _a12;
				_v1088 = 0;
				_v1068 = 0;
				_v1044 = 0;
				_v1056 = 0;
				_v1092 = 0;
				_v1060 = 0;
				_t242 = 0;
				_v1036 = 0;
				if(_t246 != 0) {
					_t227 = _a8;
					if(_t227 == 0) {
						goto L1;
					}
					_push(__esi);
					_push(__edi);
					_v1052 = 0;
					_v1072 = 0;
					_t251 =  *_t227 & 0x0000ffff;
					if(_t251 == 0) {
						L184:
						_t229 = _v1052;
						goto L185;
					} else {
						_t255 = _v1104;
						_t249 = _t227;
						while(1) {
							_v1048 = _t249;
							_t250 =  &(_t249[1]);
							_t231 = _t251 & 0x0000ffff;
							_a8 =  &(_t249[1]);
							if(_v1052 < 0) {
								break;
							}
							_t250 = _t231;
							_t20 = _t251 - 0x20; // -32
							_t243 = 0x58;
							if(_t20 > _t243) {
								_t236 = 0;
							} else {
								_t236 =  *(_t250 + 0x6df26750) & 0xf;
							}
							_t24 = _v1072 + 0x6df26770; // 0x86808006
							_t245 =  *(_t236 * 9 + _t24) & 0x000000ff;
							_v1072 = _t245;
							_t242 = _v1036;
							_t239 = _t245 >> 4;
							_v1072 = _t239;
							if(_t239 == 8) {
								L183:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_t229 = E6DF8B58E(_t242, _t250, _t251, 0, _t255) | 0xffffffff;
								L185:
								_pop(_t252);
								_pop(_t254);
								L186:
								return E6DF8B640(_t229, _t242, _v8 ^ _t256, _t251, _t252, _t254);
							} else {
								if(_t239 > 7) {
									L179:
									_t249 = _a8;
									L180:
									_t251 =  *_t249 & 0x0000ffff;
									if(_t251 != 0) {
										continue;
									}
									break;
								}
								switch( *((intOrPtr*)(_t239 * 4 +  &M6DF99534))) {
									case 0:
										L57:
										__eax =  &_v1052;
										_v1060 = 1;
										__eax = E6DF99554(__edx, _v1064,  &_v1052);
										goto L179;
									case 1:
										_v1044 = _v1044 | 0xffffffff;
										_t242 = 0;
										_v1092 = 0;
										_v1068 = 0;
										_v1056 = 0;
										_v1036 = 0;
										_v1060 = 0;
										goto L179;
									case 2:
										_push(0x20);
										_pop(__eax);
										__ecx = __ecx - __eax;
										__eflags = __ecx;
										if(__ecx == 0) {
											__ebx = __ebx | 0x00000002;
											goto L21;
										}
										__ecx = __ecx - 3;
										__eflags = __ecx;
										if(__ecx == 0) {
											__ebx = __ebx | 0x00000080;
											goto L21;
										}
										__ecx = __ecx - 8;
										__eflags = __ecx;
										if(__ecx == 0) {
											__ebx = __ebx | 0x00000001;
											goto L21;
										}
										__ecx = __ecx - 1;
										__ecx = __ecx - 1;
										__eflags = __ecx;
										if(__ecx == 0) {
											__ebx = __ebx | 0x00000004;
											__eflags = __ebx;
											goto L21;
										}
										__eflags = __ecx;
										__ecx = _a8;
										if(__eflags != 0) {
											goto L180;
										} else {
											__ebx = __ebx | 0x00000008;
											__eflags = __ebx;
											goto L19;
										}
									case 3:
										_push(0x2a);
										_pop(__eax);
										__eflags = __dx - __ax;
										if(__dx != __ax) {
											_v1068 * 0xa = 0xffffffd0 + _v1068 * 0xa;
											__eax = 0xffffffd0 + _v1068 * 0xa + __ecx;
											_v1068 = __eax;
											goto L179;
										} else {
											__ecx = _v1040;
											__ecx = _v1040 + 4;
											_v1040 = __ecx;
											__eax =  *(__ecx - 4);
											__ecx = _a8;
											_v1068 = __eax;
											__eflags = __eax;
											if(__eax < 0) {
												__ebx = __ebx | 0x00000004;
												__eax =  ~__eax;
												_v1036 = __ebx;
												_v1068 = __eax;
											}
											goto L180;
										}
									case 4:
										__eax = 0;
										__eflags = 0;
										goto L30;
									case 5:
										_push(0x2a);
										_pop(__eax);
										__eflags = __dx - __ax;
										if(__dx != __ax) {
											_v1044 * 0xa = 0xffffffd0 + _v1044 * 0xa;
											__eax = 0xffffffd0 + _v1044 * 0xa + __ecx;
											L30:
											_v1044 = __eax;
											goto L179;
										}
										__ecx = _v1040;
										__ecx = _v1040 + 4;
										_v1040 = __ecx;
										__ecx =  *(__ecx - 4);
										__eflags = __ecx;
										_v1044 = __ecx;
										__ecx = _a8;
										if(__eflags < 0) {
											_v1044 = _v1044 | 0xffffffff;
										}
										goto L180;
									case 6:
										__eflags = __ecx - 0x49;
										if(__ecx == 0x49) {
											__eax = _a8;
											__eax =  *_a8 & 0x0000ffff;
											__eflags = __eax - 0x36;
											if(__eax != 0x36) {
												__eflags = __eax - 0x33;
												if(__eax != 0x33) {
													__eflags = __eax - 0x64;
													if(__eax == 0x64) {
														goto L179;
													}
													_push(0x69);
													_pop(__ecx);
													__eflags = __ax - __cx;
													if(__ax == __cx) {
														goto L179;
													}
													__eflags = __eax - 0x6f;
													if(__eax == 0x6f) {
														goto L179;
													}
													__eflags = __eax - 0x75;
													if(__eax == 0x75) {
														goto L179;
													}
													_push(0x78);
													_pop(__ecx);
													__eflags = __ax - __cx;
													if(__ax == __cx) {
														goto L179;
													}
													_push(0x58);
													_pop(__ecx);
													__eflags = __ax - __cx;
													if(__ax == __cx) {
														goto L179;
													}
													L56:
													__eax = 0;
													__eflags = 0;
													_v1072 = 0;
													goto L57;
												}
												__eax = _v1048;
												__eflags =  *((short*)(__eax + 4)) - 0x32;
												if( *((short*)(__eax + 4)) != 0x32) {
													goto L56;
												}
												__ecx = __eax + 6;
												__ebx = __ebx & 0xffff7fff;
												L19:
												_v1036 = __ebx;
												goto L180;
											}
											__eax = _v1048;
											__eflags =  *((short*)(__eax + 4)) - 0x34;
											if( *((short*)(__eax + 4)) != 0x34) {
												goto L56;
											}
											__ecx = __eax + 6;
											__ebx = __ebx | 0x00008000;
											goto L19;
										}
										__eflags = __ecx - 0x68;
										if(__ecx == 0x68) {
											_push(0x20);
											_pop(__eax);
											__ebx = __ebx | __eax;
											L21:
											_v1036 = __ebx;
											goto L179;
										}
										_push(0x6c);
										_pop(__edx);
										__eflags = __ecx - __edx;
										if(__ecx == __edx) {
											__eax = _a8;
											__ecx =  *_a8 & 0x0000ffff;
											__eflags = __cx - __dx;
											if(__cx != __dx) {
												__eax = _v1048;
												_a8 = _v1048;
											}
											__eax = 0;
											__eflags = __cx - __dx;
											__ecx = _a8;
											0 | __eflags == 0x00000000 = (__eflags == 0) - 1;
											__eax = (__eflags == 0x00000000) - 0x00000001 & 0xfffff010;
											__eax = ((__eflags == 0x00000000) - 0x00000001 & 0xfffff010) + 0x1000;
											__ebx = __ebx | __eax;
											__ecx = _a8 + 2;
											_v1036 = __ebx;
											goto L180;
										}
										__eflags = __ecx - 0x77;
										__ecx = _a8;
										if(__eflags != 0) {
											goto L180;
										}
										__ebx = __ebx | 0x00000800;
										goto L19;
									case 7:
										_push(0x69);
										_pop(__eax);
										__eflags = __ecx - __eax;
										if(__eflags > 0) {
											__ecx = __ecx - 0x6e;
											__eflags = __ecx;
											if(__ecx == 0) {
												goto L183;
											}
											__ecx = __ecx - 1;
											__eflags = __ecx;
											if(__ecx == 0) {
												_v1048 = 8;
												__eflags = __bl;
												if(__bl >= 0) {
													L116:
													__eflags = __ebx & 0x00008000;
													if((__ebx & 0x00008000) == 0) {
														__eflags = __ebx & 0x00001000;
														if((__ebx & 0x00001000) == 0) {
															__ecx = _v1040;
															__eax = __ebx;
															__ecx = _v1040 + 4;
															__eax = __ebx & 0x00000040;
															_v1040 = __ecx;
															__eflags = __bl & 0x00000020;
															if((__bl & 0x00000020) == 0) {
																_v1040 = __ecx;
																__eflags = __eax;
																if(__eax == 0) {
																	__edi =  *(__ecx - 4);
																	__ecx = 0;
																	__eflags = 0;
																	__edx = 0;
																	L129:
																	__eflags = __bl & 0x00000040;
																	if((__bl & 0x00000040) == 0) {
																		L134:
																		__eflags = __ebx & 0x00009000;
																		if((__ebx & 0x00009000) == 0) {
																			__edx = __ecx;
																		}
																		__eax = _v1044;
																		__eflags = _v1044;
																		if(_v1044 >= 0) {
																			_v1036 = __ebx;
																			__ebx = _v1044;
																			__eflags = __ebx - 0x200;
																			if(__ebx > 0x200) {
																				__ebx = 0x200;
																			}
																		} else {
																			__ebx = 0;
																			__ebx = 1;
																		}
																		__edi = __edi | __edx;
																		__eflags = __edi | __edx;
																		if((__edi | __edx) == 0) {
																			_v1056 = __ecx;
																		}
																		__esi =  &_v521;
																		while(1) {
																			__eax = __ebx;
																			__ecx = __esi;
																			__ebx = __ebx - 1;
																			_v1044 = __ebx;
																			__eflags = __eax;
																			if(__eax > 0) {
																				goto L145;
																			}
																			L144:
																			__eax = __edi;
																			__eax = __edi | __edx;
																			__eflags = __eax;
																			if(__eax == 0) {
																				__ebx = _v1036;
																				__edi =  &_v521;
																				__edi =  &_v521 - __esi;
																				__esi = __esi + 1;
																				__eflags = __ebx & 0x00000200;
																				if((__ebx & 0x00000200) == 0) {
																					L152:
																					__eflags = _v1092;
																					if(_v1092 != 0) {
																						goto L179;
																					}
																					__eflags = __bl & 0x00000040;
																					if((__bl & 0x00000040) == 0) {
																						L157:
																						_push(0x20);
																						_pop(__edx);
																						L158:
																						__eax = _v1068;
																						__ecx = __ebx;
																						_v1068 - __edi = _v1068 - __edi - _v1056;
																						__ecx = __ebx & 0x0000000c;
																						__eflags = __ecx;
																						_v1100 = _v1068 - __edi - _v1056;
																						_v1084 = __ecx;
																						if(__ecx == 0) {
																							__ecx =  &_v1052;
																							__eax = E6DF995AA(__edx, __eax, _v1064,  &_v1052);
																						}
																						 &_v1052 =  &_v1080;
																						__eax = E6DF995D8( &_v1080, _v1056, _v1064,  &_v1052);
																						__eflags = _v1084 - 8;
																						if(_v1084 == 8) {
																							__eax =  &_v1052;
																							_push( &_v1052);
																							_push(_v1064);
																							_push(_v1100);
																							_push(0x30);
																							_pop(__eax);
																							_push( &_v1052);
																							__eax = E6DF995AA();
																							__esp = __esp + 0x10;
																						}
																						__eflags = _v1060;
																						if(_v1060 != 0) {
																							L175:
																							__eax =  &_v1052;
																							__eax = E6DF995D8(__esi, __edi, _v1064,  &_v1052);
																						} else {
																							__eflags = __edi;
																							if(__edi <= 0) {
																								goto L175;
																							}
																							__ecx = __esi;
																							_v1084 = __esi;
																							__eax = __edi;
																							while(1) {
																								_v1048 = __eax;
																								__eax =  &_v1096;
																								__eax = E6DF97E20( &_v1096, __ecx,  *0x6e035874);
																								_v1104 = __eax;
																								__eflags = __eax - 2;
																								if(__eax == 2) {
																									_t195 =  &_v1048;
																									 *_t195 = _v1048 - 1;
																									__eflags =  *_t195;
																								}
																								__eflags = __eax;
																								if(__eax <= 0) {
																									break;
																								}
																								 &_v1052 = E6DF99554(_v1096, _v1064,  &_v1052);
																								__ecx = _v1084;
																								__ecx = _v1084 + _v1104;
																								__eax = _v1048;
																								_v1084 = __ecx;
																								__eflags = __eax;
																								if(__eax > 0) {
																									continue;
																								}
																								L176:
																								__eflags = _v1052;
																								if(_v1052 >= 0) {
																									__eflags = __bl & 0x00000004;
																									if((__bl & 0x00000004) != 0) {
																										__eax =  &_v1052;
																										_push( &_v1052);
																										_push(_v1064);
																										_push(_v1100);
																										_push(0x20);
																										_pop(__eax);
																										_push( &_v1052);
																										__eax = E6DF995AA();
																										__esp = __esp + 0x10;
																									}
																								}
																								goto L179;
																							}
																							_v1052 = _v1052 | 0xffffffff;
																						}
																						goto L176;
																					}
																					__eflags = __ebx & 0x00000100;
																					if((__ebx & 0x00000100) == 0) {
																						__eflags = __bl & 0x00000001;
																						if((__bl & 0x00000001) == 0) {
																							__eflags = __bl & 0x00000002;
																							if((__bl & 0x00000002) == 0) {
																								goto L157;
																							}
																							_push(0x20);
																							_pop(__edx);
																							_v1080 = __dx;
																							_v1056 = 1;
																							goto L158;
																						}
																						_push(0x2b);
																						L156:
																						_pop(__eax);
																						_v1080 = __ax;
																						_v1056 = 1;
																						goto L157;
																					}
																					_push(0x2d);
																					goto L156;
																				}
																				__eflags = __edi;
																				if(__edi == 0) {
																					L151:
																					__esi = __ecx;
																					__edi = __edi + 1;
																					__eflags = __edi;
																					_push(0x30);
																					_pop(__eax);
																					 *__esi = __al;
																					goto L152;
																				}
																				__eflags =  *__esi - 0x30;
																				if( *__esi == 0x30) {
																					goto L152;
																				}
																				goto L151;
																			}
																			L145:
																			_push(__ebx);
																			__eax = 0;
																			__eax = E6DF8D220(__edi, __edx, _v1048, 0);
																			_v1104 = __ebx;
																			_pop(__ebx);
																			__ecx = __ecx + 0x30;
																			__edi = __eax;
																			__eflags = __ecx - 0x39;
																			if(__ecx > 0x39) {
																				__eflags = __ecx;
																			}
																			__ebx = _v1044;
																			 *__esi = __cl;
																			__esi = __esi - 1;
																			__eax = __ebx;
																			__ecx = __esi;
																			__ebx = __ebx - 1;
																			_v1044 = __ebx;
																			__eflags = __eax;
																			if(__eax > 0) {
																				goto L145;
																			}
																			goto L144;
																		}
																	}
																	__eflags = __edx - __ecx;
																	if(__eflags > 0) {
																		goto L134;
																	}
																	if(__eflags < 0) {
																		L133:
																		__edi =  ~__edi;
																		asm("adc edx, ecx");
																		__edx =  ~__edx;
																		__ebx = __ebx | 0x00000100;
																		__eflags = __ebx;
																		_v1036 = __ebx;
																		goto L134;
																	}
																	__eflags = __edi - __ecx;
																	if(__edi >= __ecx) {
																		goto L134;
																	}
																	goto L133;
																}
																__eax =  *(__ecx - 4);
																L126:
																asm("cdq");
																__edi = __eax;
																L127:
																__ecx = 0;
																goto L129;
															}
															__eflags = __eax;
															if(__eax == 0) {
																__eax =  *(__ecx - 4) & 0x0000ffff;
															} else {
																__eax =  *(__ecx - 4);
															}
															goto L126;
														}
														__eax = _v1040;
														__eax = _v1040 + 8;
														_v1040 = __eax;
														__edi =  *(__eax - 8);
														__edx =  *(__eax - 4);
														goto L127;
													}
													__ecx = _v1040;
													__ecx = _v1040 + 8;
													_v1040 = __ecx;
													__edi =  *(__ecx - 8);
													__edx =  *(__ecx - 4);
													goto L127;
												}
												__ebx = __ebx | 0x00000200;
												__eflags = __ebx;
												L115:
												_v1036 = __ebx;
												goto L116;
											}
											__ecx = __ecx - 1;
											__eflags = __ecx;
											if(__ecx == 0) {
												_v1044 = 8;
												L110:
												_v1088 = 7;
												_push(0x58);
												L111:
												_pop(__eax);
												_v1048 = 0x10;
												__eflags = __bl;
												if(__bl < 0) {
													_push(0x30);
													_pop(__ecx);
													_v1080 = __cx;
													_v1078 = __ax;
													_v1056 = 2;
												}
												goto L116;
											}
											__ecx = __ecx - 3;
											__eflags = __ecx;
											if(__ecx == 0) {
												L78:
												__eax = _v1044;
												__eflags = __eax - 0xffffffff;
												if(__eax == 0xffffffff) {
													__eax = 0x7fffffff;
												}
												__ecx = _v1040;
												__ecx = _v1040 + 4;
												_v1040 = __ecx;
												__esi =  *(__ecx - 4);
												__eflags = __bl & 0x00000020;
												if((__bl & 0x00000020) == 0) {
													__eflags = __esi;
													if(__esi == 0) {
														__esi = L"(null)";
													}
													_v1060 = 1;
													__edi = __esi;
													__eflags = __eax;
													if(__eax == 0) {
														L108:
														__edi = __edi - __esi;
														__edi = __edi >> 1;
														goto L152;
													} else {
														__ecx = 0;
														__eflags = 0;
														while(1) {
															__eax = __eax - 1;
															__eflags =  *__edi - __cx;
															if( *__edi == __cx) {
																goto L108;
															}
															__edi = __edi + 2;
															__eflags = __eax;
															if(__eax != 0) {
																continue;
															}
															goto L108;
														}
														goto L108;
													}
												} else {
													__eflags = __esi;
													if(__esi == 0) {
														__esi = "(null)";
													}
													__ecx = 0;
													__edi = 0;
													__eflags = __eax;
													if(__eax > 0) {
														while(1) {
															__eflags =  *((intOrPtr*)(__esi + __edi)) - __cl;
															if( *((intOrPtr*)(__esi + __edi)) == __cl) {
																goto L152;
															}
															__edi = __edi + 1;
															__eflags = __edi - __eax;
															if(__edi < __eax) {
																continue;
															}
															goto L152;
														}
													}
													goto L152;
												}
											}
											__ecx = __ecx - 1;
											__ecx = __ecx - 1;
											__eflags = __ecx;
											if(__ecx == 0) {
												_v1048 = 0xa;
												goto L116;
											}
											__ecx = __ecx - 3;
											__eflags = __ecx;
											if(__ecx != 0) {
												goto L152;
											}
											_v1088 = 0x27;
											_push(0x78);
											goto L111;
										}
										if(__eflags == 0) {
											L66:
											__ebx = __ebx | 0x00000040;
											_v1048 = 0xa;
											goto L115;
										}
										__ecx = __ecx - 0x43;
										__eflags = __ecx;
										if(__ecx == 0) {
											__eflags = __ebx & 0x00000830;
											if((__ebx & 0x00000830) == 0) {
												_push(0x20);
												_pop(__eax);
												__ebx = __ebx | __eax;
												__eflags = __ebx;
												_v1036 = __ebx;
											}
											L89:
											__eax = _v1040;
											__eax = _v1040 + 4;
											_v1060 = 1;
											_v1040 = __eax;
											__eax =  *(__eax - 4) & 0x0000ffff;
											_v1096 = __eax;
											__eflags = __bl & 0x00000020;
											if((__bl & 0x00000020) == 0) {
												_v1032 = __ax;
											} else {
												_v1076 = __al;
												__eax = 0;
												_v1075 = __al;
												 &_v1076 =  &_v1032;
												__eax = E6DF97E20( &_v1032,  &_v1076,  *0x6e035874);
												__eflags = __eax;
												if(__eax < 0) {
													_v1092 = 1;
												}
											}
											__edi = 0;
											__esi =  &_v1032;
											__edi = 1;
											goto L152;
										}
										__ecx = __ecx - 0x10;
										__eflags = __ecx;
										if(__ecx == 0) {
											__eflags = __ebx & 0x00000830;
											if((__ebx & 0x00000830) == 0) {
												_push(0x20);
												_pop(__eax);
												__ebx = __ebx | __eax;
												__eflags = __ebx;
												_v1036 = __ebx;
											}
											goto L78;
										}
										__ecx = __ecx - 5;
										__eflags = __ecx;
										if(__ecx == 0) {
											goto L110;
										}
										__ecx = __ecx - 1;
										__ecx = __ecx - 1;
										__eflags = __ecx;
										if(__ecx == 0) {
											__edx = _v1040;
											__edx = _v1040 + 4;
											_v1040 = __edx;
											__ecx =  *(__edx - 4);
											__eflags = __ecx;
											if(__ecx == 0) {
												L75:
												_push(6);
												__esi = "(null)";
												_pop(__edi);
												goto L152;
											}
											__esi =  *(__ecx + 4);
											__eflags = __esi;
											if(__esi == 0) {
												goto L75;
											}
											__eax =  *__ecx & 0x0000ffff;
											__edx = __eax;
											__eflags =  *((intOrPtr*)(__ecx + 2)) - __ax;
											if( *((intOrPtr*)(__ecx + 2)) < __ax) {
												goto L183;
											}
											__edi = __edx;
											__eflags = __ebx & 0x00000800;
											if((__ebx & 0x00000800) == 0) {
												__eax = 0;
												_v1060 = 0;
												goto L152;
											}
											__eax =  !__eax;
											__eflags = __al & 0x00000001;
											if((__al & 0x00000001) == 0) {
												goto L183;
											}
											__eax = __esi;
											__eax =  !__esi;
											__eflags = __al & 0x00000001;
											if((__al & 0x00000001) == 0) {
												goto L183;
											}
											__edi = __edi >> 1;
											_v1060 = 1;
											goto L152;
										}
										__ecx = __ecx - 9;
										__eflags = __ecx;
										if(__ecx == 0) {
											goto L89;
										}
										__ecx = __ecx - 1;
										__eflags = __ecx;
										if(__ecx != 0) {
											goto L152;
										}
										goto L66;
								}
							}
						}
						_t232 = _v1072;
						if(_t232 == 0) {
							goto L184;
						}
						if(_t232 == 7) {
							goto L184;
						}
						goto L183;
					}
				}
				L1:
				_push(_t251);
				_push(_t251);
				_push(_t251);
				_push(_t251);
				_push(_t251);
				_t229 = E6DF8B58E(_t242, _t246, _t251, _t252, _t254) | 0xffffffff;
				goto L186;
			}

0x6df98be8
0x6df98be8
0x6df98bfa
0x6df98bfd
0x6df98c00
0x6df98c05
0x6df98c0b
0x6df98c11
0x6df98c17
0x6df98c1d
0x6df98c23
0x6df98c29
0x6df98c2f
0x6df98c36
0x6df98c38
0x6df98c40
0x6df98c57
0x6df98c5c
0x00000000
0x00000000
0x6df98c5e
0x6df98c5f
0x6df98c60
0x6df98c68
0x6df98c6e
0x6df98c74
0x6df9951b
0x6df9951b
0x00000000
0x6df98c7a
0x6df98c7a
0x6df98c80
0x6df98c82
0x6df98c82
0x6df98c88
0x6df98c92
0x6df98c95
0x6df98c98
0x00000000
0x00000000
0x6df98ca0
0x6df98ca2
0x6df98ca5
0x6df98ca9
0x6df98cb7
0x6df98cab
0x6df98cb2
0x6df98cb2
0x6df98cc2
0x6df98cc2
0x6df98ccc
0x6df98cd2
0x6df98cd8
0x6df98cdb
0x6df98ce4
0x6df99507
0x6df99509
0x6df9950a
0x6df9950b
0x6df9950c
0x6df9950d
0x6df99516
0x6df99521
0x6df99521
0x6df99522
0x6df99523
0x6df99531
0x6df98cea
0x6df98ced
0x6df994e9
0x6df994e9
0x6df994ec
0x6df994ec
0x6df994f2
0x00000000
0x00000000
0x00000000
0x6df994f2
0x6df98cf3
0x00000000
0x6df98f1c
0x6df98f1c
0x6df98f22
0x6df98f34
0x00000000
0x00000000
0x6df98cfc
0x6df98d03
0x6df98d05
0x6df98d0b
0x6df98d11
0x6df98d17
0x6df98d1d
0x00000000
0x00000000
0x6df98d28
0x6df98d2a
0x6df98d2b
0x6df98d2b
0x6df98d2d
0x6df98d74
0x00000000
0x6df98d74
0x6df98d2f
0x6df98d2f
0x6df98d32
0x6df98d6c
0x00000000
0x6df98d6c
0x6df98d34
0x6df98d34
0x6df98d37
0x6df98d67
0x00000000
0x6df98d67
0x6df98d39
0x6df98d3a
0x6df98d3a
0x6df98d3d
0x6df98d59
0x6df98d59
0x00000000
0x6df98d59
0x6df98d3f
0x6df98d42
0x6df98d45
0x00000000
0x6df98d4b
0x6df98d4b
0x6df98d4b
0x00000000
0x6df98d4b
0x00000000
0x6df98d79
0x6df98d7b
0x6df98d7c
0x6df98d7f
0x6df98dc1
0x6df98dc4
0x6df98dc6
0x00000000
0x6df98d81
0x6df98d81
0x6df98d87
0x6df98d8a
0x6df98d90
0x6df98d93
0x6df98d96
0x6df98d9c
0x6df98d9e
0x6df98da4
0x6df98da7
0x6df98da9
0x6df98daf
0x6df98daf
0x00000000
0x6df98d9e
0x00000000
0x6df98dd1
0x6df98dd1
0x00000000
0x00000000
0x6df98dde
0x6df98de0
0x6df98de1
0x6df98de4
0x6df98e1c
0x6df98e1f
0x6df98dd3
0x6df98dd3
0x00000000
0x6df98dd3
0x6df98de6
0x6df98dec
0x6df98def
0x6df98df5
0x6df98df8
0x6df98dfa
0x6df98e00
0x6df98e03
0x6df98e09
0x6df98e09
0x00000000
0x00000000
0x6df98e23
0x6df98e26
0x6df98e8f
0x6df98e92
0x6df98e95
0x6df98e98
0x6df98eb5
0x6df98eb8
0x6df98ed5
0x6df98ed8
0x00000000
0x00000000
0x6df98ede
0x6df98ee0
0x6df98ee1
0x6df98ee4
0x00000000
0x00000000
0x6df98eea
0x6df98eed
0x00000000
0x00000000
0x6df98ef3
0x6df98ef6
0x00000000
0x00000000
0x6df98efc
0x6df98efe
0x6df98eff
0x6df98f02
0x00000000
0x00000000
0x6df98f08
0x6df98f0a
0x6df98f0b
0x6df98f0e
0x00000000
0x00000000
0x6df98f14
0x6df98f14
0x6df98f14
0x6df98f16
0x00000000
0x6df98f16
0x6df98eba
0x6df98ec0
0x6df98ec5
0x00000000
0x00000000
0x6df98ec7
0x6df98eca
0x6df98d4e
0x6df98d4e
0x00000000
0x6df98d4e
0x6df98e9a
0x6df98ea0
0x6df98ea5
0x00000000
0x00000000
0x6df98ea7
0x6df98eaa
0x00000000
0x6df98eaa
0x6df98e28
0x6df98e2b
0x6df98e85
0x6df98e87
0x6df98e88
0x6df98d5c
0x6df98d5c
0x00000000
0x6df98d5c
0x6df98e2d
0x6df98e2f
0x6df98e30
0x6df98e32
0x6df98e4b
0x6df98e4e
0x6df98e51
0x6df98e54
0x6df98e56
0x6df98e5c
0x6df98e5c
0x6df98e5f
0x6df98e61
0x6df98e64
0x6df98e6a
0x6df98e6b
0x6df98e70
0x6df98e75
0x6df98e77
0x6df98e7a
0x00000000
0x6df98e7a
0x6df98e34
0x6df98e37
0x6df98e3a
0x00000000
0x00000000
0x6df98e40
0x00000000
0x00000000
0x6df98f41
0x6df98f43
0x6df98f44
0x6df98f46
0x6df990fa
0x6df990fa
0x6df990fd
0x00000000
0x00000000
0x6df99103
0x6df99103
0x6df99106
0x6df991b9
0x6df991c3
0x6df991c5
0x6df991d3
0x6df991d3
0x6df991d9
0x6df991f2
0x6df991f8
0x6df99211
0x6df99217
0x6df99219
0x6df9921c
0x6df9921f
0x6df99225
0x6df99228
0x6df9923a
0x6df99240
0x6df99242
0x6df9924e
0x6df99251
0x6df99251
0x6df99253
0x6df99255
0x6df99255
0x6df99258
0x6df99276
0x6df99276
0x6df9927c
0x6df9927e
0x6df9927e
0x6df99280
0x6df99286
0x6df99288
0x6df99292
0x6df99298
0x6df9929e
0x6df992a4
0x6df992a6
0x6df992a6
0x6df9928a
0x6df9928a
0x6df9928c
0x6df9928c
0x6df992ad
0x6df992ad
0x6df992af
0x6df992b1
0x6df992b1
0x6df992b7
0x6df992bd
0x6df992bd
0x6df992bf
0x6df992c1
0x6df992c2
0x6df992c8
0x6df992ca
0x00000000
0x00000000
0x6df992cc
0x6df992cc
0x6df992ce
0x6df992ce
0x6df992d0
0x6df99305
0x6df9930b
0x6df99311
0x6df99313
0x6df99314
0x6df9931a
0x6df9932d
0x6df9932d
0x6df99334
0x00000000
0x00000000
0x6df9933a
0x6df9933d
0x6df9935f
0x6df9935f
0x6df99361
0x6df99362
0x6df99362
0x6df99368
0x6df9936c
0x6df99372
0x6df99372
0x6df99375
0x6df9937b
0x6df99381
0x6df99383
0x6df99392
0x6df99397
0x6df993a7
0x6df993b4
0x6df993bc
0x6df993c3
0x6df993c5
0x6df993cb
0x6df993cc
0x6df993d2
0x6df993d8
0x6df993da
0x6df993db
0x6df993dc
0x6df993e1
0x6df993e1
0x6df993e4
0x6df993eb
0x6df994a5
0x6df994a5
0x6df994b4
0x6df993f1
0x6df993f1
0x6df993f3
0x00000000
0x00000000
0x6df993f9
0x6df993fb
0x6df99401
0x6df99403
0x6df9940a
0x6df99410
0x6df99418
0x6df99420
0x6df99426
0x6df99429
0x6df9942b
0x6df9942b
0x6df9942b
0x6df9942b
0x6df99431
0x6df99433
0x00000000
0x00000000
0x6df99448
0x6df9944d
0x6df99456
0x6df9945c
0x6df99462
0x6df99468
0x6df9946a
0x00000000
0x00000000
0x6df994bc
0x6df994bc
0x6df994c3
0x6df994c5
0x6df994c8
0x6df994ca
0x6df994d0
0x6df994d1
0x6df994d7
0x6df994dd
0x6df994df
0x6df994e0
0x6df994e1
0x6df994e6
0x6df994e6
0x6df994c8
0x00000000
0x6df994c3
0x6df9949c
0x6df9949c
0x00000000
0x6df993eb
0x6df9933f
0x6df99345
0x6df9946e
0x6df99471
0x6df9947a
0x6df9947d
0x00000000
0x00000000
0x6df99483
0x6df99485
0x6df99486
0x6df9948d
0x00000000
0x6df9948d
0x6df99473
0x6df9934d
0x6df9934d
0x6df9934e
0x6df99355
0x00000000
0x6df99355
0x6df9934b
0x00000000
0x6df9934b
0x6df9931c
0x6df9931e
0x6df99325
0x6df99325
0x6df99327
0x6df99327
0x6df99328
0x6df9932a
0x6df9932b
0x00000000
0x6df9932b
0x6df99320
0x6df99323
0x00000000
0x00000000
0x00000000
0x6df99323
0x6df992d2
0x6df992d2
0x6df992d3
0x6df992de
0x6df992e3
0x6df992e9
0x6df992ea
0x6df992ed
0x6df992ef
0x6df992f2
0x6df992f4
0x6df992f4
0x6df992fa
0x6df99300
0x6df99302
0x6df992bd
0x6df992bf
0x6df992c1
0x6df992c2
0x6df992c8
0x6df992ca
0x00000000
0x00000000
0x00000000
0x6df992ca
0x6df992bd
0x6df9925a
0x6df9925c
0x00000000
0x00000000
0x6df9925e
0x6df99264
0x6df99264
0x6df99266
0x6df99268
0x6df9926a
0x6df9926a
0x6df99270
0x00000000
0x6df99270
0x6df99260
0x6df99262
0x00000000
0x00000000
0x00000000
0x6df99262
0x6df99244
0x6df99247
0x6df99247
0x6df99248
0x6df9924a
0x6df9924a
0x00000000
0x6df9924a
0x6df9922a
0x6df9922c
0x6df99234
0x6df9922e
0x6df9922e
0x6df9922e
0x00000000
0x6df9922c
0x6df991fa
0x6df99200
0x6df99203
0x6df99209
0x6df9920c
0x00000000
0x6df9920c
0x6df991db
0x6df991e1
0x6df991e4
0x6df991ea
0x6df991ed
0x00000000
0x6df991ed
0x6df991c7
0x6df991c7
0x6df991cd
0x6df991cd
0x00000000
0x6df991cd
0x6df9910c
0x6df9910c
0x6df9910f
0x6df99177
0x6df99181
0x6df99181
0x6df9918b
0x6df9918d
0x6df9918d
0x6df9918e
0x6df99198
0x6df9919a
0x6df9919c
0x6df9919e
0x6df9919f
0x6df991a6
0x6df991ad
0x6df991ad
0x00000000
0x6df9919a
0x6df99111
0x6df99111
0x6df99114
0x6df9901d
0x6df9901d
0x6df99023
0x6df99026
0x6df99028
0x6df99028
0x6df9902d
0x6df99033
0x6df99036
0x6df9903c
0x6df9903f
0x6df99042
0x6df99146
0x6df99148
0x6df9914a
0x6df9914a
0x6df9914f
0x6df99159
0x6df9915b
0x6df9915d
0x6df9916e
0x6df9916e
0x6df99170
0x00000000
0x6df9915f
0x6df9915f
0x6df9915f
0x6df99161
0x6df99161
0x6df99162
0x6df99165
0x00000000
0x00000000
0x6df99167
0x6df9916a
0x6df9916c
0x00000000
0x00000000
0x00000000
0x6df9916c
0x00000000
0x6df99161
0x6df99048
0x6df99048
0x6df9904a
0x6df9904c
0x6df9904c
0x6df99051
0x6df99053
0x6df99055
0x6df99057
0x6df9905d
0x6df9905d
0x6df99060
0x00000000
0x00000000
0x6df99066
0x6df99067
0x6df99069
0x00000000
0x00000000
0x00000000
0x6df9906b
0x6df9905d
0x00000000
0x6df99057
0x6df99042
0x6df9911a
0x6df9911b
0x6df9911b
0x6df9911e
0x6df99137
0x00000000
0x6df99137
0x6df99120
0x6df99120
0x6df99123
0x00000000
0x00000000
0x6df99129
0x6df99133
0x00000000
0x6df99133
0x6df98f4c
0x6df98f81
0x6df98f81
0x6df98f84
0x00000000
0x6df98f84
0x6df98f4e
0x6df98f4e
0x6df98f51
0x6df99070
0x6df99076
0x6df99078
0x6df9907a
0x6df9907b
0x6df9907b
0x6df9907d
0x6df9907d
0x6df99083
0x6df99083
0x6df99089
0x6df9908c
0x6df99096
0x6df9909c
0x6df990a0
0x6df990a6
0x6df990a9
0x6df990e5
0x6df990ab
0x6df990b1
0x6df990b7
0x6df990b9
0x6df990c6
0x6df990cd
0x6df990d5
0x6df990d7
0x6df990d9
0x6df990d9
0x6df990d7
0x6df990ec
0x6df990ee
0x6df990f4
0x00000000
0x6df990f4
0x6df98f57
0x6df98f57
0x6df98f5a
0x6df9900a
0x6df99010
0x6df99012
0x6df99014
0x6df99015
0x6df99015
0x6df99017
0x6df99017
0x00000000
0x6df99010
0x6df98f60
0x6df98f60
0x6df98f63
0x00000000
0x00000000
0x6df98f69
0x6df98f6a
0x6df98f6a
0x6df98f6d
0x6df98f93
0x6df98f99
0x6df98f9c
0x6df98fa2
0x6df98fa5
0x6df98fa7
0x6df98ffd
0x6df98ffd
0x6df98fff
0x6df99004
0x00000000
0x6df99004
0x6df98fa9
0x6df98fac
0x6df98fae
0x00000000
0x00000000
0x6df98fb0
0x6df98fb3
0x6df98fb5
0x6df98fb9
0x00000000
0x00000000
0x6df98fbf
0x6df98fc1
0x6df98fc7
0x6df98ff0
0x6df98ff2
0x00000000
0x6df98ff2
0x6df98fc9
0x6df98fcb
0x6df98fcd
0x00000000
0x00000000
0x6df98fd3
0x6df98fd5
0x6df98fd7
0x6df98fd9
0x00000000
0x00000000
0x6df98fdf
0x6df98fe1
0x00000000
0x6df98fe1
0x6df98f6f
0x6df98f6f
0x6df98f72
0x00000000
0x00000000
0x6df98f78
0x6df98f78
0x6df98f7b
0x00000000
0x00000000
0x00000000
0x00000000
0x6df98cf3
0x6df98ce4
0x6df994f8
0x6df99500
0x00000000
0x00000000
0x6df99505
0x00000000
0x00000000
0x00000000
0x6df99505
0x6df98c74
0x6df98c42
0x6df98c42
0x6df98c43
0x6df98c44
0x6df98c45
0x6df98c46
0x6df98c4f
0x00000000

Strings

(null), xrefs: 6DF9914A
', xrefs: 6DF99129
(null), xrefs: 6DF98FFF, 6DF9904C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: '$(null)$(null)
API String ID: 3558298466-1087929977
Opcode ID: 4f66fa75626ed9d648aa429c1e2c13d3f70aaa7a02f0faefaa53b072bfb5afc5
Instruction ID: 490dd17f8899d3df64095588bc023e30c820e0b0e287d77937ff9c06e9550e82
Opcode Fuzzy Hash: 4f66fa75626ed9d648aa429c1e2c13d3f70aaa7a02f0faefaa53b072bfb5afc5
Instruction Fuzzy Hash: 723292B1E042198FFB25CF2CCC847A9B7B5BB45314F0191A9DA19AF291DB318AC5CF58

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6DBE9, Relevance: 7.6, APIs: 5, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6DF6DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t72;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t101 = _t98 + 0xc8;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E6DF4CC50(E6DF44510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E6DF67D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E6E018ED6(_t102, _t98);
						}
						_t76 = _v44;
						E6DF62280(_t58, _v44);
						E6DF6DD82(_v44, _t102, _t98);
						E6DF6B944(_t102, _v5);
						return E6DF5FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_v28 =  *0x6e038628;
							_v32 =  *0x6e03862c;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t105 = _v28;
						_t80 =  *0x6e03862c;
					} while (_t105 !=  *0x6e038628 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t101 = _v40 + 0xc8;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x6df6dbe9
0x6df6dbf2
0x6df6dbf7
0x6df6dbf9
0x6df6dbfc
0x6df6dc00
0x6df6dc03
0x6df6dc14
0x6df6dd54
0x6df6dd54
0x6df6dd54
0x6df6dc18
0x6df6dc1d
0x6df6dc32
0x6df6dc3b
0x6df6dc3e
0x6df6dc46
0x6df6dd5b
0x6df6dd62
0x6df6dd64
0x6df6dd67
0x6df6dd69
0x6df6dd6b
0x6df6dd6e
0x6df6dd70
0x6df6dd73
0x6df6dd73
0x00000000
0x6df6dc4c
0x6df6dc4e
0x6dfb3ae3
0x6dfb3ae8
0x6dfb3aea
0x6df6dce7
0x6df6dce9
0x6df6dcec
0x6df6dcee
0x6df6dcf0
0x6df6dcf3
0x6df6dcf5
0x6dfb3af2
0x6dfb3af5
0x6dfb3af5
0x6df6dd06
0x6df6dd08
0x6df6dd0b
0x6df6dd12
0x6dfb3b08
0x6df6dd18
0x6df6dd18
0x6df6dd18
0x6df6dd20
0x6df6dd23
0x6dfb3b16
0x6dfb3b16
0x6df6dd29
0x6df6dd2d
0x6df6dd36
0x6df6dd40
0x6df6dd51
0x6df6dd51
0x6df6dc54
0x6df6dc59
0x6df6dc59
0x6df6dc5e
0x6df6dc63
0x6df6dc6b
0x6df6dc78
0x6df6dc7b
0x6df6dc81
0x6df6dc81
0x6df6dc83
0x6df6dc89
0x00000000
0x00000000
0x6df6dd7b
0x6df6dd7b
0x6df6dc8f
0x6df6dc8f
0x6df6dc92
0x6df6dc99
0x6df6dc9f
0x6df6dca5
0x6df6dcaa
0x6df6dcaa
0x6df6dcb8
0x6df6dcbb
0x6df6dcc1
0x6df6dccf
0x6df6dcd2
0x6df6dcd5
0x6df6dcd7
0x6df6dcda
0x6df6dcdc
0x6df6dce2
0x6df6dce4
0x00000000
0x6df6dce4

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6DF6DD0B
RtlAcquireSRWLockExclusive.9419(00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6DF6DD2D
RtlReleaseSRWLockExclusive.9419(00000000,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6DF6DD46

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseServiceSession
String ID:
API String ID: 3179239776-0
Opcode ID: 6dd93aaa08f2105d8c442998e229f98b96401626d5ace827088ab3b185a510d2
Instruction ID: 6fcb353dd43d3d8df9642df83116129f950f71ee7c00be055d3098b95cb34318
Opcode Fuzzy Hash: 6dd93aaa08f2105d8c442998e229f98b96401626d5ace827088ab3b185a510d2
Instruction Fuzzy Hash: B251BD71A0464ACFCB14DFACC880A9EBBF5BB89314F31855AD954EB740DB30AD44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF49100, Relevance: 7.6, APIs: 5, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6DF49100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x6e01f6e8);
				E6DF9D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0 || _t82 ==  *0x6e0386c0 || _t82 ==  *0x6e0386b8 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E6E0188F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E6DF9D130(_t68, _t82, _t84);
				} else {
					E6DF62280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E6E0188F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E6DF8AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x6e03b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x6e0384c0;
										if(_t69 >=  *0x6e0384c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E6E019063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E6DF4922A(_t82);
							_t53 = E6DF67D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E6E018B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) == 0) {
								goto L5;
							} else {
								__eflags = _t82 -  *0x6e0386c0;
								if(__eflags != 0) {
									__eflags = _t82 -  *0x6e0386b8;
									if(__eflags == 0) {
										_t79 = 0x6e0386bc;
										_t72 = 0x6e0386b8;
										L18:
										E6DF79B82(_t68, _t72, _t79, _t82, _t84, __eflags);
										goto L5;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E6DF49240(_t68, _t82, _t82, _t84, __eflags);
									}
									goto L5;
								}
								_t79 = 0x6e0386c4;
								_t72 = 0x6e0386c0;
								goto L18;
							}
						}
					}
				}
			}

0x6df49100
0x6df49100
0x6df49100
0x6df49100
0x6df49102
0x6df49107
0x6df4910c
0x6df49110
0x6df49115
0x6df49143
0x6dfa37e4
0x6dfa37e4
0x6df49149
0x6df4914e
0x6df49151
0x6df49158
0x6df4915d
0x6df49161
0x6df49168
0x6dfa3715
0x00000000
0x6df4916e
0x6df4916e
0x6df49175
0x6df49177
0x6df4917e
0x6df4917f
0x6df49182
0x6df49182
0x6df49187
0x6df49187
0x6df4918a
0x6df4918d
0x6df4918f
0x6df49192
0x6df49195
0x6df49198
0x6df49198
0x6df49198
0x6df4919a
0x00000000
0x00000000
0x6dfa371f
0x6dfa3721
0x6dfa3727
0x6dfa372f
0x6dfa3733
0x6dfa3735
0x6dfa3738
0x6dfa373b
0x6dfa373d
0x6dfa3740
0x00000000
0x00000000
0x6dfa3746
0x6dfa3749
0x00000000
0x00000000
0x6dfa374f
0x6dfa3751
0x00000000
0x00000000
0x6dfa3757
0x6dfa3759
0x6dfa375c
0x6dfa375c
0x6dfa375e
0x6dfa375e
0x6dfa3761
0x6dfa3764
0x00000000
0x00000000
0x6dfa3766
0x6dfa3768
0x6dfa37a3
0x6dfa37a3
0x6dfa37a5
0x6dfa37a7
0x6dfa37ad
0x6dfa37b0
0x6dfa37b2
0x6dfa37bc
0x6dfa37c2
0x6dfa37c2
0x6dfa37b2
0x6df49187
0x6df49187
0x6df4918a
0x6df4918d
0x6df4918f
0x6df49192
0x6df49195
0x00000000
0x6df49195
0x00000000
0x6df49187
0x6dfa376a
0x6dfa376a
0x6dfa376c
0x6dfa376c
0x6dfa376f
0x6dfa3775
0x00000000
0x00000000
0x6dfa3777
0x6dfa3779
0x00000000
0x00000000
0x6dfa3782
0x6dfa3787
0x6dfa3789
0x6dfa3790
0x6dfa3790
0x6dfa378b
0x6dfa378b
0x6dfa378b
0x6dfa3792
0x6dfa3795
0x6dfa3795
0x6dfa3798
0x6dfa3798
0x6dfa379b
0x6dfa379b
0x6df491a3
0x6df491a9
0x6df491b0
0x6df491b4
0x6df491b4
0x6df491bb
0x6df491c0
0x6df491c5
0x6df491c7
0x6dfa37da
0x6df491cd
0x6df491cd
0x6df491cd
0x6df491d2
0x6df491d5
0x6df49239
0x6df49239
0x6df491d7
0x6df491db
0x00000000
0x6df491e1
0x6df491e1
0x6df491e7
0x6df491fd
0x6df49203
0x6df4921e
0x6df49223
0x6df491f3
0x6df491f3
0x00000000
0x6df491f3
0x6df49205
0x6df49208
0x6df4920c
0x6df49214
0x6df49214
0x00000000
0x6df4920c
0x6df491e9
0x6df491ee
0x00000000
0x6df491ee
0x6df491db
0x6df49187
0x6df49168

APIs

RtlAcquireSRWLockExclusive.9419(?,6E01F6E8,0000002C,6DF9E530,00000000,?,6E0201C0,00000010,6E01810C,00000000,00000000,00000000,00000000,6E0386C4,6E0386C4,00000008), ref: 6DF49158
ZwShutdownWorkerFactory.9419(?,?), ref: 6DF49182
RtlGetCurrentServiceSessionId.9419 ref: 6DF491C0

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCurrentExclusiveFactoryLockServiceSessionShutdownWorker
String ID:
API String ID: 1345183298-0
Opcode ID: 6501281bd739b032ecbc85e6b153b12a6c2436d9114daee012f280f0f63a64d1
Instruction ID: df4d6abf30f98ca77e120f98f3353203812cb2e89488840e63b725ba22e0b7df
Opcode Fuzzy Hash: 6501281bd739b032ecbc85e6b153b12a6c2436d9114daee012f280f0f63a64d1
Instruction Fuzzy Hash: 1451D475A18643EFD712CBADD6487ADBBF5BB89314F24C15DC41497281DB309940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD19C8, Relevance: 7.6, APIs: 5, Instructions: 107
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DFD19C8(intOrPtr* __ecx, intOrPtr* __edx) {
				int _v8;
				void* _v12;
				char _v16;
				intOrPtr* _v20;
				int _v24;
				char _v28;
				int _v32;
				int _v36;
				intOrPtr _v40;
				int _v44;
				int _v48;
				void _v52;
				int _t37;
				intOrPtr* _t47;
				signed int _t49;
				int _t51;
				intOrPtr* _t54;
				int _t58;

				_t47 = __edx;
				_t54 = __ecx;
				_t49 = 6;
				memset( &_v52, 0, _t49 << 2);
				_v20 = _t54;
				_v12 = 0;
				_v8 = 0;
				_v16 = 0;
				if(_t54 != 0) {
					 *_t54 = 0;
				}
				if(_t47 != 0) {
					 *_t47 = 0;
				}
				if(_t54 != 0) {
					if(_t47 != 0) {
						_push(0);
						_push(0x8000000);
						_push(4);
						_v52 = 0x18;
						_push( &_v28);
						_v48 = 0;
						_push( &_v52);
						_push(0xf0007);
						_v40 = 2;
						_push( &_v12);
						_v44 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0x414;
						_v24 = 0;
						_t58 = E6DF899A0();
						if(_t58 < 0) {
							L11:
							_t51 = _v12;
							_t37 = _v8;
							L12:
							if(_t37 != 0) {
								_push(_t37);
								_push(0xffffffff);
								E6DF897A0();
								_t51 = _v12;
								_v8 = 0;
							}
							if(_t51 != 0) {
								_push(_t51);
								E6DF895D0();
							}
							goto L16;
						}
						_push(4);
						_push(0);
						_push(1);
						_push( &_v16);
						_push(0);
						_push(0);
						_push(0);
						_push( &_v8);
						_push(0xffffffff);
						_push(_v12);
						_t58 = E6DF89780();
						if(_t58 < 0) {
							goto L11;
						}
						memset(_v8, 0, 0xf0);
						_t58 = 0;
						 *_v20 = _v12;
						_t51 = 0;
						 *_t47 = _v8;
						_t37 = 0;
						_v12 = 0;
						_v8 = 0;
						goto L12;
					}
					_t58 = 0xc00000f0;
					goto L16;
				} else {
					_t58 = 0xc00000ef;
					L16:
					return _t58;
				}
			}

0x6dfd19d3
0x6dfd19d8
0x6dfd19de
0x6dfd19df
0x6dfd19e3
0x6dfd19e6
0x6dfd19e9
0x6dfd19ec
0x6dfd19f1
0x6dfd19f3
0x6dfd19f3
0x6dfd19f7
0x6dfd19f9
0x6dfd19f9
0x6dfd19fd
0x6dfd1a0b
0x6dfd1a17
0x6dfd1a18
0x6dfd1a1d
0x6dfd1a22
0x6dfd1a29
0x6dfd1a2d
0x6dfd1a30
0x6dfd1a31
0x6dfd1a39
0x6dfd1a40
0x6dfd1a41
0x6dfd1a44
0x6dfd1a47
0x6dfd1a4a
0x6dfd1a51
0x6dfd1a59
0x6dfd1a5d
0x6dfd1aab
0x6dfd1aab
0x6dfd1aae
0x6dfd1ab1
0x6dfd1ab3
0x6dfd1ab5
0x6dfd1ab6
0x6dfd1ab8
0x6dfd1abd
0x6dfd1ac0
0x6dfd1ac0
0x6dfd1ac5
0x6dfd1ac7
0x6dfd1ac8
0x6dfd1ac8
0x00000000
0x6dfd1ac5
0x6dfd1a5f
0x6dfd1a61
0x6dfd1a62
0x6dfd1a67
0x6dfd1a68
0x6dfd1a69
0x6dfd1a6a
0x6dfd1a6e
0x6dfd1a6f
0x6dfd1a71
0x6dfd1a79
0x6dfd1a7d
0x00000000
0x00000000
0x6dfd1a88
0x6dfd1a96
0x6dfd1a98
0x6dfd1a9a
0x6dfd1a9f
0x6dfd1aa1
0x6dfd1aa3
0x6dfd1aa6
0x00000000
0x6dfd1aa6
0x6dfd1a0d
0x00000000
0x6dfd19ff
0x6dfd19ff
0x6dfd1ace
0x6dfd1ad5
0x6dfd1ad5

APIs

ZwCreateSection.9419(?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6DFD1A54
ZwMapViewOfSection.9419(?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004,08000000), ref: 6DFD1A74
memset.9419(?,00000000,000000F0,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?), ref: 6DFD1A88
ZwUnmapViewOfSection.9419(000000FF,?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6DFD1AB8
ZwClose.9419(?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6DFD1AC8

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$View$CloseCreateUnmapmemset
String ID:
API String ID: 788617167-0
Opcode ID: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction ID: 6ce32749ade9810bd67138528720b0f0b18e877e50d4cfb7755832a1ac4c2dd5
Opcode Fuzzy Hash: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction Fuzzy Hash: A9310FB5E0421AABDB10CF9EC840EAEFBF9EF95714F14416AE911BB250D7714E40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF43880, Relevance: 7.6, APIs: 5, Instructions: 97
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DF43880(intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				signed int _t28;
				signed int _t30;
				signed int _t42;
				signed int _t45;
				void* _t46;

				_v20 = _v20 | 0xffffffff;
				_t28 = 0;
				_t42 = 0;
				_v24 = 0xfd050f80;
				_t46 = 0;
				_v16 = 0;
				_t45 = 0;
				_v12 = 0;
				_v8 = 0;
				if( *0x6e0384cc != 0) {
					E6DF6ECE0(_a12, _a8, 0, 0);
					_t30 = 0;
					L2:
					while(1) {
						do {
							L2:
							while(1) {
								if(_t46 != 0) {
									L5:
									_push(0x1030);
									_push(_t46);
									_push(_t45);
									_push(_t30);
									_push( &_v16);
									_push(_t42);
									if(E6DF8A3A0() >= 0) {
										_t43 = _t46;
										_t45 = E6DF4395E(_t46, 0);
										if(_t45 == 0x103) {
											_t42 = 0;
											_t30 = 0;
											_v16 = _v16 & 0;
											_t45 = 0;
											_v12 = _v12 & 0;
											_t46 = 0;
											_v8 = 0;
											continue;
										} else {
											break;
										}
										goto L9;
									}
								} else {
									_t46 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t46, 0x1030);
									if(_t46 == 0) {
										_t28 = 0xc0000017;
									} else {
										_t30 = _v8;
										goto L5;
									}
								}
								if(_t28 != 0x8000001a) {
									_t28 = E6DF6ECE0(_a12, _a8,  &_v24, 0);
								}
								if(_t46 != 0) {
									return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t46);
								}
								goto L9;
							}
							_t13 = _t46 + 8; // 0x8
							_t42 = _t13;
							_v16 =  *_t46;
							_v12 =  *(_t46 + 4);
							_t30 =  *((intOrPtr*)(_t46 + 0x18));
							_v8 = _t30;
						} while (_t45 != 0xc000022d);
						E6DFD2D0B(_t43);
						_t30 = _v8;
						_t46 = 0;
					}
				}
				L9:
				return _t28;
			}

0x6df43888
0x6df4388c
0x6df4388f
0x6df43891
0x6df43899
0x6df4389b
0x6df4389f
0x6df438a1
0x6df438a4
0x6df438ad
0x6df438b7
0x6df438bc
0x00000000
0x6df438be
0x6df438be
0x00000000
0x6df438be
0x6df438c0
0x6df438e3
0x6df438e3
0x6df438e8
0x6df438e9
0x6df438ea
0x6df438ee
0x6df438ef
0x6df438f7
0x6df43924
0x6df4392b
0x6df43933
0x6df9ffb7
0x6df9ffb9
0x6df9ffbb
0x6df9ffbe
0x6df9ffc0
0x6df9ffc3
0x6df9ffc5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df43933
0x6df438c2
0x6df438d6
0x6df438da
0x6df9ffdc
0x6df438e0
0x6df438e0
0x00000000
0x6df438e0
0x6df438da
0x6df438fe
0x6df9fff2
0x6df9fff2
0x6df43906
0x00000000
0x6df43914
0x00000000
0x6df43906
0x6df4393b
0x6df4393b
0x6df4393e
0x6df43944
0x6df43947
0x6df4394a
0x6df4394d
0x6df9ffcd
0x6df9ffd2
0x6df9ffd5
0x6df9ffd5
0x6df438be
0x6df4391f
0x6df4391f

APIs

TpSetWaitEx.9419(000000FF,?,00000000,00000000), ref: 6DF438B7

Part of subcall function 6DF6ECE0: RtlAcquireSRWLockExclusive.9419(?,00000000,00000000), ref: 6DF6ED2C
Part of subcall function 6DF6ECE0: RtlReleaseSRWLockExclusive.9419(?,00000000,00000000,?,00000000,00000000), ref: 6DF6ED90

RtlAllocateHeap.9419(?,00000000,00001030,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6DF438D1
ZwGetCompleteWnfStateSubscription.9419(00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6DF438F0
RtlFreeHeap.9419(?,00000000,00000000,00000000,?,?,00000000,00000000,00001030,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6DF43914

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateCompleteFreeReleaseStateSubscriptionWait
String ID:
API String ID: 2233382-0
Opcode ID: 0c0c8b5e858953cb5bd28e5728415f1da95cc242782e438b7184d1b3d9391154
Instruction ID: 6d3d79f1779663ccf7e24ead2c40775f2a9365d315ba4cd77c5b06bf67e205fe
Opcode Fuzzy Hash: 0c0c8b5e858953cb5bd28e5728415f1da95cc242782e438b7184d1b3d9391154
Instruction Fuzzy Hash: B231AF32E4561AAFDB21CEAD8840AAEBBF9EF09314F01C525F914E7651D7309E008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44A20, Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6DF44A20(void* __ecx, void* _a4, intOrPtr _a8) {
				void* __esi;
				void* __ebp;
				char* _t21;
				void* _t32;
				intOrPtr* _t34;
				intOrPtr _t36;
				void* _t37;
				void* _t38;
				void* _t40;

				if(E6DF67D50() != 0) {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t21 = 0x7ffe0386;
				}
				_t40 = _a4;
				if( *_t21 != 0) {
					E6E019BBE(_t40,  *((intOrPtr*)(_t40 + 0x20)),  *((intOrPtr*)(_t40 + 0x24)),  *((intOrPtr*)(_t40 + 0x34)));
				}
				if(_a8 == 0 && ( *(_t40 + 0x1c) & 0x000000c0) != 0) {
					_push(2);
					_pop(0);
				}
				_t34 =  *((intOrPtr*)(_t40 + 0x14));
				_t36 =  *0x6e0386b8;
				if(_t34 == 0) {
					_t34 = _t36;
					if(0 == 0) {
						_t34 =  *0x6e0386c0;
					}
				}
				_t50 = _t34 -  *0x6e0386c0;
				if(_t34 !=  *0x6e0386c0) {
					__eflags = _t34 - _t36;
					if(__eflags != 0) {
						__eflags = 0xffffffff;
						asm("lock xadd [ecx], eax");
						if(0xffffffff == 0) {
							E6DF49240(_t32, _t34, _t38, _t40, 0xffffffff);
						}
						L11:
						if( *((intOrPtr*)(_t40 + 0x18)) != 0) {
							_push( *((intOrPtr*)(_t40 + 0x18)));
							E6DF895D0();
						}
						if( *((intOrPtr*)(_t40 + 0x28)) != 0xffffffff) {
							E6DF79B10( *((intOrPtr*)(_t40 + 0x28)));
						}
						if( *((intOrPtr*)(_t40 + 0x2c)) != 0) {
							E6DF50840(_t34,  *((intOrPtr*)(_t40 + 0x2c)));
						}
						return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t40);
					}
					_t37 = 0x6e0386bc;
					_t34 = 0x6e0386b8;
					L10:
					E6DF79B82(_t32, _t34, _t37, _t38, _t40, _t50);
					goto L11;
				}
				_t37 = 0x6e0386c4;
				_t34 = 0x6e0386c0;
				goto L10;
			}

0x6df44a31
0x6dfa0a89
0x6df44a37
0x6df44a37
0x6df44a37
0x6df44a3f
0x6df44a42
0x6dfa0a9e
0x6dfa0a9e
0x6df44a4d
0x6df44abf
0x6df44ac1
0x6df44ac1
0x6df44a55
0x6df44a58
0x6df44a60
0x6df44a62
0x6df44a66
0x6df44a68
0x6df44a68
0x6df44a66
0x6df44a6e
0x6df44a74
0x6dfa0aa8
0x6dfa0aaa
0x6dfa0abb
0x6dfa0abe
0x6dfa0ac2
0x6dfa0ac8
0x6dfa0ac8
0x6df44a89
0x6df44a8d
0x6dfa0ad2
0x6dfa0ad5
0x6dfa0ad5
0x6df44a97
0x6dfa0ae2
0x6dfa0ae2
0x6df44aa1
0x6dfa0aef
0x6dfa0aef
0x6df44abc
0x6df44abc
0x6dfa0aac
0x6dfa0ab1
0x6df44a84
0x6df44a84
0x00000000
0x6df44a84
0x6df44a7a
0x6df44a7f
0x00000000

APIs

RtlGetCurrentServiceSessionId.9419 ref: 6DF44A2A
RtlFreeHeap.9419(?,00000000,?), ref: 6DF44AB3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFreeHeapServiceSession
String ID:
API String ID: 1159841122-0
Opcode ID: 8ad62814624d8e0e8d5f3cacd7b973b340ce7db2b01bbaef21df8b5161d2c9eb
Instruction ID: 1363935385045212dae722d0992fe05d545eac1720629ac0ba413bceb0e4af3a
Opcode Fuzzy Hash: 8ad62814624d8e0e8d5f3cacd7b973b340ce7db2b01bbaef21df8b5161d2c9eb
Instruction Fuzzy Hash: A7210731259A03CBC732DE2DE800B163BB5FB49324F24C669D4569E5E2DBB0A941CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6DF528AE, Relevance: 7.6, APIs: 5, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF528AE(signed int __edx) {
				void* _t14;
				char* _t17;
				signed char* _t27;
				void* _t31;
				signed int _t35;
				signed char* _t37;
				char* _t39;

				_t35 = __edx;
				_t14 = E6DF67D50();
				_t39 = 0x7ffe0384;
				if(_t14 != 0) {
					_t17 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t17 = 0x7ffe0384;
				}
				_t37 = 0x7ffe0385;
				if( *_t17 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(E6DF67D50() == 0) {
							_t27 = 0x7ffe0385;
						} else {
							_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t27 & 0x00000020) != 0) {
							L6DFC7016(0x1480, _t35, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				_t31 = L6DF5EEF0(0x6e035350);
				if(E6DF67D50() != 0) {
					_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t39 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(E6DF67D50() != 0) {
							_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t37 & 0x00000020) != 0) {
							L6DFC7016(0x1481, _t35 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				return _t31;
			}

0x6df528ae
0x6df528b3
0x6df528b8
0x6df528bf
0x6dfa7692
0x6df528c5
0x6df528c5
0x6df528c5
0x6df528ca
0x6df528cf
0x6dfa76a9
0x6dfa76b6
0x6dfa76c8
0x6dfa76b8
0x6dfa76c1
0x6dfa76c1
0x6dfa76cd
0x6dfa76e3
0x6dfa76e3
0x6dfa76cd
0x6dfa76a9
0x6df528df
0x6df528e8
0x6dfa76f7
0x6dfa76f7
0x6df528f1
0x6dfa770f
0x6dfa771c
0x6dfa7727
0x6dfa7727
0x6dfa7730
0x6dfa7746
0x6dfa7746
0x6dfa7730
0x6dfa770f
0x6df528fc

APIs

RtlGetCurrentServiceSessionId.9419(00000000,?,6E0384D8,6DF50924,6E0384D8,?,6E0384D8,?,00000000,?,?,?,6DF5087C,?,?,?), ref: 6DF528B3
RtlEnterCriticalSection.9419(6E035350), ref: 6DF528DA
RtlGetCurrentServiceSessionId.9419(6E035350), ref: 6DF528E1
RtlGetCurrentServiceSessionId.9419 ref: 6DFA76AF

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 68f8eb779e3517bc5dfccaa501821e7c571a363f7e05c2ad23be832120ce04a2
Instruction ID: 82239ae5a89c08dc74838147309f1bf3da7759a2b0dc3c05b97eb3538716e1d0
Opcode Fuzzy Hash: 68f8eb779e3517bc5dfccaa501821e7c571a363f7e05c2ad23be832120ce04a2
Instruction Fuzzy Hash: AC210B32A596C2DBF32287AC8C04F243794AB01778F2947A1EA309BBE1DB699C54C251

Uniqueness

Uniqueness Score: -1.00%

Function 6E013E22, Relevance: 7.6, APIs: 5, Instructions: 62
nativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6E013E22(void* __ecx, signed char _a4, signed short _a8) {
				char _v8;
				intOrPtr _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				signed int _t18;
				intOrPtr _t24;
				signed char _t32;
				intOrPtr _t37;

				_t18 = _a8 & 0x0000ffff;
				if(_t18 == 0) {
					L7:
					_t37 = 6;
					goto L8;
				} else {
					_t32 = _a4;
					if((_t32 & 0x00000001) != 0 || _t18 !=  *((intOrPtr*)(_t32 + 0x34))) {
						goto L7;
					} else {
						_v20 =  *((intOrPtr*)(_t32 + 0x30));
						_push( &_v8);
						_push(0);
						_push(0);
						_push(8);
						_v16 = 0;
						_push( &_v20);
						_push(0x1a);
						_t24 = E6DF8B0B0();
						if(_t24 != 0) {
							_t37 = _t24;
							if(_t37 != 0) {
								L8:
								E6DF4CC50(_t37);
							} else {
								goto L6;
							}
						} else {
							_t37 = 0;
							L6:
							_t11 = _t32 + 0x24; // 0x6e038504
							E6DF62280(_t24, _t11);
							 *(_t32 + 0x2c) =  *( *[fs:0x18] + 0x24);
							 *(_t32 + 0x36) =  *(_t32 + 0x36) | 0x00008000;
							E6E015977(_t32);
							 *(_t32 + 0x2c) =  *(_t32 + 0x2c) & 0x00000000;
							E6DF5FFB0(_t32, _t37, _t11);
						}
					}
				}
				return _t37;
			}

0x6e013e27
0x6e013e34
0x6e013ea8
0x6e013eaa
0x00000000
0x6e013e36
0x6e013e36
0x6e013e3c
0x00000000
0x6e013e44
0x6e013e49
0x6e013e4f
0x6e013e50
0x6e013e51
0x6e013e52
0x6e013e57
0x6e013e5a
0x6e013e5b
0x6e013e5d
0x6e013e64
0x6e013e70
0x6e013e74
0x6e013eab
0x6e013eac
0x00000000
0x00000000
0x00000000
0x6e013e66
0x6e013e66
0x6e013e76
0x6e013e76
0x6e013e7a
0x6e013e8b
0x6e013e93
0x6e013e97
0x6e013e9c
0x6e013ea1
0x6e013ea1
0x6e013e64
0x6e013e3c
0x6e013eb9

APIs

ZwTraceControl.9419(0000001A,6E035338,00000008,00000000,00000000,?,6E035338,00000000,6E035320,6E035320,6E035338,?,6E0384E0,?,00000001,6DF25C80), ref: 6E013E5D
RtlNtStatusToDosError.9419(00000000,0000001A,6E035338,00000008,00000000,00000000,?,6E035338,00000000,6E035320,6E035320,6E035338,?,6E0384E0,?,00000001), ref: 6E013E6B
RtlAcquireSRWLockExclusive.9419(6E038504,00000000,0000001A,6E035338,00000008,00000000,00000000,?,6E035338,00000000,6E035320,6E035320,6E035338,?,6E0384E0), ref: 6E013E7A
RtlReleaseSRWLockExclusive.9419(6E038504,6E038504,00000000,0000001A,6E035338,00000008,00000000,00000000,?,6E035338,00000000,6E035320,6E035320,6E035338,?,6E0384E0), ref: 6E013EA1
RtlSetLastWin32Error.9419(00000006,6E035338,00000000,6E035320,6E035320,6E035338,?,6E0384E0,?,00000001,6DF25C80,6DF4591B), ref: 6E013EAC

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID:
API String ID: 1422652320-0
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: 34de0ab512bdbf2725708ac2ad316ded2805adb8a6429fcfe3b62a8fa6904f1e
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: 6011C47660C21466DB509FD9C884BDF7BE8EF89760F824165ED049F189DB38C9058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4F150, Relevance: 7.6, APIs: 5, Instructions: 59
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DF4F150(intOrPtr _a4, intOrPtr _a8) {
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _t35;
				void* _t37;

				_t37 = E6DF5A3E0( &_v12);
				_t35 = 0x18;
				if(_t37 >= 0) {
					_v36 = _t35;
					_v28 =  &_v12;
					_push( &_v36);
					_push(_a4);
					_v32 = 0;
					_push(_a8);
					_v24 = 0x640;
					_v20 = 0;
					_v16 = 0;
					_t37 = E6DF89600();
					RtlFreeUnicodeString( &_v12);
				}
				if(_t37 == 0xc0000034) {
					RtlInitUnicodeString( &_v12,  *0x6df21808);
					_v36 = _t35;
					_v28 =  &_v12;
					_push( &_v36);
					_push(_a4);
					_v32 = 0;
					_push(_a8);
					_v24 = 0x640;
					_v20 = 0;
					_v16 = 0;
					_t37 = E6DF89600();
				}
				return _t37;
			}

0x6df4f164
0x6df4f16a
0x6df4f16d
0x6df4f172
0x6df4f175
0x6df4f17b
0x6df4f17c
0x6df4f17f
0x6df4f182
0x6df4f185
0x6df4f18c
0x6df4f18f
0x6df4f197
0x6df4f19d
0x6df4f19d
0x6df4f1a8
0x6dfa59f5
0x6dfa59fd
0x6dfa5a00
0x6dfa5a06
0x6dfa5a07
0x6dfa5a0a
0x6dfa5a0d
0x6dfa5a10
0x6dfa5a17
0x6dfa5a1a
0x6dfa5a22
0x6dfa5a22
0x6df4f1b6

APIs

RtlFormatCurrentUserKeyPath.9419(?,02000000,?,00000000), ref: 6DF4F15F

Part of subcall function 6DF5A3E0: ZwQueryInformationToken.9419(000000FA,00000001,?,00000050,?,?), ref: 6DF5A404
Part of subcall function 6DF5A3E0: RtlLengthSidAsUnicodeString.9419(?,?,000000FA,00000001,?,00000050,?,?), ref: 6DF5A414
Part of subcall function 6DF5A3E0: RtlAppendUnicodeToString.9419(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6DF5A443
Part of subcall function 6DF5A3E0: RtlConvertSidToUnicodeString.9419(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6DF5A469

RtlFreeUnicodeString.9419(?,?,?,?,?,02000000,?,00000000), ref: 6DF4F19D

Part of subcall function 6DF62400: RtlDeleteBoundaryDescriptor.9419(?,00000000,?,6DFD8405,?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?), ref: 6DF62412

ZwOpenKey.9419(?,?,?,?,02000000,?,00000000), ref: 6DF4F192

Part of subcall function 6DF89600: LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendBoundaryConvertCurrentDeleteDescriptorFormatFreeInformationInitializeLengthOpenPathQueryThunkTokenUser
String ID:
API String ID: 1101908438-0
Opcode ID: 1bb3a0e932e85e49ec910ef20db352bc90be7bcc7d98f89dcdffc151de662581
Instruction ID: 15b5012120b1665f3ecec8f613df29162569479bd8fbaf64f4109b73b012194f
Opcode Fuzzy Hash: 1bb3a0e932e85e49ec910ef20db352bc90be7bcc7d98f89dcdffc151de662581
Instruction Fuzzy Hash: 1D11B472C0021DABDF119F9AC8848EEFFB9EB88254F018166E915A7210D7359A55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7D4B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E6DF7D4B0(long* __ecx, signed int __edx, void* _a4) {
				signed int _v8;
				void* _t17;
				long* _t26;
				signed int _t29;
				void* _t34;
				signed int _t41;

				_push(__ecx);
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t26 = __ecx;
				_t41 = __edx;
				if(__ecx == 0 || __edx == 0) {
					_push(_t41);
					_push(_t26);
					E6DFD5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Map        : 0x%p\nSXS:    EntryCount : 0x%lx\n", "RtlpInitializeAssemblyStorageMap");
					_t17 = 0xc000000d;
				} else {
					_t34 = _a4;
					if(_t34 == 0) {
						_t29 = 4;
						_t17 = E6DF7F3D5( &_v8, __edx * _t29, __edx * _t29 >> 0x20);
						if(_t17 >= 0) {
							_t34 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _v8);
							if(_t34 != 0) {
								_v8 = 1;
								goto L3;
							} else {
								_t17 = 0xc0000017;
							}
						}
					} else {
						L3:
						if(_t41 != 0) {
							memset(_t34, 0, _t41 << 2);
						}
						 *_t26 = _v8;
						_t17 = 0;
						_t26[1] = _t41;
						_t26[2] = _t34;
					}
				}
				return _t17;
			}

0x6df7d4b5
0x6df7d4b6
0x6df7d4b7
0x6df7d4bd
0x6df7d4bf
0x6df7d4c4
0x6dfbb0b0
0x6dfbb0b1
0x6dfbb0c0
0x6dfbb0c8
0x6df7d4d2
0x6df7d4d2
0x6df7d4d7
0x6dfbb06a
0x6dfbb074
0x6dfbb07b
0x6dfbb094
0x6dfbb098
0x6dfbb0a4
0x00000000
0x6dfbb09a
0x6dfbb09a
0x6dfbb09a
0x6dfbb098
0x6df7d4dd
0x6df7d4dd
0x6df7d4df
0x6df7d4e7
0x6df7d4e7
0x6df7d4ec
0x6df7d4ee
0x6df7d4f0
0x6df7d4f3
0x6df7d4f3
0x6df7d4d7
0x6df7d4fc

APIs

RtlAllocateHeap.9419(?,00000000,00000000,?,?,?,00000234,00000000,00000000,00000000,?,6DF7C8DC,0000000C,?), ref: 6DFBB08F
DbgPrintEx.9419(00000033,00000000,SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx,RtlpInitializeAssemblyStorageMap,00000000,?,?,00000234,00000000,00000000,00000000,?,6DF7C8DC,0000000C,?), ref: 6DFBB0C0

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 6DFBB0B2
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 6DFBB0B7

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrint
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 3766636288-2653619699
Opcode ID: 0e3db847b7e62814b5747012b4d5cf75706ed0c7ecd33615919b25c6400be8e8
Instruction ID: 8a67b971e6025a84afd9ec8d29c05dcb08906faa95933a8ed1c3249a8c1d3143
Opcode Fuzzy Hash: 0e3db847b7e62814b5747012b4d5cf75706ed0c7ecd33615919b25c6400be8e8
Instruction Fuzzy Hash: 2011C672B04215FBE725CE4DED80FBB76A9DBC5754F19806ABA049B240E671DE0083A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DFD176C(signed int __ecx) {
				char _v8;
				char* _v12;
				short _v14;
				char _v16;
				signed int _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				intOrPtr _v48;
				char _v52;
				short _t22;
				short _t23;
				void* _t27;
				void* _t29;
				signed int _t38;

				_t22 = 0x46;
				_v16 = _t22;
				_t23 = 0x48;
				_v14 = _t23;
				_t38 = __ecx;
				_v12 = L"\\KernelObjects\\SystemErrorPortReady";
				_v44 =  &_v16;
				_push( &_v52);
				_push(0x100001);
				_v52 = 0x18;
				_push( &_v8);
				_v48 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_t27 = E6DF89900();
				if(_t27 >= 0) {
					if(__ecx != 0xffffffff) {
						_v28 = __ecx * 0xffffd8f0;
						_v24 = __ecx * 0xffffd8f0 >> 0x20;
					}
					asm("sbb esi, esi");
					_push( ~(_t38 + 1) &  &_v28);
					_push(0);
					_push(_v8);
					_t29 = E6DF89520();
					_push(_v8);
					E6DF895D0();
					return _t29;
				}
				return _t27;
			}

0x6dfd1778
0x6dfd177b
0x6dfd1781
0x6dfd1782
0x6dfd1786
0x6dfd178b
0x6dfd1792
0x6dfd1798
0x6dfd1799
0x6dfd17a1
0x6dfd17a8
0x6dfd17a9
0x6dfd17ac
0x6dfd17af
0x6dfd17b2
0x6dfd17b5
0x6dfd17bc
0x6dfd17c1
0x6dfd17cc
0x6dfd17cf
0x6dfd17cf
0x6dfd17d8
0x6dfd17dc
0x6dfd17dd
0x6dfd17de
0x6dfd17e1
0x6dfd17e6
0x6dfd17eb
0x00000000
0x6dfd17f0
0x6dfd17f7

APIs

ZwOpenEvent.9419(00000568,00100001,?,?,00000000), ref: 6DFD17B5
ZwWaitForSingleObject.9419(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6DFD17E1
ZwClose.9419(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6DFD17EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6DFD178B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: 7b23977daa358ca7c353a738e07c233dc76fcf600f6f6d3a331901981f5fb42f
Instruction ID: 0026062b5e5fae95d576564c498e7867b93fa2bc5520e3d198608bbff9c807a4
Opcode Fuzzy Hash: 7b23977daa358ca7c353a738e07c233dc76fcf600f6f6d3a331901981f5fb42f
Instruction Fuzzy Hash: 81113075D1021CAACB10CFA99841AEEFBF8EF89210F11426BE914F7290E7704E05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4429E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51librarynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.9419(?,\DllNXOptions,?,?,00000000), ref: 6DF442C7

Part of subcall function 6DF80F48: ZwOpenKey.9419(?,?,00000018), ref: 6DF81015

ZwClose.9419(?,?,?,?,\DllNXOptions,?,?,00000000), ref: 6DFA068E
LdrQueryImageFileKeyOption.9419(?,?,00000004,?,00000004,?,?,?,00000000), ref: 6DFA06A6

Strings

\DllNXOptions, xrefs: 6DF442BE

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileImageInitOpenOptionQueryStringUnicode
String ID: \DllNXOptions
API String ID: 166309601-742623237
Opcode ID: 1462957f9fb8ea1d0ce0f8a81c3ed030da0a82411937ac0410690c59c61a85d5
Instruction ID: 979891dd0ee1c786fbfbdb39457ca6314a5fa9419e05b3b83893689c8df07196
Opcode Fuzzy Hash: 1462957f9fb8ea1d0ce0f8a81c3ed030da0a82411937ac0410690c59c61a85d5
Instruction Fuzzy Hash: 1C01F776A00119BBCB11CA9D9C01D9F77BCEF85328F1540A5EA08EB241D7709E0583E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF58800, Relevance: 6.2, APIs: 4, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DF58800(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t62;
				signed int _t66;
				void* _t67;
				void* _t69;
				signed int _t70;
				intOrPtr _t74;
				signed int _t78;
				signed int _t85;
				intOrPtr* _t88;
				signed int _t93;
				signed int _t95;
				signed int _t98;
				signed int _t100;
				signed int _t106;
				signed int* _t110;
				signed int _t114;
				signed int* _t118;
				intOrPtr _t119;
				signed int _t123;
				signed int _t125;

				_t119 = __ecx;
				_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_t106 = 0;
				_v20 = __ecx;
				_t88 = 0;
				if(_t62 != 0) {
					_t88 = _t62 + 0x5d8;
					if(_t88 == 0 ||  *((intOrPtr*)(_t88 + 0x30)) == 0) {
						_t88 = 0;
					}
				}
				_v28 = 0;
				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				if(_t88 == 0 || _t119 == 0) {
					L13:
					return _t106;
				} else {
					if( *((intOrPtr*)(_t88 + 8)) == 0) {
						L12:
						_t106 = 1;
						goto L13;
					}
					_t11 = _t88 + 0x40; // 0x40
					_t117 = _t11;
					E6DF58999(_t11,  &_v12);
					if(_a4 != 0) {
						__eflags = _a4 - 1;
						if(_a4 != 1) {
							goto L12;
						}
						_t92 =  *(_t119 + 0x64);
						__eflags =  *(_t119 + 0x64);
						if( *(_t119 + 0x64) == 0) {
							goto L12;
						}
						E6DF58999(_t92,  &_v8);
						_t110 = _v8;
						_t66 = 0;
						__eflags = 0;
						_t93 =  *_t110;
						while(1) {
							__eflags =  *((intOrPtr*)(0x6e035c60 + _t66 * 8)) - _t93;
							if( *((intOrPtr*)(0x6e035c60 + _t66 * 8)) == _t93) {
								break;
							}
							_t66 = _t66 + 1;
							__eflags = _t66 - 5;
							if(_t66 < 5) {
								continue;
							}
							_t95 = 0;
							__eflags = 0;
							L27:
							__eflags = _t95;
							if(_t95 != 0) {
								goto L12;
							}
							__eflags = _v12 - _t110;
							if(_v12 != _t110) {
								goto L12;
							}
							E6DF62280(_t67, 0x6e0386cc);
							_t69 = E6E019DFB( &_v16);
							__eflags = _t69 - 1;
							if(_t69 != 1) {
							}
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							 *_t88 =  *_t88 + 1;
							asm("adc dword [ebx+0x4], 0x0");
							_t70 = E6DF761A0( &_v28);
							__eflags = _t70;
							if(_t70 == 0) {
								L20:
								 *_t88 =  *_t88 + 1;
								asm("adc dword [ebx+0x4], 0x0");
								E6DF5FFB0(_t88, _t117, 0x6e0386cc);
								goto L12;
							}
							__eflags = _v28 | _v24;
							if((_v28 | _v24) == 0) {
								goto L20;
							}
							_t55 = _t88 + 0x40; // 0x3f
							_t98 = _t55;
							L40:
							_t74 = _v20;
							_t57 = _t74 + 0x28; // 0x0
							_t58 = _t74 + 0x24; // 0x0
							E6E019D2E(_t98, 1, _v28, _v24,  *_t58 & 0x0000ffff,  *_t57);
							goto L20;
						}
						_t67 = 0x6e035c64 + _t66 * 8;
						asm("lock xadd [eax], ecx");
						_t95 = (_t93 | 0xffffffff) - 1;
						goto L27;
					}
					_t106 = E6DF58A0A( *((intOrPtr*)(_t119 + 0x18)),  &_v8);
					if(_t106 == 0) {
						goto L13;
					}
					_t118 = _v8;
					_t78 = 0;
					_t17 =  &(_t118[1]); // 0x6e0384dc
					_t100 = _t17;
					 *(_t119 + 0x64) = _t100;
					_t114 =  *_t118;
					_v16 = _t100;
					while( *((intOrPtr*)(0x6e035c60 + _t78 * 8)) != _t114) {
						_t78 = _t78 + 1;
						if(_t78 < 5) {
							continue;
						}
						L11:
						if(E6DF8F380(_t100, 0x6df21184, 0x10) != 0) {
							__eflags =  *_t118 -  *_v12;
							if( *_t118 >=  *_v12) {
								goto L12;
							}
							asm("cdq");
							_t123 = _t118[5] & 0x0000ffff;
							_t83 = _t118[5] & 0x0000ffff;
							asm("cdq");
							_t125 = _t123 << 0x00000010 | _t118[5] & 0x0000ffff;
							__eflags = ((_t114 << 0x00000020 | _t123) << 0x10 | _t114) -  *((intOrPtr*)(_t88 + 0x2c));
							if(__eflags > 0) {
								L19:
								E6DF62280(_t83, 0x6e0386cc);
								 *_t88 =  *_t88 + 1;
								_t34 = _t88 + 0x40; // 0x3f
								_t117 = _t34;
								asm("adc dword [ebx+0x4], 0x0");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 = E6DF761A0( &_v28);
								__eflags = _t85;
								if(_t85 != 0) {
									__eflags = _v28 | _v24;
									if((_v28 | _v24) == 0) {
										goto L20;
									}
									_t98 = _v16;
									goto L40;
								}
								goto L20;
							}
							if(__eflags < 0) {
								goto L12;
							}
							__eflags = _t125 -  *((intOrPtr*)(_t88 + 0x28));
							if(_t125 <  *((intOrPtr*)(_t88 + 0x28))) {
								goto L12;
							}
							goto L19;
						}
						goto L12;
					}
					asm("lock inc dword [eax]");
					goto L11;
				}
			}

0x6df58810
0x6df58814
0x6df5881a
0x6df5881c
0x6df5881f
0x6df58824
0x6df58826
0x6df5882e
0x6dfa9c48
0x6dfa9c48
0x6df5882e
0x6df5883d
0x6df58840
0x6df58843
0x6df58846
0x6df58849
0x6df5884e
0x6df588b7
0x6df588bf
0x6df58854
0x6df58857
0x6df588b4
0x6df588b6
0x00000000
0x6df588b6
0x6df58859
0x6df58859
0x6df58861
0x6df5886a
0x6df5893d
0x6df58941
0x00000000
0x00000000
0x6df58947
0x6df5894a
0x6df5894c
0x00000000
0x00000000
0x6df58955
0x6df5895a
0x6df5895d
0x6df5895d
0x6df5895f
0x6df58961
0x6df58961
0x6df58968
0x00000000
0x00000000
0x6df5896a
0x6df5896b
0x6df5896e
0x00000000
0x00000000
0x6df58970
0x6df58970
0x6df58972
0x6df58972
0x6df58974
0x00000000
0x00000000
0x6df5897a
0x6df5897d
0x00000000
0x00000000
0x6dfa9c65
0x6dfa9c6d
0x6dfa9c72
0x6dfa9c75
0x6dfa9c75
0x6dfa9c82
0x6dfa9c86
0x6dfa9c87
0x6dfa9c88
0x6dfa9c89
0x6dfa9c8c
0x6dfa9c90
0x6dfa9c95
0x6dfa9c97
0x6df58927
0x6df58927
0x6df5892f
0x6df58933
0x00000000
0x6df58933
0x6dfa9ca0
0x6dfa9ca3
0x00000000
0x00000000
0x6dfa9ca9
0x6dfa9ca9
0x6dfa9cac
0x6dfa9cac
0x6dfa9cb2
0x6dfa9cb5
0x6dfa9cc0
0x00000000
0x6dfa9cc0
0x6df58988
0x6df58992
0x6df58996
0x00000000
0x6df58996
0x6df5887b
0x6df5887f
0x00000000
0x00000000
0x6df58881
0x6df58884
0x6df58886
0x6df58886
0x6df58889
0x6df5888c
0x6df5888e
0x6df58891
0x6df5889a
0x6df5889e
0x00000000
0x00000000
0x6df588a0
0x6df588b2
0x6df588d3
0x6df588d5
0x00000000
0x00000000
0x6df588db
0x6df588dc
0x6df588e0
0x6df588e8
0x6df588ee
0x6df588f0
0x6df588f3
0x6df588fc
0x6df58901
0x6df58906
0x6df5890c
0x6df5890c
0x6df5890f
0x6df58916
0x6df58917
0x6df58918
0x6df58919
0x6df5891a
0x6df5891f
0x6df58921
0x6dfa9c52
0x6dfa9c55
0x00000000
0x00000000
0x6dfa9c5b
0x00000000
0x6dfa9c5b
0x00000000
0x6df58921
0x6df588f5
0x00000000
0x00000000
0x6df588f7
0x6df588fa
0x00000000
0x00000000
0x00000000
0x6df588fa
0x00000000
0x6df588b2
0x6df588c9
0x00000000
0x6df588c9

APIs

memcmp.9419(6E0384DC,6DF21184,00000010,-00000054,?,00000000,00000001,?,6E0352D8), ref: 6DF588A8
RtlAcquireSRWLockExclusive.9419(6E0386CC,-00000054,?,00000000,00000001,?,6E0352D8), ref: 6DF58901
RtlReleaseSRWLockExclusive.9419(6E0386CC,6E0386CC,-00000054,?,00000000,00000001,?,6E0352D8), ref: 6DF58933
RtlAcquireSRWLockExclusive.9419(6E0386CC,-00000054,?,00000000,00000001,?,6E0352D8), ref: 6DFA9C65

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Acquire$Releasememcmp
String ID:
API String ID: 2792186644-0
Opcode ID: a27c20aca0e6796c5ff56ebe2a448291ed2be6e60fdcce45bcd04bd9741ce214
Instruction ID: 7f6849f30590f0b6e60347bf765dd240062b27edc2a90b5413ac5999b8a520e7
Opcode Fuzzy Hash: a27c20aca0e6796c5ff56ebe2a448291ed2be6e60fdcce45bcd04bd9741ce214
Instruction Fuzzy Hash: 2A510131A2460BDFEF08CF5CC480ABA77B5FF9130AF5580A9D805AB241DB31AA10CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E00B581, Relevance: 6.2, APIs: 4, Instructions: 163
nativeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E6E00B581(char __ecx) {
				signed int _v8;
				signed int _v11;
				intOrPtr _v15;
				short _v41;
				char _v47;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v55;
				signed int _v56;
				char _v60;
				intOrPtr _v63;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				signed int _t60;
				char* _t66;
				void* _t67;
				signed int _t87;
				signed int _t88;
				void* _t89;
				signed char _t91;
				intOrPtr* _t98;
				signed int _t107;
				signed int _t108;
				signed int _t114;
				signed int _t115;
				char _t117;
				void* _t120;
				signed int* _t123;
				void* _t124;
				signed int _t128;
				signed int _t129;

				_t131 = (_t129 & 0xfffffff8) - 0x3c;
				_v8 =  *0x6e03d360 ^ (_t129 & 0xfffffff8) - 0x0000003c;
				_t117 = __ecx;
				_v60 = __ecx;
				_t91 =  *((intOrPtr*)(__ecx + 0x38));
				_t54 =  *(__ecx + 0x34);
				_t87 = _t91 & 1;
				if(_t54 == 0) {
					L17:
					 *(_t117 + 0x34) =  *(_t117 + 0x34) & 0x00000000;
					 *(_t117 + 0x38) =  *(_t117 + 0x38) & 0x00000000;
					if((_t91 & 0x00000001) != 0) {
						 *(_t117 + 0x38) = 1;
					}
					_t118 = _v60;
					_t88 = _v60 + 0xe8;
					while(1) {
						_t122 =  *_t88;
						if( *_t88 == 0) {
							break;
						}
						E6E012EF7(_t118 + 0xd8, _t122 ^ _t88);
						E6E013209(_t118 + 0xd8, _t122 ^ _t88, 1);
					}
					E6E00CB82(_v60 + 0x118);
					E6E00FA96();
					E6E00FA96();
					_t98 = _v60;
					_v48 =  *((intOrPtr*)(_t98 + 4));
					_t60 =  *((intOrPtr*)(_t98 + 0xd4)) - _t98;
					_v52 =  *_t98;
					_v56 = _t60;
					_push( *((intOrPtr*)(_t98 + 4)));
					_push( *_t98);
					if(( *(_t98 + 0x2c) & 0x00000001) == 0) {
						asm("sbb eax, eax");
						_push((_t60 & 0x01000000) + 0x8000);
						L6E00AFDE( &_v60,  &_v56);
					} else {
						E6E00BCD2(_t98);
					}
					E6E00C23A( &_v55, 0);
					if(E6DF67D50() == 0) {
						_t66 = 0x7ffe0388;
					} else {
						_t66 = ( *[fs:0x30])[0x14] + 0x22e;
					}
					if( *_t66 != 0) {
						E6DFFFDD3(_v63);
					}
					_t67 = E6DF67D50();
					_t123 = 0x7ffe0380;
					if(_t67 == 0) {
						_t68 = 0x7ffe0380;
					} else {
						_t68 = ( *[fs:0x30])[0x14] + 0x226;
					}
					if( *_t68 != 0) {
						_t68 =  *[fs:0x30];
						if((( *[fs:0x30])[0x90] & 0x00000001) != 0) {
							if(E6DF67D50() != 0) {
								_t123 = ( *[fs:0x30])[0x14] + 0x226;
							}
							_v15 = _v63;
							_v41 = 0x1023;
							_push( &_v47);
							_push(4);
							_push(0x402);
							_push( *_t123 & 0x000000ff);
							_t68 = E6DF89AE0();
						}
					}
					_pop(_t120);
					_pop(_t124);
					_pop(_t89);
					return E6DF8B640(_t68, _t89, _v11 ^ _t131, 0, _t120, _t124);
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t107 =  *_t54;
					if(_t107 != 0) {
						break;
					}
					_t108 =  *(_t54 + 4);
					if(_t108 == 0) {
						_t128 =  *(_t54 + 8) & 0xfffffffc;
						if(_t87 != 0 && _t128 != 0) {
							_t128 = _t128 ^ _t54;
						}
						E6E00E962(_t108, _t54, _t117);
						if(_t128 == 0) {
							_t91 =  *(_t117 + 0x38);
							goto L17;
						} else {
							_t54 = _t128;
							continue;
						}
					}
					_t115 = _t54;
					if(_t87 == 0) {
						_t54 = _t108;
					} else {
						_t54 = _t54 ^ _t108;
					}
					 *(_t115 + 4) =  *(_t115 + 4) & 0x00000000;
				}
				_t114 = _t54;
				if(_t87 == 0) {
					_t54 = _t107;
				} else {
					_t54 = _t54 ^ _t107;
				}
				 *_t114 =  *_t114 & 0x00000000;
				goto L1;
			}

0x6e00b589
0x6e00b593
0x6e00b59a
0x6e00b59c
0x6e00b5a0
0x6e00b5a3
0x6e00b5a9
0x6e00b5ae
0x6e00b602
0x6e00b602
0x6e00b606
0x6e00b60d
0x6e00b60f
0x6e00b60f
0x6e00b613
0x6e00b617
0x6e00b61d
0x6e00b61d
0x6e00b621
0x00000000
0x00000000
0x6e00b62d
0x6e00b63c
0x6e00b63c
0x6e00b64d
0x6e00b659
0x6e00b668
0x6e00b66d
0x6e00b676
0x6e00b680
0x6e00b682
0x6e00b686
0x6e00b68e
0x6e00b691
0x6e00b693
0x6e00b6a7
0x6e00b6b3
0x6e00b6b4
0x6e00b695
0x6e00b695
0x6e00b695
0x6e00b6bf
0x6e00b6cb
0x6e00b6dd
0x6e00b6cd
0x6e00b6d6
0x6e00b6d6
0x6e00b6e5
0x6e00b6eb
0x6e00b6eb
0x6e00b6f0
0x6e00b6f5
0x6e00b701
0x6e00b710
0x6e00b703
0x6e00b70c
0x6e00b70c
0x6e00b715
0x6e00b717
0x6e00b724
0x6e00b72d
0x6e00b738
0x6e00b738
0x6e00b740
0x6e00b749
0x6e00b752
0x6e00b753
0x6e00b755
0x6e00b75d
0x6e00b75e
0x6e00b75e
0x6e00b724
0x6e00b767
0x6e00b768
0x6e00b769
0x6e00b774
0x00000000
0x00000000
0x00000000
0x6e00b5b0
0x6e00b5b0
0x6e00b5b0
0x6e00b5b4
0x00000000
0x00000000
0x6e00b5c7
0x6e00b5cc
0x6e00b5e3
0x6e00b5e8
0x6e00b5ee
0x6e00b5ee
0x6e00b5f2
0x6e00b5f9
0x6e00b5ff
0x00000000
0x6e00b5fb
0x6e00b5fb
0x00000000
0x6e00b5fb
0x6e00b5f9
0x6e00b5ce
0x6e00b5d2
0x6e00b5d8
0x6e00b5d4
0x6e00b5d4
0x6e00b5d4
0x6e00b5da
0x6e00b5da
0x6e00b5b6
0x6e00b5ba
0x6e00b5c0
0x6e00b5bc
0x6e00b5bc
0x6e00b5bc
0x6e00b5c2
0x00000000

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6DF9FC28), ref: 6E00B6C4
RtlGetCurrentServiceSessionId.9419(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6DF9FC28), ref: 6E00B6F0
RtlGetCurrentServiceSessionId.9419 ref: 6E00B726
ZwTraceEvent.9419(?,00000402,00000004,?), ref: 6E00B75E

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: 3fbb66233ba0a84819bc68b8c77dd5bc61d60f883b23773e5474894e714a70c0
Instruction ID: 601b9f87832f05d6f6d1d34309e316f4ea8f477272a415623d5a3b1695323763
Opcode Fuzzy Hash: 3fbb66233ba0a84819bc68b8c77dd5bc61d60f883b23773e5474894e714a70c0
Instruction Fuzzy Hash: F151E231608B438FF341CFA9C5A0BAAB7E4FF41348F1409A9E9558B695EB34E805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF41AA0, Relevance: 6.1, APIs: 4, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.9419(?,00000008,00000000,?,00000000,?,?,00000000,C0000017), ref: 6DF41B1E
ZwAllocateVirtualMemory.9419(000000FF,?,00000000,?,00002000,00000004,00000000,?,?,00000000,C0000017,?,?,6DF416E0), ref: 6DF41B83
ZwAllocateVirtualMemory.9419(000000FF,6DF416E0,00000000,C0000017,00001000,00000004,00000000,?,?,00000000,C0000017,?,?,6DF416E0), ref: 6DF41BBD
RtlAllocateHeap.9419(?,00000008,?,00000000,?,?,00000000,C0000017), ref: 6DF41BD8

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Allocate$HeapMemoryVirtual
String ID:
API String ID: 1343662020-0
Opcode ID: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction ID: 09863113dd2ef35856b8ddda472074e1537719997337319a216e21b03294f67c
Opcode Fuzzy Hash: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction Fuzzy Hash: 71413071A04709EFD725CF9DC980AAABBF9FF08300B10856DE55ADB651E730EA54CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4F018, Relevance: 6.1, APIs: 4, Instructions: 95
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DF4F018(intOrPtr __ecx, void* __edx, intOrPtr* _a4, void* _a8, int* _a12) {
				long _v8;
				intOrPtr _v12;
				signed int _v16;
				int _t20;
				long _t21;
				int _t28;
				void* _t32;
				void* _t34;
				intOrPtr _t35;
				intOrPtr* _t36;
				void* _t39;
				void* _t40;
				int* _t41;

				_t35 = __ecx;
				_t41 = _a12;
				_t39 = __edx;
				_v12 = __ecx;
				if(_a8 == 0) {
					if(_t41 != 0) {
						L2:
						_t20 =  *_t41;
						L3:
						_v16 = _v16 & 0x00000000;
						_t21 = _t20 + 0xc;
						_v8 = _t21;
						if(_t21 == 0) {
							_t34 = 0;
						} else {
							_t32 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t21);
							_t35 = _v12;
							_t34 = _t32;
							_t21 = _v8;
						}
						if(_t34 == 0) {
							_t40 = 0xc000009a;
							goto L16;
						} else {
							_push( &_v16);
							_push(_t21);
							_push(_t34);
							_push(2);
							_push(_t39);
							_push(_t35);
							_t40 = E6DF89650();
							if(_t40 == 0xc0000034) {
								L13:
								if(_t40 >= 0) {
									L20:
									if(_t41 != 0) {
										 *_t41 =  *(_t34 + 8);
									}
									_t36 = _a4;
									if(_t36 != 0) {
										 *_t36 =  *((intOrPtr*)(_t34 + 4));
									}
									L15:
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t34);
									L16:
									return _t40;
								}
								L14:
								if(_t40 == 0x80000005) {
									goto L20;
								}
								goto L15;
							}
							if(_t40 < 0) {
								goto L14;
							}
							if(_a8 == 0 || _t41 == 0) {
								goto L13;
							} else {
								_t28 =  *(_t34 + 8);
								if(_t28 >  *_t41) {
									_t40 = 0x80000005;
									goto L20;
								} else {
									if(_t28 <= _v8) {
										_t14 = _t34 + 0xc; // 0xc
										memcpy(_a8, _t14, _t28);
									}
									goto L13;
								}
							}
						}
					}
					_t20 = 0;
					goto L3;
				}
				if(_t41 == 0) {
					return 0xc000000d;
				}
				goto L2;
			}

0x6df4f018
0x6df4f026
0x6df4f02a
0x6df4f02c
0x6df4f02f
0x6df4f0dd
0x6df4f03d
0x6df4f03d
0x6df4f03f
0x6df4f03f
0x6df4f043
0x6df4f046
0x6df4f049
0x6dfa59a5
0x6df4f04f
0x6df4f05b
0x6df4f060
0x6df4f063
0x6df4f065
0x6df4f065
0x6df4f06a
0x6dfa59ac
0x00000000
0x6df4f070
0x6df4f073
0x6df4f074
0x6df4f075
0x6df4f076
0x6df4f078
0x6df4f079
0x6df4f07f
0x6df4f087
0x6df4f0b3
0x6df4f0b5
0x6df4f0ea
0x6df4f0ec
0x6df4f0f1
0x6df4f0f1
0x6df4f0f3
0x6df4f0f8
0x6df4f0fd
0x6df4f0fd
0x6df4f0bf
0x6df4f0cb
0x6df4f0d0
0x00000000
0x6df4f0d0
0x6df4f0b7
0x6df4f0bd
0x00000000
0x00000000
0x00000000
0x6df4f0bd
0x6df4f08b
0x00000000
0x00000000
0x6df4f091
0x00000000
0x6df4f097
0x6df4f097
0x6df4f09c
0x6df4f101
0x00000000
0x6df4f09e
0x6df4f0a1
0x6df4f0a4
0x6df4f0ab
0x6df4f0b0
0x00000000
0x6df4f0a1
0x6df4f09c
0x6df4f091
0x6df4f06a
0x6df4f0e3
0x00000000
0x6df4f0e3
0x6df4f037
0x00000000
0x6dfa599b
0x00000000

APIs

RtlAllocateHeap.9419(?,00000008,?,?,00000000,?), ref: 6DF4F05B
ZwQueryValueKey.9419(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6DF4F07A
memcpy.9419(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6DF4F0AB
RtlFreeHeap.9419(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6DF4F0CB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy
String ID:
API String ID: 125101864-0
Opcode ID: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction ID: 0e7769e056c3f48ca81e7361606858daa98d2c5e24a77a24ebaf316b663dcfcc
Opcode Fuzzy Hash: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction Fuzzy Hash: AD31CE32A00505EFEB51CE8CC980B6A7BB9EFC4714F29C029A9199B202D370DD40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF46730, Relevance: 6.1, APIs: 4, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DF46730(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				void* _v24;
				void* _v40;
				void* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t32;
				char* _t35;
				char* _t42;
				char* _t51;
				void* _t52;
				signed int _t67;
				void* _t68;
				void* _t71;
				signed int _t73;

				_t75 = (_t73 & 0xfffffff8) - 0xc;
				_v8 =  *0x6e03d360 ^ (_t73 & 0xfffffff8) - 0x0000000c;
				_t70 = _a8;
				_t67 = _a8 - 0x78;
				_t32 = E6DF67D50();
				_t51 = 0x7ffe0386;
				if(_t32 != 0) {
					_t35 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t35 = 0x7ffe0386;
				}
				if( *_t35 != 0) {
					E6E0189E7( *((intOrPtr*)(_t67 + 0x5c)), _t70,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
				}
				_t64 = _t67;
				if(E6DF795EC(_a4, _t67, 1) != 0) {
					if(E6DF67D50() != 0) {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t42 = _t51;
					}
					if( *_t42 != 0) {
						E6E019CB3( *((intOrPtr*)(_t67 + 0x5c)), _t70,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					}
					_t64 =  *((intOrPtr*)(_t67 + 0x30));
					E6DF6C677(_t75 + 0x14,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					 *0x6e03b1e0(_a4,  *((intOrPtr*)(_t67 + 0x34)));
					 *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x30))))();
					if(E6DF67D50() != 0) {
						_t51 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					}
					if( *_t51 != 0) {
						_t64 = _a8;
						E6E018ADD( *((intOrPtr*)(_t67 + 0x5c)), _a8,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					}
					_t37 = E6DF6C5F8( *((intOrPtr*)(_t75 + 0x10)));
				}
				_pop(_t68);
				_pop(_t71);
				_pop(_t52);
				return E6DF8B640(_t37, _t52, _v8 ^ _t75, _t64, _t68, _t71);
			}

0x6df46738
0x6df46742
0x6df46748
0x6df4674c
0x6df4674f
0x6df46754
0x6df4675b
0x6dfa1aac
0x6df46761
0x6df46761
0x6df46761
0x6df46766
0x6dfa1ac4
0x6dfa1ac4
0x6df4676f
0x6df4677a
0x6df46783
0x6dfa1ad7
0x6df46789
0x6df46789
0x6df46789
0x6df4678e
0x6dfa1aef
0x6dfa1aef
0x6df46797
0x6df467a1
0x6df467b1
0x6df467b7
0x6df467c0
0x6dfa1b02
0x6dfa1b02
0x6df467c9
0x6dfa1b10
0x6dfa1b1c
0x6dfa1b1c
0x6df467d3
0x6df467d3
0x6df467dc
0x6df467dd
0x6df467de
0x6df467e9

APIs

RtlGetCurrentServiceSessionId.9419 ref: 6DF4674F
RtlGetCurrentServiceSessionId.9419(00000001), ref: 6DF4677C
RtlDebugPrintTimes.9419(?,?,?,?,00000001), ref: 6DF467B1
RtlGetCurrentServiceSessionId.9419 ref: 6DF467B9

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: dafbb590fa6b4585af15c365338d600b5b96db43f34f21c0d626ffb784b5d668
Instruction ID: ecc06d63a56499554dac0384110ea3047a9aeb261c76f9b1b6314459110a0325
Opcode Fuzzy Hash: dafbb590fa6b4585af15c365338d600b5b96db43f34f21c0d626ffb784b5d668
Instruction Fuzzy Hash: 1B31CF35618A46EFDB02DB68DA80A9ABBA1FF44354F419411ED004BE61DB31EC30CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF71DB5, Relevance: 6.1, APIs: 4, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E6DF71DB5(intOrPtr __ecx, void** __edx, long* _a4) {
				long _v8;
				intOrPtr _v12;
				void* _v16;
				void** _v20;
				void* _t22;
				long _t23;
				void* _t36;
				void* _t42;
				long _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = L6DF6F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					if(_t23 >  *_a4) {
						_t42 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(L6DF6F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x6df71dc2
0x6df71dc5
0x6df71dc7
0x6df71dcc
0x6df71dce
0x6df71dd6
0x6df71ddf
0x6df71de0
0x6df71de1
0x6df71de5
0x6df71de8
0x6df71def
0x6df71df0
0x6df71df6
0x6df71df7
0x6df71dfe
0x6df71e1a
0x00000000
0x00000000
0x6df71e0b
0x6df71e12
0x6df71e12
0x6df71e00
0x6df71e00
0x6df71e05
0x6df71e23
0x6dfb570f
0x6dfb5713
0x00000000
0x00000000
0x6dfb5719
0x6dfb5719
0x6df71e2c
0x6df71e2d
0x6df71e2e
0x6df71e2f
0x6df71e31
0x6df71e32
0x6df71e35
0x6df71e3d
0x6dfb5723
0x6dfb573d
0x6dfb573d
0x00000000
0x6dfb5723
0x6df71e49
0x6df71e4e
0x6df71e4e
0x6df71e09
0x00000000

APIs

RtlQueryInformationActivationContext.9419(-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?,?,?,00000040,-00000054,00000000), ref: 6DF71DF7
RtlQueryInformationActivationContext.9419(-40000003,-00000054,00000000,00000006,00000000,00000000,00000000,-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?), ref: 6DF71E36

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContextInformationQuery
String ID:
API String ID: 2130846384-0
Opcode ID: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction ID: 9462ee64a7f7a4077452c350b367edfdffe6ddf40cb791a583c6ef66e355a1a2
Opcode Fuzzy Hash: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction Fuzzy Hash: 26219F32640119EFD721CF5DEC90EABBBB9FF85644F215056E90097210D634AE01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6E01F1B5, Relevance: 6.1, APIs: 4, Instructions: 78
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6E01F1B5(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a4, void* _a8, int* _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _t26;
				int* _t32;
				intOrPtr* _t34;
				void* _t36;
				long _t38;
				void* _t39;

				_v8 = _v8 & 0x00000000;
				_t32 = _a12;
				_v12 = __edx;
				_v16 = __ecx;
				if(_t32 != 0) {
					_t38 =  *_t32 + 0xc;
					_t36 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t38);
					if(_t36 != 0) {
						_t39 =  *0x6df26cd4(_v16, _v12, 2, _t36, _t38,  &_v8);
						if(_t39 < 0) {
							L12:
							if(_t39 == 0x80000005 || _t39 == 0xc0000023) {
								L14:
								_t39 = 0xc0000023;
								 *_t32 =  *(_t36 + 8);
								goto L15;
							} else {
								L15:
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t36);
								return _t39;
							}
						}
						_t26 =  *(_t36 + 8);
						if(_t26 != 0) {
							if(_t26 >  *_t32) {
								goto L14;
							}
							 *_t32 = _t26;
							if(_a8 != 0) {
								_t12 = _t36 + 0xc; // 0xc
								memcpy(_a8, _t12, _t26);
							}
							_t34 = _a4;
							if(_t34 != 0) {
								 *_t34 =  *((intOrPtr*)(_t36 + 4));
							}
							goto L12;
						}
						_t39 = 0xc000000d;
						goto L15;
					}
					return 0xc000009a;
				}
				return 0xc000000d;
			}

0x6e01f1bd
0x6e01f1c2
0x6e01f1c5
0x6e01f1c8
0x6e01f1cf
0x6e01f1e3
0x6e01f1f1
0x6e01f1f5
0x6e01f212
0x6e01f216
0x6e01f24e
0x6e01f254
0x6e01f25e
0x6e01f261
0x6e01f266
0x00000000
0x6e01f268
0x6e01f268
0x6e01f274
0x00000000
0x6e01f279
0x6e01f254
0x6e01f218
0x6e01f21d
0x6e01f228
0x00000000
0x00000000
0x6e01f22e
0x6e01f230
0x6e01f233
0x6e01f23a
0x6e01f23f
0x6e01f242
0x6e01f247
0x6e01f24c
0x6e01f24c
0x00000000
0x6e01f247
0x6e01f21f
0x00000000
0x6e01f21f
0x00000000
0x6e01f1f7
0x00000000

APIs

RtlAllocateHeap.9419(?,00000008,-0000000B,00000002,00000001,00000000,6DF7FE70,00000000), ref: 6E01F1EC

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5cd3dedf4f050ef2fad6a011081f06d073f6ccf72e6760932d819df6e0244bc4
Instruction ID: c1afa2deaf472a5b5093c8673d538b6fa5f5ab217c2f4334711065733add1536
Opcode Fuzzy Hash: 5cd3dedf4f050ef2fad6a011081f06d073f6ccf72e6760932d819df6e0244bc4
Instruction Fuzzy Hash: 9F21D37AA08515AFDB119FC9C884F8ABBB8FF56750F214165ED249F614D3319D00CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF718B9, Relevance: 6.1, APIs: 4, Instructions: 75
nativetimeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6DF718B9(intOrPtr __ecx, intOrPtr __edx, signed char _a4) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _t27;
				intOrPtr* _t37;
				intOrPtr _t42;
				intOrPtr* _t43;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t53;

				_t50 = __ecx;
				_v12 = __edx;
				_push(0x100002);
				_v16 = __ecx;
				_push(8);
				_push(0);
				_push(0);
				_t3 = _t50 + 0x10; // 0x58
				_t52 = _t3;
				 *((intOrPtr*)(__ecx)) = 0;
				_push(_t52);
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				_t27 = E6DF8A0D0();
				if(_t27 >= 0) {
					_push(0);
					_t7 = _t50 + 0x14; // 0x5c
					_push(1);
					_t42 = E6DF8A130();
					_v20 = _t42;
					if(_t42 < 0) {
						_push( *_t52);
						E6DF895D0();
						return _t42;
					}
					_t45 = _v12;
					_push( &_v5);
					_t12 = _t50 + 0x18; // 0x60
					_t43 = _t12;
					_push(_a4 & 0x000000ff);
					_push(0);
					_push(_t45 + 0x40);
					_push(_t43);
					_push( *_t52);
					_push( *((intOrPtr*)(_t45 + 0x28)));
					_push( *((intOrPtr*)(__ecx + 0x14)));
					E6DF89DE0();
					_t17 = _t50 + 0x3c; // 0x84
					_t53 = _t17;
					 *((intOrPtr*)(__ecx + 0x38)) = 0x6df6af60;
					_t51 = __ecx + 0x40;
					E6DF6F194(_v12, _t53, _t51);
					_t47 = _v16;
					 *(_t47 + 0x2c) =  *(_t47 + 0x2c) & 0x00000000;
					_t22 = _t47 + 0x30; // 0x30
					_t37 = _t22;
					 *((intOrPtr*)(_t37 + 4)) = _t37;
					 *_t37 = _t37;
					 *((intOrPtr*)(_t47 + 0x1c)) =  *_t53;
					 *((char*)(_t47 + 0x20)) =  *_t51;
					 *_t43 = 0x6df211f4;
					return _v20;
				}
				return _t27;
			}

0x6df718c4
0x6df718c6
0x6df718c9
0x6df718d0
0x6df718d3
0x6df718d5
0x6df718d6
0x6df718d7
0x6df718d7
0x6df718da
0x6df718dc
0x6df718dd
0x6df718e0
0x6df718e3
0x6df718e6
0x6df718ed
0x6df718ef
0x6df718f0
0x6df718f3
0x6df718fb
0x6df718fd
0x6df71902
0x6dfb568e
0x6dfb5690
0x00000000
0x6dfb5695
0x6df71908
0x6df7190e
0x6df71913
0x6df71913
0x6df71916
0x6df71917
0x6df7191c
0x6df7191d
0x6df7191e
0x6df71920
0x6df71923
0x6df71926
0x6df7192e
0x6df7192e
0x6df71931
0x6df7193a
0x6df7193e
0x6df71943
0x6df71946
0x6df7194a
0x6df7194a
0x6df7194d
0x6df71950
0x6df71954
0x6df71959
0x6df7195f
0x00000000
0x6df7195f
0x6df7196b

APIs

ZwCreateTimer2.9419(00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6DF718E6
ZwCreateWaitCompletionPacket.9419(0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6DF718F6
ZwAssociateWaitCompletionPacket.9419(?,00000000,00000058,00000060,?,00000000,?,?,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002), ref: 6DF71926
ZwClose.9419(00000058,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6DFB5690

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CompletionCreatePacketWait$AssociateCloseTimer2
String ID:
API String ID: 56835937-0
Opcode ID: 4aa942623cf00e8a6160805c08fab2e2e6267b7e95ebdd9a03376b52be955528
Instruction ID: b2c18545770cc3eb33620d1cd2459a2fb8066bb32e4f010cdb745be83270397a
Opcode Fuzzy Hash: 4aa942623cf00e8a6160805c08fab2e2e6267b7e95ebdd9a03376b52be955528
Instruction Fuzzy Hash: 352174B1500209BFD700CF99C880E96BBF8FF48348F10816AE64497641D771E916CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF73B7A, Relevance: 6.1, APIs: 4, Instructions: 75
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DF73B7A(void* __ecx) {
				long _v8;
				char _v12;
				intOrPtr _v20;
				void* _t35;
				void* _t38;
				long _t39;
				void* _t41;
				intOrPtr _t44;

				_t39 =  *0x6e0384c0 * 0x4c;
				_v12 = 1;
				_v8 = _t39;
				_t41 = __ecx;
				_t35 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0x000c0000 | 0x00000008, _t39);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E6DF8AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						memset( *(_t41 + 0x20), 0,  *0x6e0384c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _t35 + _v8) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _t35 + _v8);
							_t44 = _v20;
						}
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000, _t35);
				}
				return _t44;
			}

0x6df73b82
0x6df73b96
0x6df73ba1
0x6df73bab
0x6df73bb5
0x6df73bb9
0x6dfb6298
0x6df73bbf
0x6df73bc2
0x6df73bc3
0x6df73bc9
0x6df73bca
0x6df73bcc
0x6df73bcd
0x6df73bd4
0x6df73bd6
0x6df73bdb
0x6df73bea
0x6df73bf7
0x6df73bfb
0x6df73bff
0x6df73c09
0x6df73c0a
0x6df73c0b
0x6df73c0f
0x6df73c14
0x6df73c18
0x6df73c18
0x6df73bfb
0x6df73c30
0x6df73c30
0x6df73c3d

APIs

RtlAllocateHeap.9419(?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6DF73BB0
ZwQuerySystemInformationEx.9419(0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6DF73BCF
memset.9419(6DFB43AB,00000000,?,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6DF73BEA
RtlFreeHeap.9419(?,?,00000000,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6DF73C30

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeInformationQuerySystemmemset
String ID:
API String ID: 21860560-0
Opcode ID: 484b0a01cf54861d01eea020ac8daa9a7c59f0270332b165e48ec22cbfe515ae
Instruction ID: 55732dd98b397fd4a2a28159b10493989c1412996f70274477c94d99b33e5508
Opcode Fuzzy Hash: 484b0a01cf54861d01eea020ac8daa9a7c59f0270332b165e48ec22cbfe515ae
Instruction Fuzzy Hash: 08217CB2A00509BFDB10CB5CDD81F9AB7BDFB45708F1500A9EA09EB691D371AD018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD6652, Relevance: 6.1, APIs: 4, Instructions: 74
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DFD6652(void* __ecx, void* __edx) {
				signed char _t23;
				void* _t35;
				void* _t37;
				void* _t42;

				_push(__ecx);
				_t42 = __ecx;
				_t35 = __edx;
				if(__ecx != 0) {
					_t23 =  *0x6e036db0;
					_t45 = 0xc0000001;
					if(_t23 != 0) {
						if((_t23 & 0x00000001) != 0 &&  *(__ecx + 0x14) != 0) {
							_push( *(__ecx + 0x14));
							E6DF895D0();
							 *(__ecx + 0x14) =  *(__ecx + 0x14) & 0x00000000;
							_t45 = 0;
							_t23 =  *0x6e036db0;
						}
						if((_t23 & 0x00000006) != 0) {
							if( *(_t42 + 0x10) == 0 ||  *(_t42 + 0x10) == 0xffffffff || (_t23 & 0x00000004) != 0 || (_t23 & 0x00000002) == 0 || _t35 == 0) {
								L16:
								_t45 = 0;
							} else {
								_t45 = 0xc0000019;
								if( *((intOrPtr*)(_t42 + 0x1c)) != 0xc0000019) {
									_t37 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *(_t42 + 0x18));
									if(_t37 != 0) {
										memcpy(_t37,  *(_t42 + 0x10) & 0xfffffffc,  *(_t42 + 0x18));
										_push( *(_t42 + 0x10) & 0xfffffffc);
										_push(0xffffffff);
										E6DF897A0();
										 *((intOrPtr*)(_t42 + 0x1c)) = 0xc0000019;
										 *(_t42 + 0x10) = _t37 | 0x00000001;
										goto L16;
									} else {
										_t45 = 0xffffffffc0000017;
									}
								}
							}
						}
					}
				} else {
					_t45 = 0xc000000d;
				}
				return _t45;
			}

0x6dfd6657
0x6dfd665b
0x6dfd665d
0x6dfd6661
0x6dfd666d
0x6dfd6672
0x6dfd6679
0x6dfd6681
0x6dfd6689
0x6dfd668c
0x6dfd6691
0x6dfd6695
0x6dfd6697
0x6dfd6697
0x6dfd669e
0x6dfd66a4
0x6dfd670a
0x6dfd670a
0x6dfd66b8
0x6dfd66b8
0x6dfd66c0
0x6dfd66d5
0x6dfd66d9
0x6dfd66eb
0x6dfd66f9
0x6dfd66fa
0x6dfd66fc
0x6dfd6704
0x6dfd6707
0x00000000
0x6dfd66db
0x6dfd66db
0x6dfd66db
0x6dfd66d9
0x6dfd66c0
0x6dfd66a4
0x6dfd669e
0x6dfd6663
0x6dfd6663
0x6dfd6663
0x6dfd6714

APIs

ZwClose.9419(00000000,00000000,00000000,00000000,?,?,6DFBB381,00000001,6E03861C,6E020268,00000020,6DF5BE44,?,00000000,?,00000001), ref: 6DFD668C
RtlAllocateHeap.9419(?,00000008,?,00000000,00000000,00000000,?,?,6DFBB381,00000001,6E03861C,6E020268,00000020,6DF5BE44,?,00000000), ref: 6DFD66D0

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCloseHeap
String ID:
API String ID: 3565931908-0
Opcode ID: 7b1c651402988b0f2f6c0fbe16aeed63cd3e58c00d5be5e7ff8f23e51d934a0a
Instruction ID: 60f0c84cd5d4a6fe009fb23a7ffcc38ba9e41348abd77622615f7da3f439fb37
Opcode Fuzzy Hash: 7b1c651402988b0f2f6c0fbe16aeed63cd3e58c00d5be5e7ff8f23e51d934a0a
Instruction Fuzzy Hash: 42219372A04A1BABD7518E6CA840762B774BB12379F090325FD30D76D1CB72EC90DAE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44DC0, Relevance: 6.1, APIs: 4, Instructions: 73
nativeCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6DF44DC0(intOrPtr __ecx, intOrPtr _a4) {
				void* _v8;
				char _v12;
				void* __ebp;
				intOrPtr _t11;
				void* _t12;
				void* _t14;
				char _t15;
				intOrPtr _t20;
				intOrPtr _t28;
				char _t29;

				_t20 = __ecx;
				_push(__ecx);
				_t28 = _a4;
				_t11 =  *((intOrPtr*)(_t28 + 0x10));
				if(_t11 == 0) {
					_t20 = _t28;
					_t11 = E6DF42E9F(_t20, 0);
				}
				if(_t11 != 0xffffffff) {
					_push("true");
					_push(_t11);
					_t12 = E6DF895C0();
				} else {
					asm("lock or [eax], ecx");
					_t4 = _t28 + 4; // 0x103
					_t20 = _t4;
					E6DF7DFDF(_t20, 0, 0);
					_t12 = 0;
				}
				if(_t12 < 0) {
					L6DF9DF30(_t20, 0, _t12);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t20);
					_push(_t28);
					_t29 = _v12;
					_t14 = E6DF44F2E(_t29, 0);
					if(_t14 != 0) {
						_t15 =  *((intOrPtr*)(_t29 + 0xac));
						_v12 = _t15;
						if(_t15 != 0) {
							_push("true");
							_push(4);
							_push( &_v12);
							_push(0xb);
							_push( *((intOrPtr*)(_t29 + 0xa8)));
							E6DF89D70();
						}
						_t8 = _t29 + 0x50; // 0x14f
						_t14 = E6DF79ED0(_t8, 0, 1);
					}
					return _t14;
				} else {
					return _t12;
				}
			}

0x6df44dc0
0x6df44dc5
0x6df44dc7
0x6df44dca
0x6df44dcf
0x6df44dfa
0x6df44dfc
0x6df44dfc
0x6df44dd4
0x6dfa0b56
0x6dfa0b58
0x6dfa0b59
0x6df44dda
0x6df44ddf
0x6df44de3
0x6df44de3
0x6df44de8
0x6df44ded
0x6df44ded
0x6df44df1
0x6df44e04
0x6df44e09
0x6df44e0a
0x6df44e0b
0x6df44e0c
0x6df44e0d
0x6df44e0e
0x6df44e0f
0x6df44e15
0x6df44e16
0x6df44e17
0x6df44e20
0x6df44e27
0x6df44e29
0x6df44e2f
0x6df44e34
0x6dfa0b63
0x6dfa0b65
0x6dfa0b6a
0x6dfa0b6b
0x6dfa0b6d
0x6dfa0b73
0x6dfa0b73
0x6df44e3c
0x6df44e41
0x6df44e41
0x6df44e4a
0x6df44df3
0x6df44df7
0x6df44df7

APIs

RtlWakeAddressAllNoFence.9419(00000000), ref: 6DF44DE8
RtlRaiseStatus.9419(00000000,?,?,?,6DF5EBD0,?,?,?,?,00000000,?,6DF41E03,?,6DF41D6E,?), ref: 6DF44E04
ZwAlpcQueryInformation.9419(?,0000000B,FFFFFFFE,00000004,00000000,00000000,000000FF,?,?,00000000,?,?,?,6DF5EBD0,?,?), ref: 6DFA0B73

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressAlpcFenceInformationQueryRaiseStatusWake
String ID:
API String ID: 3812654406-0
Opcode ID: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction ID: 2c4d2a62b6e4730d9607f3c337776010d4b5ebc401c0fe79a491211d9fb7b282
Opcode Fuzzy Hash: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction Fuzzy Hash: EC11C431614305ABE714CB3DCC41FAB77AC9F49718F11812AAA15EB1C0EFF0ED008295

Uniqueness

Uniqueness Score: -1.00%

Function 6DF83EE4, Relevance: 6.1, APIs: 4, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6DF83EE4(void* __ecx, void* __edx) {
				char _v8;
				char _v20;
				void* _t51;
				intOrPtr* _t55;
				void* _t57;

				if( *0x6e038644 != 0) {
					L4:
					return 1;
				}
				_t57 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x28);
				if(_t57 == 0) {
					L7:
					return 0;
				}
				if(E6DF83FA0( &_v8, 0x6e0365d4,  &_v20) < 0) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
					goto L7;
				}
				_t55 =  *((intOrPtr*)(_v8 + 0x10)) + _v8;
				_t51 =  *_t55 + _t55;
				 *((short*)(_t57 + 8)) =  *((intOrPtr*)(_t51 + 0x18));
				 *((short*)(_t57 + 0xc)) =  *((intOrPtr*)(_t51 + 0x16));
				 *((short*)(_t57 + 0xa)) =  *((intOrPtr*)(_t51 + 0x20));
				 *((short*)(_t57 + 0x24)) =  *((intOrPtr*)(_t51 + 0x1a));
				 *((intOrPtr*)(_t57 + 0x10)) =  *((intOrPtr*)(_t51 + 0x1c)) + _t55;
				 *((intOrPtr*)(_t57 + 0x14)) =  *((intOrPtr*)(_t51 + 0x24)) + _t55;
				 *((intOrPtr*)(_t57 + 0x18)) =  *((intOrPtr*)(_t51 + 0x28)) + _t55;
				 *((intOrPtr*)(_t57 + 0x1c)) =  *((intOrPtr*)(_t51 + 0x38)) + _t55;
				asm("lock cmpxchg [edx], ecx");
				if(0 != 0) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
				}
				goto L4;
			}

0x6df83ef4
0x6df83f91
0x00000000
0x6df83f91
0x6df83f0c
0x6df83f10
0x6dfbe7d8
0x00000000
0x6dfbe7d8
0x6df83f2a
0x6dfbe7d3
0x00000000
0x6dfbe7d3
0x6df83f36
0x6df83f3a
0x6df83f40
0x6df83f48
0x6df83f50
0x6df83f58
0x6df83f61
0x6df83f69
0x6df83f71
0x6df83f80
0x6df83f85
0x6df83f8b
0x6dfbe7eb
0x6dfbe7eb
0x00000000

APIs

RtlAllocateHeap.9419(?,00000008,00000028,?,?,6DFA8546), ref: 6DF83F07
RtlGetLocaleFileMappingAddress.9419(00000000,6E0365D4,6DFA8546,?,00000008,00000028,?,?,6DFA8546), ref: 6DF83F23

Part of subcall function 6DF83FA0: ZwInitializeNlsFiles.9419(00000028,00000008,?,?,?,00000000,?,6DF83F28,00000000,6E0365D4,6DFA8546,?,00000008,00000028,?), ref: 6DF83FCD

RtlFreeHeap.9419(?,00000000,00000000,00000000,6E0365D4,6DFA8546,?,00000008,00000028,?,?,6DFA8546), ref: 6DFBE7D3
RtlFreeHeap.9419(?,00000000,00000000,00000000,6E0365D4,6DFA8546,?,00000008,00000028,?,?,6DFA8546), ref: 6DFBE7EB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: fab0951efe0224488820bf2cd2049a6420ede350fddd6de793ca9cd88ffd09b7
Instruction ID: d1399c18a23cb3a5f4dc889a97234ae6c1d4ed28cacc7a482a8f5c5d5083bd6b
Opcode Fuzzy Hash: fab0951efe0224488820bf2cd2049a6420ede350fddd6de793ca9cd88ffd09b7
Instruction Fuzzy Hash: 2121BD79601A419FC725DF6DC900B52B7F5FF08708F2449A8A919CBB62E330EC42CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD8372, Relevance: 6.1, APIs: 4, Instructions: 72
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DFD8372(intOrPtr* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				char _v24;
				char _v28;
				char _v32;
				void* _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t24;
				void* _t25;
				void* _t30;
				void* _t35;
				intOrPtr _t38;
				intOrPtr* _t45;
				signed int _t47;

				_t44 = __edx;
				_v8 =  *0x6e03d360 ^ _t47;
				_t24 = 0;
				_v32 = 1;
				_t38 = __edx;
				_v28 = 0;
				_t45 = __ecx;
				L1:
				L1:
				if(_t24 != 0) {
					_push(_t24);
					E6DF895D0();
				}
				_t25 = E6DFD874A( &_v24);
				_t46 = _t25;
				if(_t25 < 0) {
					goto L8;
				}
				_t30 = E6DF867A0( &_v24,  &_v40, 1);
				_t46 = _t30;
				if(_t30 >= 0) {
					_v64 = 0x18;
					_v56 =  &_v40;
					_v60 = _t38;
					_push( &_v32);
					_push(0);
					_push(0);
					_push(0);
					_v52 = 0x240;
					_push( &_v64);
					_push(_a4);
					_v48 = 0;
					_push( &_v28);
					_v44 = 0;
					_t35 = E6DF896D0();
					_t46 = _t35;
					RtlFreeUnicodeString( &_v40);
					if(_t35 >= 0) {
						_t24 = _v28;
						if(_v32 == 2) {
							goto L1;
						} else {
							 *_t45 = _t24;
						}
					}
				}
				L8:
				return E6DF8B640(_t46, _t38, _v8 ^ _t47, _t44, _t45, _t46);
			}

0x6dfd8372
0x6dfd8381
0x6dfd8386
0x6dfd8388
0x6dfd8390
0x6dfd8392
0x6dfd8395
0x00000000
0x6dfd8397
0x6dfd8399
0x6dfd839b
0x6dfd839c
0x6dfd839c
0x6dfd83a4
0x6dfd83a9
0x6dfd83ad
0x00000000
0x00000000
0x6dfd83b9
0x6dfd83be
0x6dfd83c2
0x6dfd83c7
0x6dfd83ce
0x6dfd83d6
0x6dfd83d9
0x6dfd83da
0x6dfd83db
0x6dfd83dc
0x6dfd83e0
0x6dfd83e7
0x6dfd83e8
0x6dfd83ee
0x6dfd83f1
0x6dfd83f2
0x6dfd83f5
0x6dfd83fa
0x6dfd8400
0x6dfd8407
0x6dfd840d
0x6dfd8410
0x00000000
0x6dfd8412
0x6dfd8412
0x6dfd8412
0x6dfd8410
0x6dfd8407
0x6dfd8414
0x6dfd8426

APIs

ZwClose.9419(00000000,?,00000000,00000000), ref: 6DFD839C
RtlStringFromGUIDEx.9419(?,?,00000001,?,00000000,00000000), ref: 6DFD83B9
ZwCreateKey.9419(?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6DFD83F5
RtlFreeUnicodeString.9419(?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6DFD8400

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$CloseCreateFreeFromUnicode
String ID:
API String ID: 4294597832-0
Opcode ID: 5181d1d805880d838fc62b670129e40c8fbaa1f7b25ce968db9a3c06e4e4c94c
Instruction ID: cdad759dd0008912912efee230a5dfb06b43d1971177cd2d59f147bd78f0d93e
Opcode Fuzzy Hash: 5181d1d805880d838fc62b670129e40c8fbaa1f7b25ce968db9a3c06e4e4c94c
Instruction Fuzzy Hash: A421FFB1D0121DABDB54CFA9C885DEFBBB8EB04314F15416AE911E7240EB719E44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4519E, Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E6DF4519E(struct _EXCEPTION_RECORD __ecx) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _t17;
				signed int _t18;
				char _t27;
				signed short _t32;
				struct _EXCEPTION_RECORD _t34;
				void* _t35;

				_t34 = __ecx;
				_t27 = 0;
				_t29 = 0;
				_t35 = L6DF452A5(0);
				if(_t35 == 0) {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_v12 =  *((intOrPtr*)(_t29 + 0x24));
					_t17 =  *((intOrPtr*)(_t29 + 0x28));
				} else {
					_v12 =  *((intOrPtr*)(_t35 + 0xc));
					_t17 =  *((intOrPtr*)(_t35 + 0x10));
				}
				_t32 = _v12;
				_v8 = _t17;
				_t18 =  *_t34 & 0x0000ffff;
				if(_t32 <= 6) {
					if(_t32 != _t18) {
						goto L4;
					}
					goto L10;
				} else {
					_t29 = (_t32 & 0x0000ffff) - 2;
					if((_t32 & 0x0000ffff) - 2 == _t18) {
						_v12 = _t32 + 0xfffe;
						L10:
						_t18 = RtlEqualUnicodeString( &_v12, _t34, 1);
						if(_t18 != 0) {
							_t27 = 1;
						}
					}
					L4:
					if(_t35 == 0) {
						E6DF5EB70(_t29, 0x6e0379a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t18 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t35 + 4)));
							E6DF895D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t35);
						}
					}
					return _t27;
				}
			}

0x6df451a9
0x6df451ab
0x6df451ad
0x6df451b4
0x6df451b8
0x6dfa0c9c
0x6dfa0ca2
0x6dfa0ca5
0x6df451be
0x6df451c1
0x6df451c4
0x6df451c4
0x6df451c7
0x6df451cb
0x6df451ce
0x6df451d5
0x6dfa0cbe
0x00000000
0x00000000
0x00000000
0x6df451db
0x6df451de
0x6df451e3
0x6dfa0cb5
0x6dfa0cc4
0x6dfa0ccb
0x6dfa0cd2
0x6dfa0cd8
0x6dfa0cd8
0x6dfa0cd2
0x6df451e9
0x6df451eb
0x6dfa0ce4
0x6df451f1
0x6df451f4
0x6df451f8
0x6dfa0cee
0x6dfa0cf1
0x6dfa0d03
0x6dfa0d03
0x6df451f8
0x6df45206
0x6df45206

APIs

RtlEqualUnicodeString.9419(?,?,00000001,?,?,?), ref: 6DFA0CCB
RtlLeaveCriticalSection.9419(6E0379A0,?,?,?), ref: 6DFA0CE4

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEqualLeaveSectionStringUnicode
String ID:
API String ID: 1601533729-0
Opcode ID: abd2637713b532a6c5e2749fb7d0e54e5750b3f4783a09d81e304fecbd47f0c1
Instruction ID: 6ef21f983b87ea18ec32df9e972d06a4718f63a04828718123100955316c63c2
Opcode Fuzzy Hash: abd2637713b532a6c5e2749fb7d0e54e5750b3f4783a09d81e304fecbd47f0c1
Instruction Fuzzy Hash: EE112136941212EBCB20EF6DC450ABABFE5FB56710F26412AE85597781EB71CC41C650

Uniqueness

Uniqueness Score: -1.00%

Function 6DF73B5A, Relevance: 6.1, APIs: 4, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF73B5A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				void* _t14;
				char _t18;
				void* _t31;
				void* _t32;
				void* _t33;
				void* _t34;
				void* _t37;
				void* _t39;

				_t37 = __esi;
				_t31 = __ebx;
				_t14 = __eax;
				if( *((intOrPtr*)(_t39 - 0x40)) != __ebx || __edi < 0) {
					if(_t37 == 0) {
						goto L2;
					}
					_t32 =  *(_t39 - 0x24);
					if(_t32 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000, _t32);
						_t37 =  *(_t39 - 0x20);
					}
					_t33 =  *(_t37 + 0x1c);
					if(_t33 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000, _t33);
						_t37 =  *(_t39 - 0x20);
					}
					_t34 =  *(_t37 + 0x20);
					if(_t34 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000, _t34);
						_t37 =  *(_t39 - 0x20);
					}
					_t18 = RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0xc0000, _t37);
					 *(_t39 - 0x20) = _t31;
					return _t18;
				} else {
					L2:
					return _t14;
				}
			}

0x6df73b5a
0x6df73b5a
0x6df73b5a
0x6df73b5d
0x6dfb61e6
0x00000000
0x00000000
0x6dfb61ec
0x6dfb61f1
0x6dfb6208
0x6dfb620d
0x6dfb620d
0x6dfb6210
0x6dfb6215
0x6dfb622c
0x6dfb6231
0x6dfb6231
0x6dfb6234
0x6dfb6239
0x6dfb6250
0x6dfb6255
0x6dfb6255
0x6dfb626d
0x6dfb6274
0x00000000
0x6df73b6b
0x6df73b6b
0x6df73b6b
0x6df73b6b

APIs

RtlFreeHeap.9419(?,?,?,6DF73AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6DFB6208
RtlFreeHeap.9419(?,?,?,6DF73AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6DFB622C
RtlFreeHeap.9419(?,?,?,6DF73AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6DFB6250
RtlFreeHeap.9419(?,?,00000000,6DF73AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6DFB626D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 37b5854d37c8be654ebdfd9093e9f0a48bafb4b480a860915be6f04277098196
Instruction ID: 31855443be07d3952cbae4ab729614b5697f31ebf1bbb6f9bcb41bc43d286204
Opcode Fuzzy Hash: 37b5854d37c8be654ebdfd9093e9f0a48bafb4b480a860915be6f04277098196
Instruction Fuzzy Hash: 93110D36911995EFDF25DF4DCA40F6A73B9FB04704F150098E805A7B52C328ED00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4A745, Relevance: 6.0, APIs: 4, Instructions: 46
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6DF4A745(void* __ebx, void* __ecx, void* __edx, void* __edi) {
				signed int _v12;
				void* __esi;
				signed int _t9;
				intOrPtr* _t12;
				char _t19;
				void* _t23;
				intOrPtr* _t28;
				intOrPtr _t30;
				void* _t32;
				void* _t34;
				void* _t35;
				signed int _t37;

				_push(__ecx);
				_t34 = __ecx;
				_t9 = E6DF62280( *0x6e0384cc + 0x18,  *0x6e0384cc + 0x18);
				asm("lock xadd [esi+0x14], eax");
				if((_t9 | 0xffffffff) == 1) {
					_t2 = _t34 + 8; // 0x8
					_t12 = _t2;
					_t30 =  *_t12;
					if( *((intOrPtr*)(_t30 + 4)) != _t12) {
						L7:
						asm("int 0x29");
						_t32 = 3;
						_pop(_t35);
						_pop(_t23);
						return E6DF8B640(0xc00000f0, _t23, _v12 ^ _t37, _t30, _t32, _t35);
					} else {
						_t28 =  *((intOrPtr*)(_t12 + 4));
						if( *_t28 != _t12) {
							goto L7;
						} else {
							 *_t28 = _t30;
							 *((intOrPtr*)(_t30 + 4)) = _t28;
							E6DF5FFB0(__ebx, __edi,  *0x6e0384cc + 0x18);
							_t19 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t34);
							goto L2;
						}
					}
				} else {
					_t19 = E6DF5FFB0(__ebx, __edi,  *0x6e0384cc + 0x18);
					L2:
					return _t19;
				}
			}

0x6df4a74a
0x6df4a754
0x6df4a757
0x6df4a75f
0x6df4a765
0x6dfa440f
0x6dfa440f
0x6dfa4412
0x6dfa4417
0x6dfa4449
0x6dfa444c
0x6df4a86a
0x6df4a86b
0x6df4a86e
0x6df4a877
0x6dfa4419
0x6dfa4419
0x6dfa441e
0x00000000
0x6dfa4420
0x6dfa4428
0x6dfa442b
0x6dfa442e
0x6dfa443f
0x00000000
0x6dfa443f
0x6dfa441e
0x6df4a76b
0x6df4a774
0x6df4a779
0x6df4a77d
0x6df4a77d

APIs

RtlAcquireSRWLockExclusive.9419(?,?,00000000,?,6DF7DFD8,00000000,?,?,?,?,?,6DF43DAD,?,00000000,6E01F4D0,00000084), ref: 6DF4A757
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,6DF7DFD8,00000000,?,?,?,?,?,6DF43DAD,?,00000000,6E01F4D0), ref: 6DF4A774
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,6DF7DFD8,00000000,?,?,?,?,?,6DF43DAD,?,00000000,6E01F4D0), ref: 6DFA442E
RtlFreeHeap.9419(?,00000000,00000000,?,?,?,00000000,?,6DF7DFD8,00000000,?,?,?,?,?,6DF43DAD), ref: 6DFA443F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: a7e0b4ca9bcc2758a2c62ef99e13b3ea02ff54c095f255f4a8af4ddc18bcf55b
Instruction ID: 98490dff03fd1ede8b90bf6b5ed963ca49728d53702e15fc7f38c4c0f1cb6f17
Opcode Fuzzy Hash: a7e0b4ca9bcc2758a2c62ef99e13b3ea02ff54c095f255f4a8af4ddc18bcf55b
Instruction Fuzzy Hash: 9701A772145202DBC320DB2DDC00E1577B8FF46318B45C2AAE908CB692DA34DC41C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6E090, Relevance: 6.0, APIs: 4, Instructions: 38
nativeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DF6E090(char __ebx, intOrPtr __ecx) {
				void* _t9;
				intOrPtr _t13;
				char _t16;
				void* _t19;
				void* _t21;

				_t17 = __ecx;
				_t16 = __ebx;
				if( *((intOrPtr*)(_t21 - 0x34)) != __ebx) {
					_t17 = 0xc0000005;
					 *((intOrPtr*)( *((intOrPtr*)(_t19 + 0x18)))) = 0xc0000005;
					_t9 = E6DF4B1E1(0xc0000005, 0x14ab, __ebx, _t19);
				}
				if( *((char*)(_t21 - 0x19)) != 0) {
					_t9 = E6DF61E70( *((intOrPtr*)(_t21 - 0x2c)), _t21 - 0x2c);
				}
				if( *((char*)(_t21 - 0x20)) == 0) {
					L6DF5EEF0(0x6e037b60);
					_t13 =  *0x6e037b78 - 1;
					 *0x6e037b78 = _t13;
					if(_t13 != 1 ||  *0x6e037b80 != 0x6e037b80) {
						 *((char*)(_t21 - 0x24)) = _t16;
					}
					_t9 = E6DF5EB70(_t17, 0x6e037b60);
					if( *((char*)(_t21 - 0x24)) != 0) {
						_push(_t16);
						_push( *0x6e037b48);
						return E6DF895C0();
					}
				}
				return _t9;
			}

0x6df6e090
0x6df6e090
0x6df6e093
0x6dfb3b93
0x6dfb3b98
0x6dfb3ba1
0x6dfb3ba1
0x6df6e09d
0x6df6e0a6
0x6df6e0a6
0x6df6e0af
0x6df6e0b7
0x6df6e0c1
0x6df6e0c2
0x6df6e0ca
0x6df6e0d8
0x6df6e0d8
0x6df6e0dc
0x6df6e0e5
0x6df6e0e8
0x6df6e0e9
0x00000000
0x6df6e0ef
0x6df6e0e5
0x6df6e0e7

APIs

RtlWow64EnableFsRedirectionEx.9419(6E037B60,6E037B60,6DF6DFDF,?,00000000,6E037B60,6E01FE18,00000028), ref: 6DF6E0A6
RtlEnterCriticalSection.9419(6E037B60,6DF6DFDF,?,00000000,6E037B60,6E01FE18,00000028), ref: 6DF6E0B7
RtlLeaveCriticalSection.9419(6E037B60,6E037B60,6DF6DFDF,?,00000000,6E037B60,6E01FE18,00000028), ref: 6DF6E0DC
ZwSetEvent.9419(00000000,6E037B60,6E037B60,6DF6DFDF,?,00000000,6E037B60,6E01FE18,00000028), ref: 6DF6E0EF

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnableEnterEventLeaveRedirectionWow64
String ID:
API String ID: 355146318-0
Opcode ID: 57f891068409c12b6990e48a6b4dabb1c4d2d5973c4f6146a617584830aba719
Instruction ID: e8cfd278e1d2f54834e35f065e03d3617dcf1e842096efed6b1108fd369dc98b
Opcode Fuzzy Hash: 57f891068409c12b6990e48a6b4dabb1c4d2d5973c4f6146a617584830aba719
Instruction Fuzzy Hash: 13016D728085DAFEEF11DB7CCC40BAE7AB5AB06318F198165E100A2A92C3354D54C772

Uniqueness

Uniqueness Score: -1.00%

Function 6DFEEB8A, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 599
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6DFEEB8A(signed int __ecx, signed int __edx, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t258;
				signed int _t260;
				signed int _t261;
				signed char _t262;
				signed int _t263;
				char* _t264;
				signed int _t265;
				intOrPtr _t267;
				signed int _t271;
				signed char _t272;
				signed short _t273;
				signed int _t277;
				signed char _t281;
				signed short _t283;
				signed short _t288;
				signed char _t289;
				signed short _t290;
				signed short _t292;
				signed short _t294;
				signed char _t295;
				intOrPtr _t296;
				signed int _t297;
				signed char _t298;
				unsigned int _t302;
				intOrPtr* _t303;
				signed int _t304;
				unsigned int _t306;
				signed short _t307;
				signed short _t308;
				signed int _t311;
				signed short _t314;
				signed short _t326;
				signed char _t329;
				signed short _t330;
				signed int _t332;
				void* _t333;
				signed short _t337;
				signed int _t339;
				void* _t340;
				signed short _t344;
				signed int _t347;
				signed int _t349;
				signed int _t351;
				signed int _t359;
				signed short _t362;
				signed int _t369;
				signed int _t376;
				signed short _t377;
				signed short* _t378;
				signed short _t381;
				signed char _t383;
				signed short _t384;
				signed short _t385;
				signed int _t390;
				signed int _t393;
				void* _t400;
				signed short _t406;
				signed int _t407;
				signed short _t408;
				signed short _t409;
				signed short _t410;
				signed short _t411;
				intOrPtr _t415;
				signed int _t416;
				signed char _t417;
				signed int _t418;
				unsigned int _t423;
				unsigned int _t431;
				signed int _t437;
				signed int _t442;
				intOrPtr _t443;
				void* _t449;
				intOrPtr _t451;
				signed short _t453;
				signed int _t455;

				_t258 =  *0x6e03d360 ^ _t455;
				_v8 = _t258;
				_t452 = __ecx;
				_t395 = __edx;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					__eflags =  *(__ecx + 0x40) & 0x61000000;
					asm("bt dword [edi+0x40], 0x1c");
					__eflags = (_t258 & 0xffffff00 | ( *(__ecx + 0x40) & 0x61000000) >= 0x00000000) & (__ecx & 0xffffff00 | __eflags != 0x00000000);
					if(__eflags == 0) {
						L5:
						_v12 = _v12 & 0x00000000;
						_t260 =  *_t395;
						_push(2);
						__eflags = _t260;
						if(_t260 != 0) {
							_t399 =  *(_t395 + 0xa) & 0x0000ffff;
							__eflags = _t399 & 0x00001002;
							if((_t399 & 0x00001002) == 0) {
								goto L25;
							}
							_t441 = _t399 & 0x00000002;
							__eflags = _t441;
							if(_t441 == 0) {
								L14:
								__eflags = _a4;
								if(_a4 == 0) {
									L17:
									_t453 =  *(_t395 + 4) + _t260;
									__eflags = _t399 & 0x00001000;
									if((_t399 & 0x00001000) != 0) {
										_t441 = _t260 - 0x18;
										_t399 = _t452;
										_t260 = E6DFED42F(_t452, _t260 - 0x18);
									}
									__eflags = _a4;
									if(_a4 == 0) {
										L21:
										_t451 =  *((intOrPtr*)(_t260 + 0x10));
										_t399 = 2;
										__eflags = _t451 - _t452 + 0xa4;
										if(_t451 == _t452 + 0xa4) {
											__eflags =  *((intOrPtr*)(_t452 + 0xda)) - _t399;
											if( *((intOrPtr*)(_t452 + 0xda)) != _t399) {
												goto L62;
											}
											_t441 =  *(_t452 + 0xd4);
											goto L63;
										}
										_t441 = _t451 + 0xfffffff0;
										goto L63;
									} else {
										__eflags = _t453 -  *((intOrPtr*)(_t260 + 0x28));
										if(_t453 <  *((intOrPtr*)(_t260 + 0x28))) {
											goto L82;
										}
										goto L21;
									}
								}
								__eflags = _t441;
								if(_t441 == 0) {
									goto L17;
								}
								_t453 =  *(_t260 + 0x24);
								goto L82;
							} else {
								__eflags =  *((char*)(_t452 + 0xda)) - 2;
								if( *((char*)(_t452 + 0xda)) != 2) {
									_t437 = 0;
									__eflags = 0;
								} else {
									_t437 =  *(_t452 + 0xd4);
								}
								__eflags = _t260 - _t437;
								if(_t260 == _t437) {
									goto L61;
								} else {
									_t399 =  *(_t395 + 0xa) & 0x0000ffff;
									goto L14;
								}
							}
						} else {
							_t441 = _t452;
							L63:
							_t453 = 0;
							__eflags = _t441;
							if(_t441 != 0) {
								__eflags =  *((intOrPtr*)(_t452 + 0xda)) - _t399;
								if( *((intOrPtr*)(_t452 + 0xda)) != _t399) {
									_t359 = 0;
									__eflags = 0;
								} else {
									_t359 =  *(_t452 + 0xd4);
								}
								__eflags = _t441 - _t359;
								if(_t441 == _t359) {
									_t441 = _t395;
									E6E006D15(_t452, _t395,  &_v12);
									goto L193;
								} else {
									 *_t395 = _t441;
									__eflags =  *(_t452 + 0x4c) - _t453;
									if( *(_t452 + 0x4c) == _t453) {
										_t362 =  *_t441 & 0x0000ffff;
									} else {
										_t377 =  *_t441;
										__eflags =  *(_t452 + 0x4c) & _t377;
										if(( *(_t452 + 0x4c) & _t377) != 0) {
											_t377 = _t377 ^  *(_t452 + 0x50);
											__eflags = _t377;
										}
										_t362 = _t377 & 0x0000ffff;
									}
									 *(_t395 + 4) = (_t362 & 0x0000ffff) << 3;
									 *(_t395 + 0xa) = _t399;
									 *(_t395 + 8) = _t453;
									 *(_t395 + 0xc) =  *((intOrPtr*)(_t441 + 0x20)) -  *(_t441 + 0x2c) << 0xc;
									_t369 =  *(_t441 + 0x2c) << 0xc;
									 *(_t395 + 0x10) = _t369;
									__eflags =  *(_t441 + 0xc) & _t399;
									if(( *(_t441 + 0xc) & _t399) != 0) {
										_t376 = _t369 + 0x1000;
										__eflags = _t376;
										 *(_t395 + 0x10) = _t376;
									}
									 *(_t395 + 0x14) =  *((intOrPtr*)(_t441 + 0x24)) + (( !( *( *((intOrPtr*)(_t441 + 0x24)) + 2)) & 0x00000001) + 1) * 8;
									 *((intOrPtr*)(_t395 + 0x18)) =  *((intOrPtr*)(_t441 + 0x28));
									L82:
									__eflags = _t453;
									if(_t453 == 0) {
										L193:
										_t263 = E6DF67D50();
										__eflags = _t263;
										if(_t263 == 0) {
											_t264 = 0x7ffe0380;
										} else {
											_t264 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										__eflags =  *_t264;
										if( *_t264 != 0) {
											_t267 =  *[fs:0x30];
											__eflags =  *(_t267 + 0x240) & 0x00000001;
											if(( *(_t267 + 0x240) & 0x00000001) != 0) {
												__eflags = _v12 - 0x8000001a;
												if(_v12 != 0x8000001a) {
													E6E001BA8(_t452);
												}
											}
										}
										_t265 = _v12;
										goto L201;
									}
									_t272 =  *((intOrPtr*)(_t453 + 7));
									__eflags = _t272 & 0x00000040;
									if((_t272 & 0x00000040) == 0) {
										__eflags = _t272 - 4;
										if(_t272 != 4) {
											_t273 = _t453;
											L89:
											 *_t395 = _t273 + 8;
											_t441 = 2;
											 *(_t395 + 0xa) = 1;
											__eflags =  *((intOrPtr*)(_t452 + 0xda)) - _t441;
											if( *((intOrPtr*)(_t452 + 0xda)) != _t441) {
												_t277 = 0;
												__eflags = 0;
											} else {
												_t277 =  *(_t452 + 0xd4);
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L97:
												_t281 =  *(_t452 + 0x4c) >> 0x00000014 &  *(_t452 + 0x52) ^  *(_t453 + 2);
												__eflags = _t281 & 0x00000001;
												if((_t281 & 0x00000001) == 0) {
													 *_t395 = _t453 + 0x10;
													__eflags =  *(_t452 + 0x4c);
													if( *(_t452 + 0x4c) == 0) {
														_t283 =  *_t453 & 0x0000ffff;
													} else {
														_t288 =  *_t453;
														__eflags =  *(_t452 + 0x4c) & _t288;
														if(( *(_t452 + 0x4c) & _t288) != 0) {
															_t288 = _t288 ^  *(_t452 + 0x50);
															__eflags = _t288;
														}
														_t283 = _t288 & 0x0000ffff;
													}
													 *(_t395 + 4) = (_t283 & 0x0000ffff) * 8 - 0x10;
													 *((char*)(_t395 + 9)) =  *(_t453 + 6);
													 *(_t395 + 0xa) = 0;
													 *(_t395 + 8) = 0x10;
													 *(_t395 + 0x14) = 0x10;
													goto L193;
												}
												_t289 =  *((intOrPtr*)(_t453 + 7));
												__eflags = _t289 & 0x00000040;
												if((_t289 & 0x00000040) == 0) {
													__eflags = _t289 - 4;
													if(_t289 != 4) {
														_t290 = _t453;
														L104:
														 *_t395 = _t290 + 8;
														_t399 =  *((intOrPtr*)(_t453 + 7));
														__eflags = _t399 - 4;
														if(_t399 == 4) {
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t292 =  *_t453 & 0x0000ffff;
															} else {
																_t308 =  *_t453;
																__eflags =  *(_t452 + 0x4c) & _t308;
																if(( *(_t452 + 0x4c) & _t308) != 0) {
																	_t308 = _t308 ^  *(_t452 + 0x50);
																	__eflags = _t308;
																}
																_t292 = _t308 & 0x0000ffff;
															}
															 *((char*)(_t395 + 9)) = 0x40;
															_t294 = 0x4001;
															 *(_t395 + 4) =  *((intOrPtr*)(_t453 - 8)) - (_t292 & 0x0000ffff);
															 *(_t395 + 0xa) = 0x4001;
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t406 =  *_t453 & 0x0000ffff;
															} else {
																_t307 =  *_t453;
																__eflags =  *(_t452 + 0x4c) & _t307;
																if(( *(_t452 + 0x4c) & _t307) != 0) {
																	_t307 = _t307 ^  *(_t452 + 0x50);
																	__eflags = _t307;
																}
																_t406 = _t307 & 0x0000ffff;
																_t294 =  *(_t395 + 0xa) & 0x0000ffff;
															}
															_t407 = _t406 & 0x0000ffff;
															 *(_t395 + 8) = _t407;
															__eflags = _t441 & _t294;
															if((_t441 & _t294) == 0) {
																 *(_t395 + 0x14) = _t407;
															}
															_t408 = _t294 & 0x0000ffff;
															L166:
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t295 =  *(_t453 + 2);
																_t409 = _t408 & 0x0000ffff;
															} else {
																_t306 =  *_t453;
																__eflags =  *(_t452 + 0x4c) & _t306;
																if(( *(_t452 + 0x4c) & _t306) != 0) {
																	_t306 = _t306 ^  *(_t452 + 0x50);
																	__eflags = _t306;
																}
																_t409 =  *(_t395 + 0xa) & 0x0000ffff;
																_t295 = _t306 >> 0x10;
															}
															__eflags = _t441 & _t295;
															if((_t441 & _t295) == 0) {
																_t296 =  *[fs:0x30];
																_t410 = _t409 & 0x0000ffff;
																__eflags =  *(_t296 + 0x68) & 0x00000800;
																if(( *(_t296 + 0x68) & 0x00000800) != 0) {
																	_t297 =  *(_t453 + 3) & 0x000000ff;
																} else {
																	_t297 = 0;
																}
																 *(_t395 + 0x10) = _t297;
															} else {
																_t441 = _t453;
																_t303 = E6DFED380(_t452, _t453);
																 *(_t395 + 0xc) =  *(_t303 + 4);
																 *((short*)(_t395 + 0x12)) =  *_t303;
																_t415 =  *[fs:0x30];
																__eflags =  *(_t415 + 0x68) & 0x00000800;
																if(( *(_t415 + 0x68) & 0x00000800) != 0) {
																	_t304 =  *(_t303 + 2) & 0x0000ffff;
																} else {
																	_t304 = 0;
																}
																 *(_t395 + 0x10) = _t304;
																 *(_t395 + 0xa) =  *(_t395 + 0xa) | 0x00000010;
																_t410 =  *(_t395 + 0xa) & 0x0000ffff;
															}
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t298 =  *(_t453 + 2);
																_t411 = _t410 & 0x0000ffff;
															} else {
																_t302 =  *_t453;
																__eflags =  *(_t452 + 0x4c) & _t302;
																if(( *(_t452 + 0x4c) & _t302) != 0) {
																	_t302 = _t302 ^  *(_t452 + 0x50);
																	__eflags = _t302;
																}
																_t411 =  *(_t395 + 0xa) & 0x0000ffff;
																_t298 = _t302 >> 0x10;
															}
															 *(_t395 + 0xa) = _t298 & 0xe0 | _t411;
															goto L193;
														}
														__eflags = _t399 - 3;
														if(_t399 == 3) {
															_t408 = 0x1000;
															 *_t395 =  *(_t453 + 0x18);
															 *(_t395 + 0x14) =  *(_t395 + 0x14) & 0x00000000;
															 *(_t395 + 4) =  *(_t453 + 0x1c);
															 *(_t395 + 8) = 0x10000000;
															goto L166;
														}
														__eflags = _t399 - 1;
														if(_t399 != 1) {
															_t442 =  *(_t452 + 0x4c);
															__eflags = _t442;
															if(_t442 == 0) {
																_t311 =  *_t453 & 0x0000ffff;
															} else {
																_t344 =  *_t453;
																_t442 =  *(_t452 + 0x4c);
																__eflags = _t344 & _t442;
																if((_t344 & _t442) != 0) {
																	_t344 = _t344 ^  *(_t452 + 0x50);
																	__eflags = _t344;
																}
																_t399 =  *((intOrPtr*)(_t453 + 7));
																_t311 = _t344 & 0x0000ffff;
															}
															_v20 = _t311;
															__eflags = _t399 - 5;
															if(_t399 != 5) {
																__eflags = _t399 & 0x00000040;
																if((_t399 & 0x00000040) == 0) {
																	__eflags = (_t399 & 0x0000003f) - 0x3f;
																	if((_t399 & 0x0000003f) == 0x3f) {
																		__eflags = _t399;
																		if(_t399 >= 0) {
																			__eflags = _t442;
																			if(_t442 == 0) {
																				_t314 =  *_t453 & 0x0000ffff;
																			} else {
																				_t337 =  *_t453;
																				__eflags =  *(_t452 + 0x4c) & _t337;
																				if(( *(_t452 + 0x4c) & _t337) != 0) {
																					_t337 = _t337 ^  *(_t452 + 0x50);
																					__eflags = _t337;
																				}
																				_t314 = _t337 & 0x0000ffff;
																			}
																		} else {
																			_t431 = _t453 >> 0x00000003 ^  *_t453 ^  *0x6e03874c ^ _t452;
																			__eflags = _t431;
																			if(_t431 == 0) {
																				_t339 = _t453 - (_t431 >> 0xd);
																				__eflags = _t339;
																				_t340 =  *_t339;
																			} else {
																				_t340 = 0;
																			}
																			_t314 =  *((intOrPtr*)(_t340 + 0x14));
																		}
																		_t416 =  *(_t453 + (_t314 & 0xffff) * 8 - 4);
																	} else {
																		_t416 = _t399 & 0x3f;
																	}
																} else {
																	_t416 =  *(_t453 + 4 + (_t399 & 0x3f) * 8) & 0x0000ffff;
																}
															} else {
																_t416 =  *(_t452 + 0x54) & 0x0000ffff ^  *(_t453 + 4) & 0x0000ffff;
															}
															 *(_t395 + 4) = ((_v20 & 0x0000ffff) << 3) - _t416;
															 *((char*)(_t395 + 9)) =  *(_t453 + 6);
															 *(_t395 + 0xa) = 1;
															_t417 =  *((intOrPtr*)(_t453 + 7));
															__eflags = _t417 - 5;
															if(_t417 != 5) {
																__eflags = _t417 & 0x00000040;
																if((_t417 & 0x00000040) == 0) {
																	__eflags = (_t417 & 0x0000003f) - 0x3f;
																	if((_t417 & 0x0000003f) == 0x3f) {
																		__eflags = _t417;
																		if(_t417 >= 0) {
																			__eflags =  *(_t452 + 0x4c);
																			if( *(_t452 + 0x4c) == 0) {
																				_t326 =  *_t453 & 0x0000ffff;
																			} else {
																				_t330 =  *_t453;
																				__eflags =  *(_t452 + 0x4c) & _t330;
																				if(( *(_t452 + 0x4c) & _t330) != 0) {
																					_t330 = _t330 ^  *(_t452 + 0x50);
																					__eflags = _t330;
																				}
																				_t326 = _t330 & 0x0000ffff;
																			}
																		} else {
																			_t423 = _t453 >> 0x00000003 ^  *_t453 ^  *0x6e03874c ^ _t452;
																			__eflags = _t423;
																			if(_t423 == 0) {
																				_t332 = _t453 - (_t423 >> 0xd);
																				__eflags = _t332;
																				_t333 =  *_t332;
																			} else {
																				_t333 = 0;
																			}
																			_t326 =  *((intOrPtr*)(_t333 + 0x14));
																		}
																		_t418 =  *(_t453 + (_t326 & 0xffff) * 8 - 4);
																	} else {
																		_t418 = _t417 & 0x3f;
																	}
																} else {
																	_t418 =  *(_t453 + 4 + (_t417 & 0x3f) * 8) & 0x0000ffff;
																}
															} else {
																_t418 =  *(_t452 + 0x54) & 0x0000ffff ^  *(_t453 + 4) & 0x0000ffff;
															}
															_t329 =  *(_t395 + 0xa) & 0x0000ffff;
															_t441 = 2;
															 *(_t395 + 8) = _t418;
															__eflags = _t441 & _t329;
															if((_t441 & _t329) == 0) {
																 *(_t395 + 0x14) = _t418;
															}
															_t408 = _t329;
															goto L166;
														}
														 *(_t395 + 0xa) = 1;
														goto L26;
													}
													_t347 =  *(_t453 + 6) & 0x000000ff;
													L100:
													_t290 = _t453 + _t347 * 8;
													goto L104;
												}
												_t347 = _t289 & 0x3f;
												__eflags = _t347;
												goto L100;
											} else {
												_t441 = _t395;
												_t399 = _t452;
												_t349 = E6E0067E2(_t452, _t395, _t452);
												__eflags = _t349;
												if(_t349 == 0) {
													_t441 = 2;
													goto L97;
												}
												__eflags =  *(_t395 + 0xa) & 0x00002000;
												if(( *(_t395 + 0xa) & 0x00002000) == 0) {
													goto L193;
												}
												L25:
												_t441 = 2;
												L26:
												__eflags =  *((intOrPtr*)(_t452 + 0xda)) - _t441;
												if( *((intOrPtr*)(_t452 + 0xda)) != _t441) {
													_t261 = 0;
													__eflags = 0;
												} else {
													_t261 =  *(_t452 + 0xd4);
												}
												__eflags = _t261;
												if(_t261 == 0) {
													L32:
													__eflags =  *(_t395 + 0xa) & 0x00000001;
													_t400 =  *_t395;
													if(( *(_t395 + 0xa) & 0x00000001) == 0) {
														_t399 = _t400 + 0xfffffff0;
														__eflags =  *(_t452 + 0x4c);
														if( *(_t452 + 0x4c) == 0) {
															_t453 =  *_t399 & 0x0000ffff;
														} else {
															_t381 =  *_t399;
															__eflags =  *(_t452 + 0x4c) & _t381;
															if(( *(_t452 + 0x4c) & _t381) != 0) {
																_t381 = _t381 ^  *(_t452 + 0x50);
																__eflags = _t381;
															}
															_t453 = _t381 & 0x0000ffff;
														}
														_t262 =  *(_t399 + 6);
														__eflags = _t262;
														if(_t262 == 0) {
															_t441 = _t452;
														} else {
															_t441 = (_t399 & 0xffff0000) - ((_t262 & 0x000000ff) << 0x10) + 0x10000;
														}
														__eflags = _t441;
														if(_t441 == 0) {
															L192:
															_v12 = 0xc0000141;
															goto L193;
														} else {
															__eflags =  *((char*)(_t399 + 7)) - 3;
															if( *((char*)(_t399 + 7)) != 3) {
																_t271 = _t453 & 0x0000ffff;
																L81:
																_t453 = _t399 + _t271 * 8;
																goto L82;
															}
															L58:
															__eflags =  *(_t399 + 0x1c) + 0x20 + _t399 -  *((intOrPtr*)(_t441 + 0x28));
															if( *(_t399 + 0x1c) + 0x20 + _t399 <  *((intOrPtr*)(_t441 + 0x28))) {
																 *_t395 =  *(_t399 + 0x18);
																 *(_t395 + 0x14) =  *(_t395 + 0x14) & 0x00000000;
																_t453 = 0;
																 *(_t395 + 4) =  *(_t399 + 0x1c);
																 *(_t395 + 8) = 0x10000000;
																goto L82;
															}
															_t443 =  *((intOrPtr*)(_t441 + 0x10));
															__eflags = _t443 - _t452 + 0xa4;
															if(_t443 == _t452 + 0xa4) {
																L61:
																_t399 = 2;
																L62:
																_t441 = 0;
																__eflags = 0;
																goto L63;
															}
															_t441 = _t443 + 0xfffffff0;
															_t399 = 2;
															goto L63;
														}
													}
													_t399 = _t400 + 0xfffffff8;
													__eflags =  *((char*)(_t399 + 7)) - 5;
													if( *((char*)(_t399 + 7)) == 5) {
														_t399 = _t399 - (( *(_t399 + 6) & 0x000000ff) << 3);
														__eflags = _t399;
													}
													__eflags =  *((intOrPtr*)(_t399 + 7)) - 4;
													if( *((intOrPtr*)(_t399 + 7)) != 4) {
														_t383 =  *(_t399 + 6);
														__eflags = _t383;
														if(_t383 == 0) {
															_t441 = _t452;
														} else {
															_t449 = (_t399 & 0xffff0000) - ((_t383 & 0x000000ff) << 0x10);
															_t383 =  *((intOrPtr*)(_t399 + 7));
															_t441 = _t449 + 0x10000;
														}
														__eflags = _t441;
														if(_t441 == 0) {
															goto L192;
														} else {
															__eflags = _t383 - 3;
															if(_t383 == 3) {
																goto L58;
															}
															__eflags =  *(_t452 + 0x4c);
															if( *(_t452 + 0x4c) == 0) {
																_t384 =  *_t399 & 0x0000ffff;
															} else {
																_t385 =  *_t399;
																__eflags =  *(_t452 + 0x4c) & _t385;
																if(( *(_t452 + 0x4c) & _t385) != 0) {
																	_t385 = _t385 ^  *(_t452 + 0x50);
																	__eflags = _t385;
																}
																_t384 = _t385 & 0x0000ffff;
															}
															_t271 = _t384 & 0x0000ffff;
															goto L81;
														}
													} else {
														_t453 =  *(_t399 - 0x18);
														_t378 = _t452 + 0x9c;
														L65:
														__eflags = _t453 - _t378;
														if(_t453 == _t378) {
															_v12 = 0x8000001a;
															goto L193;
														}
														_t453 = _t453 + 0x18;
														goto L82;
													}
												} else {
													_t441 = _t395;
													_t390 = E6E0067E2(_t452, _t395, _t399);
													__eflags = _t390;
													if(_t390 == 0) {
														goto L32;
													}
													__eflags =  *(_t395 + 0xa) & 0x00002000;
													if(( *(_t395 + 0xa) & 0x00002000) == 0) {
														goto L193;
													}
													goto L32;
												}
											}
										}
										_t351 =  *(_t453 + 6) & 0x000000ff;
										L85:
										_t273 = _t453 + _t351 * 8;
										goto L89;
									}
									_t351 = _t272 & 0x3f;
									__eflags = _t351;
									goto L85;
								}
							}
							_t378 = _t452 + 0x9c;
							_t453 =  *_t378;
							goto L65;
						}
					}
					_t393 = E6E00433B(__edx, __ecx, __ecx, _t453, __eflags);
					__eflags = _t393;
					if(_t393 != 0) {
						goto L5;
					} else {
						_v12 = 0xc000000d;
						goto L193;
					}
				} else {
					_t453 =  *0x6e035724; // 0x0
					 *0x6e03b1e0(__ecx, __edx);
					_t265 =  *_t453();
					L201:
					return E6DF8B640(_t265, _t395, _v8 ^ _t455, _t441, _t452, _t453);
				}
			}

0x6dfeeb97
0x6dfeeb99
0x6dfeeb9f
0x6dfeeba1
0x6dfeebaa
0x6dfeebc3
0x6dfeebcd
0x6dfeebd5
0x6dfeebd7
0x6dfeebf0
0x6dfeebf0
0x6dfeebf4
0x6dfeebf6
0x6dfeebf9
0x6dfeebfb
0x6dfeec04
0x6dfeec08
0x6dfeec0e
0x00000000
0x00000000
0x6dfeec16
0x6dfeec16
0x6dfeec19
0x6dfeec3a
0x6dfeec3a
0x6dfeec3e
0x6dfeec4d
0x6dfeec50
0x6dfeec52
0x6dfeec58
0x6dfeec5a
0x6dfeec5d
0x6dfeec5f
0x6dfeec5f
0x6dfeec64
0x6dfeec68
0x6dfeec73
0x6dfeec73
0x6dfeec7e
0x6dfeec7f
0x6dfeec81
0x6dfeec8b
0x6dfeec91
0x00000000
0x00000000
0x6dfeec97
0x00000000
0x6dfeec97
0x6dfeec83
0x00000000
0x6dfeec6a
0x6dfeec6a
0x6dfeec6d
0x00000000
0x00000000
0x00000000
0x6dfeec6d
0x6dfeec68
0x6dfeec40
0x6dfeec43
0x00000000
0x00000000
0x6dfeec45
0x00000000
0x6dfeec1b
0x6dfeec1b
0x6dfeec22
0x6dfeec2c
0x6dfeec2c
0x6dfeec24
0x6dfeec24
0x6dfeec24
0x6dfeec2e
0x6dfeec30
0x00000000
0x6dfeec36
0x6dfeec36
0x00000000
0x6dfeec36
0x6dfeec30
0x6dfeebfd
0x6dfeebfd
0x6dfeedd2
0x6dfeedd2
0x6dfeedd4
0x6dfeedd6
0x6dfeedf0
0x6dfeedf6
0x6dfeee00
0x6dfeee00
0x6dfeedf8
0x6dfeedf8
0x6dfeedf8
0x6dfeee02
0x6dfeee04
0x6dfeef6c
0x6dfeef71
0x00000000
0x6dfeee0a
0x6dfeee0a
0x6dfeee0c
0x6dfeee0f
0x6dfeee20
0x6dfeee11
0x6dfeee11
0x6dfeee13
0x6dfeee16
0x6dfeee18
0x6dfeee18
0x6dfeee18
0x6dfeee1b
0x6dfeee1b
0x6dfeee29
0x6dfeee2c
0x6dfeee30
0x6dfeee3d
0x6dfeee43
0x6dfeee46
0x6dfeee49
0x6dfeee4c
0x6dfeee4e
0x6dfeee4e
0x6dfeee53
0x6dfeee53
0x6dfeee65
0x6dfeee6b
0x6dfeee90
0x6dfeee90
0x6dfeee92
0x6dfef23e
0x6dfef23e
0x6dfef243
0x6dfef245
0x6dfef257
0x6dfef247
0x6dfef250
0x6dfef250
0x6dfef25c
0x6dfef25f
0x6dfef261
0x6dfef267
0x6dfef26e
0x6dfef270
0x6dfef277
0x6dfef27b
0x6dfef27b
0x6dfef277
0x6dfef26e
0x6dfef280
0x00000000
0x6dfef280
0x6dfeee98
0x6dfeee9b
0x6dfeee9d
0x6dfeeeaa
0x6dfeeeac
0x6dfeeeb4
0x6dfeeeb6
0x6dfeeeb9
0x6dfeeec0
0x6dfeeec1
0x6dfeeec5
0x6dfeeecb
0x6dfeeed5
0x6dfeeed5
0x6dfeeecd
0x6dfeeecd
0x6dfeeecd
0x6dfeeed7
0x6dfeeed9
0x6dfeef00
0x6dfeef09
0x6dfeef0c
0x6dfeef0e
0x6dfef1f7
0x6dfef1f9
0x6dfef1fd
0x6dfef20e
0x6dfef1ff
0x6dfef1ff
0x6dfef201
0x6dfef204
0x6dfef206
0x6dfef206
0x6dfef206
0x6dfef209
0x6dfef209
0x6dfef21b
0x6dfef221
0x6dfef226
0x6dfef22a
0x6dfef22e
0x00000000
0x6dfef22e
0x6dfeef14
0x6dfeef17
0x6dfeef19
0x6dfeef26
0x6dfeef28
0x6dfeef30
0x6dfeef32
0x6dfeef35
0x6dfeef37
0x6dfeef3a
0x6dfeef3d
0x6dfef0ea
0x6dfef0ee
0x6dfef0ff
0x6dfef0f0
0x6dfef0f0
0x6dfef0f2
0x6dfef0f5
0x6dfef0f7
0x6dfef0f7
0x6dfef0f7
0x6dfef0fa
0x6dfef0fa
0x6dfef10a
0x6dfef10e
0x6dfef113
0x6dfef116
0x6dfef11a
0x6dfef11e
0x6dfef133
0x6dfef120
0x6dfef120
0x6dfef122
0x6dfef125
0x6dfef127
0x6dfef127
0x6dfef127
0x6dfef12a
0x6dfef12d
0x6dfef12d
0x6dfef136
0x6dfef139
0x6dfef13c
0x6dfef13e
0x6dfef140
0x6dfef140
0x6dfef143
0x6dfef146
0x6dfef146
0x6dfef14a
0x6dfef15f
0x6dfef162
0x6dfef14c
0x6dfef14c
0x6dfef14e
0x6dfef151
0x6dfef153
0x6dfef153
0x6dfef153
0x6dfef156
0x6dfef15a
0x6dfef15a
0x6dfef165
0x6dfef167
0x6dfef1a9
0x6dfef1af
0x6dfef1b2
0x6dfef1b9
0x6dfef1bf
0x6dfef1bb
0x6dfef1bb
0x6dfef1bb
0x6dfef1c3
0x6dfef169
0x6dfef169
0x6dfef16d
0x6dfef175
0x6dfef17b
0x6dfef17f
0x6dfef186
0x6dfef18d
0x6dfef193
0x6dfef18f
0x6dfef18f
0x6dfef18f
0x6dfef197
0x6dfef19b
0x6dfef1a4
0x6dfef1a4
0x6dfef1c7
0x6dfef1cb
0x6dfef1e0
0x6dfef1e3
0x6dfef1cd
0x6dfef1cd
0x6dfef1cf
0x6dfef1d2
0x6dfef1d4
0x6dfef1d4
0x6dfef1d4
0x6dfef1d7
0x6dfef1db
0x6dfef1db
0x6dfef1ee
0x00000000
0x6dfef1ee
0x6dfeef43
0x6dfeef46
0x6dfef0d0
0x6dfef0d5
0x6dfef0da
0x6dfef0de
0x6dfef0e1
0x00000000
0x6dfef0e1
0x6dfeef4c
0x6dfeef4f
0x6dfeef7b
0x6dfeef7e
0x6dfeef80
0x6dfeef96
0x6dfeef82
0x6dfeef82
0x6dfeef84
0x6dfeef87
0x6dfeef89
0x6dfeef8b
0x6dfeef8b
0x6dfeef8b
0x6dfeef8e
0x6dfeef91
0x6dfeef91
0x6dfeef99
0x6dfeef9c
0x6dfeef9f
0x6dfeefad
0x6dfeefb0
0x6dfeefc3
0x6dfeefc5
0x6dfeefcf
0x6dfeefd1
0x6dfeeffa
0x6dfeeffc
0x6dfef00d
0x6dfeeffe
0x6dfeeffe
0x6dfef000
0x6dfef003
0x6dfef005
0x6dfef005
0x6dfef005
0x6dfef008
0x6dfef008
0x6dfeefd3
0x6dfeefe0
0x6dfeefe2
0x6dfeefe5
0x6dfeeff0
0x6dfeeff0
0x6dfeeff2
0x6dfeefe7
0x6dfeefe7
0x6dfeefe7
0x6dfeeff4
0x6dfeeff4
0x6dfef016
0x6dfeefc7
0x6dfeefca
0x6dfeefca
0x6dfeefb2
0x6dfeefb8
0x6dfeefb8
0x6dfeefa1
0x6dfeefa9
0x6dfeefa9
0x6dfef025
0x6dfef02b
0x6dfef031
0x6dfef035
0x6dfef038
0x6dfef03b
0x6dfef049
0x6dfef04c
0x6dfef05f
0x6dfef061
0x6dfef06b
0x6dfef06d
0x6dfef096
0x6dfef09a
0x6dfef0ab
0x6dfef09c
0x6dfef09c
0x6dfef09e
0x6dfef0a1
0x6dfef0a3
0x6dfef0a3
0x6dfef0a3
0x6dfef0a6
0x6dfef0a6
0x6dfef06f
0x6dfef07c
0x6dfef07e
0x6dfef081
0x6dfef08c
0x6dfef08c
0x6dfef08e
0x6dfef083
0x6dfef083
0x6dfef083
0x6dfef090
0x6dfef090
0x6dfef0b4
0x6dfef063
0x6dfef066
0x6dfef066
0x6dfef04e
0x6dfef054
0x6dfef054
0x6dfef03d
0x6dfef045
0x6dfef045
0x6dfef0b8
0x6dfef0be
0x6dfef0bf
0x6dfef0c2
0x6dfef0c4
0x6dfef0c6
0x6dfef0c6
0x6dfef0c9
0x00000000
0x6dfef0c9
0x6dfeef54
0x00000000
0x6dfeef54
0x6dfeef2a
0x6dfeef21
0x6dfeef21
0x00000000
0x6dfeef21
0x6dfeef1e
0x6dfeef1e
0x00000000
0x6dfeeedb
0x6dfeeedc
0x6dfeeede
0x6dfeeee0
0x6dfeeee5
0x6dfeeee7
0x6dfeeeff
0x00000000
0x6dfeeeff
0x6dfeeeee
0x6dfeeef2
0x00000000
0x00000000
0x6dfeeca2
0x6dfeeca4
0x6dfeeca5
0x6dfeeca5
0x6dfeecab
0x6dfeecb5
0x6dfeecb5
0x6dfeecad
0x6dfeecad
0x6dfeecad
0x6dfeecb7
0x6dfeecb9
0x6dfeecd8
0x6dfeecd8
0x6dfeecdc
0x6dfeecde
0x6dfeed59
0x6dfeed5c
0x6dfeed60
0x6dfeed71
0x6dfeed62
0x6dfeed62
0x6dfeed64
0x6dfeed67
0x6dfeed69
0x6dfeed69
0x6dfeed69
0x6dfeed6c
0x6dfeed6c
0x6dfeed74
0x6dfeed77
0x6dfeed79
0x6dfeed93
0x6dfeed7b
0x6dfeed8b
0x6dfeed8b
0x6dfeed95
0x6dfeed97
0x6dfef237
0x6dfef237
0x00000000
0x6dfeed9d
0x6dfeed9d
0x6dfeeda1
0x6dfeee8a
0x6dfeee8d
0x6dfeee8d
0x00000000
0x6dfeee8d
0x6dfeeda7
0x6dfeedaf
0x6dfeedb2
0x6dfeee73
0x6dfeee78
0x6dfeee7c
0x6dfeee7e
0x6dfeee81
0x00000000
0x6dfeee81
0x6dfeedb8
0x6dfeedc1
0x6dfeedc3
0x6dfeedcd
0x6dfeedcf
0x6dfeedd0
0x6dfeedd0
0x6dfeedd0
0x00000000
0x6dfeedd0
0x6dfeedc7
0x6dfeedca
0x00000000
0x6dfeedca
0x6dfeed97
0x6dfeece0
0x6dfeece3
0x6dfeece7
0x6dfeecf0
0x6dfeecf0
0x6dfeecf0
0x6dfeecf5
0x6dfeecf8
0x6dfeed08
0x6dfeed0b
0x6dfeed0d
0x6dfeed2a
0x6dfeed0f
0x6dfeed1d
0x6dfeed1f
0x6dfeed22
0x6dfeed22
0x6dfeed2c
0x6dfeed2e
0x00000000
0x6dfeed34
0x6dfeed34
0x6dfeed37
0x00000000
0x00000000
0x6dfeed39
0x6dfeed3d
0x6dfeed4e
0x6dfeed3f
0x6dfeed3f
0x6dfeed41
0x6dfeed44
0x6dfeed46
0x6dfeed46
0x6dfeed46
0x6dfeed49
0x6dfeed49
0x6dfeed51
0x00000000
0x6dfeed51
0x6dfeecfa
0x6dfeecfa
0x6dfeecfd
0x6dfeede0
0x6dfeede0
0x6dfeede2
0x6dfeef5d
0x00000000
0x6dfeef5d
0x6dfeede8
0x00000000
0x6dfeede8
0x6dfeecbb
0x6dfeecbc
0x6dfeecc0
0x6dfeecc5
0x6dfeecc7
0x00000000
0x00000000
0x6dfeecce
0x6dfeecd2
0x00000000
0x00000000
0x00000000
0x6dfeecd2
0x6dfeecb9
0x6dfeeed9
0x6dfeeeae
0x6dfeeea5
0x6dfeeea5
0x00000000
0x6dfeeea5
0x6dfeeea2
0x6dfeeea2
0x00000000
0x6dfeeea2
0x6dfeee04
0x6dfeedd8
0x6dfeedde
0x00000000
0x6dfeedde
0x6dfeebfb
0x6dfeebdb
0x6dfeebe0
0x6dfeebe2
0x00000000
0x6dfeebe4
0x6dfeebe4
0x00000000
0x6dfeebe4
0x6dfeebac
0x6dfeebac
0x6dfeebb6
0x6dfeebbc
0x6dfef283
0x6dfef293
0x6dfef293

APIs

RtlDebugPrintTimes.9419(?,?,?,?,?,6E002783,00000001,?,00000000,?,?,?,?,6DF9FC15), ref: 6DFEEBB6
RtlGetCurrentServiceSessionId.9419(?,?,?,6E002783,00000001), ref: 6DFEF23E

Strings

@, xrefs: 6DFEF10A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDebugPrintServiceSessionTimes
String ID: @
API String ID: 358024996-2766056989
Opcode ID: ccf9e7426839a52e8047266fe07c77926f4802f845d503a4189ea226a5d88451
Instruction ID: 145f379647e74863011fdbe8dfaaab33833015c63bdb315279b9dc5191c24560
Opcode Fuzzy Hash: ccf9e7426839a52e8047266fe07c77926f4802f845d503a4189ea226a5d88451
Instruction Fuzzy Hash: 9A322231214692BBE765CF2DE080372B7F1BF45384F04849AE895CF285E335E856DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF80E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6DF80E21(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v60;
				intOrPtr* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				long _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr* _v104;
				intOrPtr* _t41;
				intOrPtr* _t48;
				void* _t49;
				long _t53;
				signed int _t55;
				void* _t58;
				intOrPtr* _t59;
				void* _t60;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t66;
				intOrPtr* _t67;
				intOrPtr _t68;
				void* _t71;
				intOrPtr* _t72;
				long _t74;
				void* _t75;
				signed int _t79;
				signed int _t81;

				_t68 = __edx;
				_t81 = (_t79 & 0xfffffff8) - 0x5c;
				_v8 =  *0x6e03d360 ^ _t81;
				_t41 = _a4;
				 *_t81 = _t41;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				if(_t41 == 0) {
					L23:
					_t74 = 0xc000000d;
					goto L10;
				} else {
					_t74 = 0;
					 *_t41 = 0;
					if(__edx == 0) {
						goto L23;
					} else {
						_t72 = __edx + 4;
						_t59 =  *_t72;
						while(_t59 != _t72) {
							_t67 = _t59 - 8;
							if( *_t67 != 0x74736c46) {
								_v72 = 1;
								_v68 = 1;
								_v88 = 1;
								_push( &_v92);
								_v84 = _t74;
								_v76 = 4;
								_v64 = _t72;
								_v60 = _t67;
								_v92 = 0xc0150015;
								E6DF9DEF0(_t67, _t68);
								_t67 = _t59 - 8;
							}
							if( *(_t67 + 4) == 0x20) {
								L22:
								_t59 =  *_t59;
								_push(1);
								_pop(1);
								continue;
							} else {
								_t53 = _t74;
								_t68 = _t67;
								while(( *(_t68 + 0x20) & 0x00000004) == 0) {
									_t53 = _t53 + 1;
									_t68 = _t68 + 0x30;
									if(_t53 < 0x20) {
										continue;
									} else {
										goto L22;
									}
									goto L24;
								}
								_t55 =  *(_t67 + 4) + 1;
								 *(_t67 + 4) = _t55;
								 *(_t67 + 0x14) =  !_t55;
								_t12 = _t68 + 0x18; // 0x100000016
								_t64 = _t12;
								if(_t64 == 0) {
									goto L22;
								} else {
									L9:
									 *((intOrPtr*)(_t64 + 8)) = 8;
									 *_v104 = _t64;
									L10:
									_pop(_t71);
									_pop(_t75);
									_pop(_t58);
									return E6DF8B640(_t74, _t58, _v8 ^ _t81, _t68, _t71, _t75);
								}
							}
							goto L24;
						}
						_t60 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t74, 0x618);
						if(_t60 == 0) {
							_t74 = 0xc0000017;
							goto L10;
						} else {
							L18();
							 *((intOrPtr*)(_t60 + 4)) = 1;
							_t18 = _t60 + 0x18; // 0x18
							_t64 = _t18;
							 *((intOrPtr*)(_t60 + 0x14)) = 0xfffffffe;
							_t48 = _t60 + 8;
							_t68 =  *_t72;
							if( *((intOrPtr*)(_t68 + 4)) != _t72) {
								_t65 = 3;
								asm("int 0x29");
								 *_t65 = 0x74736c46;
								 *((intOrPtr*)(_t65 + 0x10)) = 0;
								_t66 = _t65 + 0x1c;
								_t49 = 0x20;
								do {
									 *((intOrPtr*)(_t66 - 4)) = 0;
									 *_t66 = 0;
									_t66 = _t66 + 0x30;
									 *((intOrPtr*)(_t66 - 0x2c)) = 0xc;
									 *((intOrPtr*)(_t66 - 0x28)) = 0;
									_t49 = _t49 - 1;
								} while (_t49 != 0);
								return _t49;
							} else {
								 *_t48 = _t68;
								 *((intOrPtr*)(_t48 + 4)) = _t72;
								 *((intOrPtr*)(_t68 + 4)) = _t48;
								 *_t72 = _t48;
								goto L9;
							}
						}
					}
				}
				L24:
			}

0x6df80e21
0x6df80e29
0x6df80e33
0x6df80e37
0x6df80e3a
0x6df80e3d
0x6df80e3e
0x6df80e3f
0x6df80e42
0x6dfbcc6f
0x6dfbcc6f
0x00000000
0x6df80e48
0x6df80e48
0x6df80e4a
0x6df80e4e
0x00000000
0x6df80e54
0x6df80e54
0x6df80e59
0x6df80e5c
0x6df80e60
0x6df80e69
0x6dfbcc2b
0x6dfbcc2f
0x6dfbcc33
0x6dfbcc3b
0x6dfbcc3c
0x6dfbcc40
0x6dfbcc48
0x6dfbcc4c
0x6dfbcc50
0x6dfbcc58
0x6dfbcc5d
0x6dfbcc5d
0x6df80e73
0x6dfbcc65
0x6dfbcc65
0x6dfbcc67
0x6dfbcc69
0x00000000
0x6df80e79
0x6df80e79
0x6df80e7b
0x6df80e7d
0x6df80ebd
0x6df80ebe
0x6df80ec4
0x00000000
0x6df80ec6
0x00000000
0x6df80ec6
0x00000000
0x6df80ec4
0x6df80e86
0x6df80e87
0x6df80e8c
0x6df80e8f
0x6df80e8f
0x6df80e94
0x00000000
0x6df80e9a
0x6df80e9a
0x6df80e9e
0x6df80ea5
0x6df80ea7
0x6df80ead
0x6df80eae
0x6df80eaf
0x6df80eba
0x6df80eba
0x6df80e94
0x00000000
0x6df80e73
0x6df80edf
0x6df80ee3
0x6df80f13
0x00000000
0x6df80ee5
0x6df80ee7
0x6df80eec
0x6df80ef3
0x6df80ef3
0x6df80ef6
0x6df80efd
0x6df80f00
0x6df80f05
0x6df80f1c
0x6df80f1d
0x6df80f21
0x6df80f29
0x6df80f2c
0x6df80f2f
0x6df80f30
0x6df80f30
0x6df80f33
0x6df80f35
0x6df80f38
0x6df80f3f
0x6df80f42
0x6df80f42
0x6df80f47
0x6df80f07
0x6df80f07
0x6df80f09
0x6df80f0c
0x6df80f0f
0x00000000
0x6df80f0f
0x6df80f05
0x6df80ee3
0x6df80e4e
0x00000000

APIs

RtlAllocateHeap.9419(?,00000000,00000618,?,?), ref: 6DF80EDA
RtlRaiseException.9419 ref: 6DFBCC58

Strings

Flst, xrefs: 6DF80E63

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: cedad11986e0b6aa18110510545a623364e32faca7307385f926c3ae352205f2
Instruction ID: e20872bf03829c8e6821e47384530ef05cbed9da8cd064f02ad783625bdefddd
Opcode Fuzzy Hash: cedad11986e0b6aa18110510545a623364e32faca7307385f926c3ae352205f2
Instruction Fuzzy Hash: 784189B160A3028FD306CF2EC580626FBF4FB89B10F50856EE599CB242D771C841CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF42240, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6DF42240(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				long _t80;
				signed int _t89;
				intOrPtr* _t101;
				long _t107;
				signed char _t118;
				intOrPtr _t119;
				void* _t124;

				_push(0x4c);
				_push(0x6e01f350);
				E6DF9D08C(__ebx, __edi, __esi);
				 *((char*)(_t124 - 0x19)) = 1;
				_t80 = 0xc0000001;
				 *((intOrPtr*)(_t124 - 0x20)) = 0xc0000001;
				 *((intOrPtr*)(_t124 - 0x28)) = 0;
				 *((intOrPtr*)(_t124 - 0x24)) = 0;
				 *((intOrPtr*)(_t124 - 0x2c)) =  *((intOrPtr*)(_t124 + 8));
				if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
					 *((intOrPtr*)( *((intOrPtr*)(_t124 + 0xc)))) = 0;
					 *((intOrPtr*)(_t124 - 4)) = 0;
					_t107 = E6DF42BC2(_t124 - 0x28,  *(_t124 + 0x20) & 0x00000100);
					 *((intOrPtr*)(_t124 - 0x20)) = _t107;
					if(_t107 < 0) {
						L13:
						_t121 =  *((intOrPtr*)(_t124 - 0x24));
					} else {
						_t121 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0x34);
						 *((intOrPtr*)(_t124 - 0x24)) = _t121;
						if(_t121 == 0) {
							_t107 = 0xc0000017;
							goto L9;
						} else {
							 *((intOrPtr*)(_t121 + 0x20)) = 0;
							 *((intOrPtr*)(_t121 + 0x30)) = 0;
							_t19 = _t121 + 8; // 0x8
							_t118 =  *(_t124 + 0x20);
							_t107 = E6DF42B93(_t19, _t118,  *((intOrPtr*)(_t124 - 0x28)));
							 *((intOrPtr*)(_t124 - 0x20)) = _t107;
							if(_t107 >= 0) {
								 *((char*)(_t124 - 0x19)) = 1;
								 *((intOrPtr*)(_t121 + 0x10)) =  *((intOrPtr*)(_t124 + 0x10));
								_t89 =  *(_t124 + 0x14);
								 *(_t121 + 0x14) = _t89;
								 *((intOrPtr*)(_t121 + 0x18)) = 0;
								 *((char*)(_t121 + 0x2c)) = _t89 & 0xffffff00 |  *((intOrPtr*)(_t124 + 0x1c)) != 0x00000000;
								 *((intOrPtr*)(_t121 + 0x1c)) =  *((intOrPtr*)(_t124 + 8));
								 *((intOrPtr*)(_t121 + 0x24)) = 0;
								 *((intOrPtr*)(_t121 + 0x28)) = 0;
								 *((intOrPtr*)(_t124 - 0x5c)) = 3;
								 *((intOrPtr*)(_t124 - 0x58)) = 0;
								 *((intOrPtr*)(_t124 - 0x54)) = 0;
								 *((intOrPtr*)(_t124 - 0x50)) = 0;
								 *((intOrPtr*)(_t124 - 0x4c)) = 0;
								 *((intOrPtr*)(_t124 - 0x48)) = 0;
								 *((intOrPtr*)(_t124 - 0x44)) = 0;
								 *((intOrPtr*)(_t124 - 0x40)) = 0;
								 *((intOrPtr*)(_t124 - 0x3c)) = 1;
								 *((intOrPtr*)(_t124 - 0x38)) = 0x28;
								if(( *(_t124 + 0x20) & 0x000000e0) != 0) {
									_push(2);
									_pop(0);
									 *((intOrPtr*)(_t124 - 0x40)) = 0;
								}
								if(( *(_t124 + 0x20) & 0x00000010) != 0) {
									 *((intOrPtr*)(_t124 - 0x40)) = 1;
								}
								 *((intOrPtr*)(_t124 - 0x44)) = 0x6df4ba10;
								_t54 = _t121 + 0x20; // 0x20
								_t107 = L6DF6EE50(_t118, _t54, 0x6e019440, _t121, _t124 - 0x5c);
								 *((intOrPtr*)(_t124 - 0x20)) = _t107;
								if(_t107 >= 0) {
									 *((intOrPtr*)(_t124 - 0x34)) =  *((intOrPtr*)(_t124 + 0x18));
									 *(_t124 - 0x30) = 0;
									 *((intOrPtr*)(_t124 - 0x34)) = L6DF8CF90( *((intOrPtr*)(_t124 + 0x18)), 0, 0xffffd8f0, 0xffffffff);
									 *(_t124 - 0x30) = _t118;
									_t107 =  *((intOrPtr*)(_t124 + 8));
									asm("lock inc dword [ebx]");
									E6DF62280(_t107 + 4, _t107 + 4);
									 *((intOrPtr*)(_t124 - 4)) = 1;
									_t101 = _t107 + 0xc;
									_t119 =  *_t101;
									if( *((intOrPtr*)(_t119 + 4)) != _t101) {
										_push(3);
										asm("int 0x29");
										goto L13;
									} else {
										 *_t121 = _t119;
										 *((intOrPtr*)(_t121 + 4)) = _t101;
										 *((intOrPtr*)(_t119 + 4)) = _t121;
										 *_t101 = _t121;
										 *((intOrPtr*)( *((intOrPtr*)(_t124 + 0xc)))) = _t121;
										E6DF6C4A0( *((intOrPtr*)(_t121 + 0x20)), _t124 - 0x34,  *((intOrPtr*)(_t124 + 0x1c)), 0);
										 *((intOrPtr*)(_t124 - 4)) = 0;
										L6DF423EC(_t107);
										_t121 = 0;
										 *((intOrPtr*)(_t124 - 0x24)) = 0;
										_t107 = 0;
										L9:
										 *((intOrPtr*)(_t124 - 0x20)) = _t107;
									}
								}
							}
						}
					}
					 *((intOrPtr*)(_t124 - 4)) = 0xfffffffe;
					E6DF423F6(_t121, 0);
					_t80 = _t107;
				}
				return E6DF9D0D1(_t80);
			}

0x6df42240
0x6df42242
0x6df42247
0x6df4224c
0x6df42250
0x6df42255
0x6df4225a
0x6df4225d
0x6df42263
0x6df42274
0x6df4227d
0x6df4227f
0x6df42293
0x6df42295
0x6df4229a
0x6df4240c
0x6df4240c
0x6df422a0
0x6df422b1
0x6df422b3
0x6df422b8
0x6df9f60d
0x00000000
0x6df422be
0x6df422be
0x6df422c1
0x6df422c7
0x6df422ca
0x6df422d2
0x6df422d4
0x6df422d9
0x6df422e2
0x6df422e8
0x6df422eb
0x6df422ee
0x6df422f1
0x6df422fa
0x6df42300
0x6df42303
0x6df42306
0x6df42309
0x6df42310
0x6df42313
0x6df42316
0x6df42319
0x6df4231c
0x6df4231f
0x6df42322
0x6df42325
0x6df42328
0x6df42335
0x6df9f617
0x6df9f619
0x6df9f61a
0x6df9f61a
0x6df4233f
0x6df9f624
0x6df9f624
0x6df42345
0x6df42356
0x6df4235f
0x6df42361
0x6df42366
0x6df4236b
0x6df4236e
0x6df4237f
0x6df42382
0x6df42385
0x6df42388
0x6df4238f
0x6df42394
0x6df4239b
0x6df4239e
0x6df423a3
0x6df42407
0x6df4240a
0x00000000
0x6df423a5
0x6df423a5
0x6df423a7
0x6df423aa
0x6df423ad
0x6df423b2
0x6df423bf
0x6df423c4
0x6df423c7
0x6df423cc
0x6df423ce
0x6df423d1
0x6df423d3
0x6df423d3
0x6df423d3
0x6df423a3
0x6df42366
0x6df422d9
0x6df422b8
0x6df423d6
0x6df423dd
0x6df423e2
0x6df423e2
0x6df423e9

APIs

RtlAllocateHeap.9419(?,00000000,00000034,?,?,?,?,?,?,?,?,?,6E01F350,0000004C), ref: 6DF422AC
TpAllocTimer.9419(00000020,6E019440,00000000,00000003,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 6DF4235A

Strings

(, xrefs: 6DF42328

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocAllocateHeapTimer
String ID: (
API String ID: 2926205940-3887548279
Opcode ID: 79b5d789b089dbba629e25a45d630d2929dd4756269bb7aaec8de88f2a526896
Instruction ID: 7d5a73d10bb1226bb4e8e75f59f8013d7f1e400d5e2230af1d3c30c32208866a
Opcode Fuzzy Hash: 79b5d789b089dbba629e25a45d630d2929dd4756269bb7aaec8de88f2a526896
Instruction Fuzzy Hash: 864123B1E14359DFCB10CF98C880A9DBFB4BF08714F11822AE548AB641C7B59981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6DF466D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
nativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E6DF466D4(void* __ecx, WCHAR* __edx, signed int* _a4) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				void* _v40;
				void* __edi;
				void* __esi;
				void* _t20;
				signed int* _t25;
				void* _t26;
				signed int _t27;

				_t24 = __edx;
				_v8 =  *0x6e03d360 ^ _t27;
				_t25 = _a4;
				_t26 = __ecx;
				 *_t25 =  *_t25 & 0x00000000;
				RtlInitUnicodeString( &_v40, __edx);
				_push( &_v32);
				_push(0x14);
				_push( &_v28);
				_push(2);
				_push( &_v40);
				_push(_t26);
				if(E6DF89650() >= 0) {
					if(_v24 != 4 || _v20 != 4) {
						_t17 = 0xc0000001;
					} else {
						 *_t25 = _v16;
						_t17 = 0;
					}
				}
				return E6DF8B640(_t17, _t20, _v8 ^ _t27, _t24, _t25, _t26);
			}

0x6df466d4
0x6df466e3
0x6df466e8
0x6df466f0
0x6df466f2
0x6df466f5
0x6df466fd
0x6df466fe
0x6df46703
0x6df46704
0x6df46709
0x6df4670a
0x6df46712
0x6dfa1a85
0x6dfa1a99
0x6dfa1a8d
0x6dfa1a90
0x6dfa1a92
0x6dfa1a92
0x6dfa1a85
0x6df46727

APIs

RtlInitUnicodeString.9419(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DF466F5
ZwQueryValueKey.9419(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DF4670B

Strings

UBR, xrefs: 6DF466EE

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: f14743829e340906c48d2ab32e50380274dba724ba48895fc9caccb0b6879540
Instruction ID: 43d803133d365ba453ee9eca2f9edd4fad5cb5710f2ac41132965d0e42a42f5e
Opcode Fuzzy Hash: f14743829e340906c48d2ab32e50380274dba724ba48895fc9caccb0b6879540
Instruction Fuzzy Hash: ED012C72A0410EEFDB00CA99C8419FFB7BCEB45714F118466E905E7140D734AE4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF8DF1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E6DFF8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x6e020d50);
				E6DF9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E6DFD5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = E6DF9DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				E6DF9DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E6DF9D130(_t34, _t39, _t40);
			}

0x6dff8df1
0x6dff8df1
0x6dff8df1
0x6dff8df1
0x6dff8df1
0x6dff8df1
0x6dff8df3
0x6dff8df8
0x6dff8dfd
0x6dff8e00
0x6dff8e0e
0x6dff8e2a
0x6dff8e36
0x6dff8e38
0x6dff8e3c
0x6dff8e46
0x6dff8e46
0x6dff8e36
0x6dff8e50
0x6dff8e56
0x6dff8e59
0x6dff8e5c
0x6dff8e60
0x6dff8e67
0x6dff8e6d
0x6dff8e73
0x6dff8e74
0x6dff8eb1
0x6dff8ebd

APIs

DbgPrintEx.9419(00000065,00000000,Critical error detected %lx,?,6E020D50,00000074,6E0020A2,?,?,6DFFFFAF,00000001,00000020,6E0358C0,00000000), ref: 6DFF8E2A
RtlRaiseException.9419(?), ref: 6DFF8E74

Strings

Critical error detected %lx, xrefs: 6DFF8E21

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionPrintRaise
String ID: Critical error detected %lx
API String ID: 1813208005-802127002
Opcode ID: c8210b025f1c6e09c975dec764e551d5511b434cc954da57d78b370cf5e3e2e6
Instruction ID: cf033b8f8c2d611d47ff9c3b8cc311971be1066411d622d1ccbad1cde7bb227b
Opcode Fuzzy Hash: c8210b025f1c6e09c975dec764e551d5511b434cc954da57d78b370cf5e3e2e6
Instruction Fuzzy Hash: B3115BB5C19349DBEF19CFAD89057DCBBB0BB45314F20425DD568AB2A2C3340A02CF14

Uniqueness

Uniqueness Score: -1.00%

Function 6E00E2C5, Relevance: 4.7, APIs: 3, Instructions: 202
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E6E00E2C5(unsigned int __edx, intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				signed short _v10;
				signed short _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				void* __ebx;
				void* __edi;
				signed short _t72;
				signed int _t81;
				signed int _t95;
				signed int _t96;
				intOrPtr _t98;
				signed int _t109;
				intOrPtr _t112;
				signed int _t120;
				signed int _t121;
				signed int* _t122;
				signed int _t126;
				void* _t127;
				intOrPtr _t128;
				signed char _t130;
				signed int _t131;
				signed int _t132;
				intOrPtr _t136;
				signed char _t138;
				signed int _t139;
				unsigned int _t146;
				signed int _t149;
				signed int _t150;
				unsigned int _t157;
				signed int _t158;
				intOrPtr _t159;
				signed int _t160;
				unsigned int _t162;
				signed int _t163;
				signed int _t164;
				intOrPtr _t165;
				intOrPtr _t167;
				signed int _t169;
				signed int _t170;
				unsigned int _t171;
				signed short _t172;
				signed int _t174;

				_t167 = _a4;
				_t120 = 0;
				_t162 = __edx;
				_v20 = __edx;
				_t72 = __edx >> 0x0000000c ^  *(__edx + 0x18) ^  *0x6e036114;
				_v12 = _t72;
				_t146 = _t72 >> 0x10;
				if(_t167 != __edx) {
					_t120 = _t72 & 0x0000ffff;
					_t169 = _t167 - _t146 - __edx;
					_t6 = _t120 + 7; // 0x7
					_t7 = (_t6 >> 3) + 0x6df2aff8; // 0xa090807
					_t128 =  *((intOrPtr*)(_t127 + 0x78 + ( *_t7 & 0x000000ff) * 4));
					_t147 =  *(_t128 + 0x24);
					_t130 =  *(_t128 + 0x28) & 0x000000ff;
					if( *(_t128 + 0x24) == 0) {
						_t149 = _t169 >> _t130;
						_t170 = _t169 & (1 << _t130) - 0x00000001;
					} else {
						_t149 = E6DF8D340(_t169 * _t147, _t130, _t169 * _t147 >> 0x20);
						_t120 = _t120 * _t149;
						_t170 = _t169 - _t120;
					}
					if(_t170 != 0) {
						L34:
						return 0;
					} else {
						_t81 =  *(_t162 + 0x12) & 0x0000ffff;
						_t18 = _t149 + 1; // 0x1
						_t131 = _t18;
						_t150 = _t81;
						if(_t131 >= _t81) {
							goto L34;
						}
						L7:
						_v40 = (_t150 & 0x0000ffff) + (_t150 & 0x0000ffff);
						_v36 = _t162 + 0x20;
						_t163 = _t131 + _t131;
						while(1) {
							L8:
							_t132 = _v40;
							_v24 = _t163;
							asm("sbb ebx, ebx");
							_v8 = _t132;
							_t121 = _t120 & _t163;
							_t26 = _t132 - 1; // -1
							_t171 = _t26;
							while(1) {
								_v16 = _t121;
								if(_t171 - _t121 + 1 >= 1) {
									goto L11;
								}
								L10:
								_t126 = _t121 | 0xffffffff;
								L18:
								if(_v16 == 0) {
									if(_t126 == 0xffffffff) {
										goto L34;
									}
									L24:
									if(_t126 < _t163) {
										goto L34;
									}
									_t172 = _v12;
									_t164 = _t172 & 0x0000ffff;
									_t120 = _t126 >> 1;
									_t157 = _t164 * _t120 + (_v10 & 0x0000ffff);
									_t98 = _v20;
									_v16 = _t157 + _t98;
									_t138 =  *(_t98 + 0x1c) & 0x000000ff;
									_v8 = _t157 >> _t138;
									_t165 = _v20;
									_v28 = (_t164 - 1 + _t157 >> _t138) + 1;
									_v32 = ( *(_t165 + 0x1e) & 0x0000ffff) + _t165;
									_t52 = _t165 + 0xc; // 0xc
									E6DF6FAD0(_t52);
									_t109 = _v8;
									_t139 = _v28;
									if(_t109 >= _t139) {
										L31:
										_t62 = _t165 + 0xc; // 0xc
										E6DF6FA00(_t120, _t139, _t165, _t62);
										if(_v8 != 0xffffffff) {
											_t158 = _v16;
											_t112 = E6E00E247(_t165, _t158, _t120, _a16);
											 *_a8 = _t112;
											 *_a12 = (_t172 & 0x0000ffff) - _t112;
											return _t158;
										}
										_t163 = _v24 + 2;
										goto L8;
									}
									_t159 = _v32;
									while(1) {
										_t172 = _v12;
										if( *((intOrPtr*)(_t159 + _t109 * 2)) < 0) {
											break;
										}
										_t109 = _t109 + 1;
										_v8 = _t109;
										if(_t109 < _t139) {
											continue;
										}
										goto L31;
									}
									_v8 = _v8 | 0xffffffff;
									goto L31;
								}
								_t39 = _t163 + 1; // -1
								_t174 = _t39;
								if(_t174 > _t132) {
									_t174 = _t132;
								}
								_t171 = _t174 - 1;
								_t121 = 0;
								_v16 = _t121;
								if(_t171 - _t121 + 1 >= 1) {
									goto L11;
								}
								goto L10;
								L11:
								_v28 = _v36 + (_t171 >> 5) * 4;
								_t136 = _v36;
								_t122 = _t136 + (_t121 >> 5) * 4;
								_t95 =  !( *_t122) | (1 << (_t121 & 0x0000001f)) - 0x00000001;
								if(_t95 != 0xffffffff) {
									L15:
									_t96 =  !_t95;
									asm("bsf eax, eax");
									_t126 = (_t122 - _t136 >> 2 << 5) + _t96;
									_v28 = _t96;
									if(_t126 > _t171) {
										L22:
										_t126 = _t126 | 0xffffffff;
										L17:
										_t132 = _v8;
										goto L18;
									}
									if(_t126 != 0xffffffff) {
										goto L24;
									}
									goto L17;
								}
								_t160 = _v28;
								while(1) {
									_t126 =  &(_t122[1]);
									if(_t126 > _t160) {
										goto L22;
									}
									_t95 =  !( *_t126);
									if(_t95 == 0xffffffff) {
										continue;
									}
									goto L15;
								}
								goto L22;
							}
						}
					}
				}
				_t150 =  *(__edx + 0x12) & 0x0000ffff;
				_t131 = 0;
				goto L7;
			}

0x6e00e2cf
0x6e00e2d2
0x6e00e2d5
0x6e00e2d9
0x6e00e2e2
0x6e00e2ea
0x6e00e2ed
0x6e00e2f2
0x6e00e2fc
0x6e00e301
0x6e00e303
0x6e00e309
0x6e00e310
0x6e00e314
0x6e00e31a
0x6e00e31f
0x6e00e338
0x6e00e33d
0x6e00e321
0x6e00e32a
0x6e00e32c
0x6e00e32f
0x6e00e32f
0x6e00e341
0x6e00e4c4
0x00000000
0x6e00e347
0x6e00e347
0x6e00e34b
0x6e00e34b
0x6e00e34e
0x6e00e352
0x00000000
0x00000000
0x6e00e358
0x6e00e35d
0x6e00e363
0x6e00e366
0x6e00e369
0x6e00e369
0x6e00e369
0x6e00e36e
0x6e00e371
0x6e00e373
0x6e00e376
0x6e00e378
0x6e00e378
0x6e00e37b
0x6e00e37d
0x6e00e386
0x00000000
0x00000000
0x6e00e388
0x6e00e388
0x6e00e3ed
0x6e00e3f1
0x6e00e40e
0x00000000
0x00000000
0x6e00e414
0x6e00e416
0x00000000
0x00000000
0x6e00e41c
0x6e00e423
0x6e00e426
0x6e00e42d
0x6e00e42f
0x6e00e435
0x6e00e438
0x6e00e440
0x6e00e446
0x6e00e44e
0x6e00e457
0x6e00e45a
0x6e00e45e
0x6e00e463
0x6e00e466
0x6e00e46b
0x6e00e489
0x6e00e489
0x6e00e48d
0x6e00e496
0x6e00e4a6
0x6e00e4ac
0x6e00e4b4
0x6e00e4be
0x00000000
0x6e00e4c0
0x6e00e49b
0x00000000
0x6e00e49b
0x6e00e46d
0x6e00e470
0x6e00e476
0x6e00e479
0x00000000
0x00000000
0x6e00e47b
0x6e00e47c
0x6e00e481
0x00000000
0x00000000
0x00000000
0x6e00e483
0x6e00e485
0x00000000
0x6e00e485
0x6e00e3f3
0x6e00e3f3
0x6e00e3f8
0x6e00e3fa
0x6e00e3fa
0x6e00e3fc
0x6e00e3ff
0x6e00e37d
0x6e00e386
0x00000000
0x00000000
0x00000000
0x6e00e38d
0x6e00e39d
0x6e00e3a7
0x6e00e3ae
0x6e00e3b5
0x6e00e3ba
0x6e00e3cf
0x6e00e3cf
0x6e00e3d3
0x6e00e3dc
0x6e00e3de
0x6e00e3e3
0x6e00e406
0x6e00e406
0x6e00e3ea
0x6e00e3ea
0x00000000
0x6e00e3ea
0x6e00e3e8
0x00000000
0x00000000
0x00000000
0x6e00e3e8
0x6e00e3bc
0x6e00e3bf
0x6e00e3bf
0x6e00e3c4
0x00000000
0x00000000
0x6e00e3c8
0x6e00e3cd
0x00000000
0x00000000
0x00000000
0x6e00e3cd
0x00000000
0x6e00e3bf
0x6e00e37b
0x6e00e369
0x6e00e341
0x6e00e2f4
0x6e00e2f8
0x00000000

APIs

_aullshr.9419(-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000,00000000,?,?,6E002783,00000001), ref: 6E00E325
RtlAcquireSRWLockShared.9419(0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6E00E45E
RtlReleaseSRWLockShared.9419(0000000C,0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6E00E48D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease_aullshr
String ID:
API String ID: 815091738-0
Opcode ID: 229e116b68a6d6477fdd00e7177c83c4c5fd1673eaf01e6cb11b543878fce54b
Instruction ID: a4b3081be7a55813da277ebb9b25d7f4f4e407bf47ed10ae1bc871617fb29aa2
Opcode Fuzzy Hash: 229e116b68a6d6477fdd00e7177c83c4c5fd1673eaf01e6cb11b543878fce54b
Instruction Fuzzy Hash: 3961C271E0461A8FDF14CFA9C8806ADB7F2FB88324724836AD825E77C0D7349942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF72990, Relevance: 4.6, APIs: 3, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6DF72990() {
				intOrPtr* _t62;
				signed int _t64;
				intOrPtr _t66;
				intOrPtr* _t69;
				intOrPtr _t76;
				intOrPtr* _t79;
				void* _t81;
				intOrPtr _t82;
				intOrPtr* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				intOrPtr _t99;
				void* _t101;
				intOrPtr* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x6e01ff00);
				E6DF9D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x6df21664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E6DF8E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x6df21668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E6DFC51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x6df2166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E6DF72AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E6DF56600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E6DF72C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								L6DF5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E6DF72AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E6DF72C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E6DF72ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E6DF9D0D1(_t62);
				goto L28;
			}

0x6df72990
0x6df72992
0x6df72997
0x6df729a3
0x6df729a6
0x6df729ab
0x6df729ad
0x6df729b2
0x6dfb5c80
0x6df729b8
0x6df729b8
0x6df729bb
0x6df729c0
0x6df729c5
0x6df729c6
0x6df729c6
0x6df729cb
0x00000000
0x00000000
0x6df729cd
0x6df729d0
0x6df729d9
0x6df729db
0x6df729dd
0x6df72a7f
0x6df72a84
0x6df72a87
0x6df72a89
0x6dfb5ca1
0x6dfb5ca3
0x00000000
0x6df72a8f
0x6df72a8f
0x00000000
0x6df72a8f
0x00000000
0x6df729e3
0x6df729e3
0x6df729e3
0x00000000
0x6df729e3
0x6df729dd
0x00000000
0x6df729db
0x6df729e6
0x6df729e9
0x6df729eb
0x6df729ed
0x6df729f3
0x6df729f5
0x6df729f8
0x6df729fa
0x6df72a97
0x6df72a9a
0x6df72a9d
0x6df72add
0x00000000
0x6df72a9f
0x6df72aa2
0x6df72aa5
0x6df72aa8
0x6df72aab
0x6dfb5cab
0x6dfb5caf
0x6dfb5cc5
0x6dfb5cda
0x6dfb5cdc
0x6dfb5cdf
0x6dfb5ce5
0x00000000
0x6dfb5ceb
0x6dfb5ced
0x6dfb5cee
0x00000000
0x6dfb5cee
0x6dfb5cb1
0x6dfb5cb4
0x6dfb5cb9
0x6dfb5cbb
0x00000000
0x6dfb5cbd
0x6dfb5cbd
0x00000000
0x6dfb5cbd
0x6dfb5cbb
0x6df72ab1
0x6df72ab1
0x6df72ac4
0x6df72ac6
0x6df72ac6
0x00000000
0x6df72ac6
0x6df72aab
0x00000000
0x6df72a00
0x6df72a09
0x6df72a0e
0x6df72a21
0x6df72a24
0x6df72a35
0x6df72a3a
0x6df72a3d
0x6df72a42
0x6df72a59
0x6df72a59
0x6df72a5c
0x6df72a5f
0x6df72a5f
0x6df729fa
0x6df729f3
0x6df72a64
0x6df72a64
0x6df72a6b
0x6df72a6b
0x6df72a6d
0x6df72a72
0x00000000

APIs

RtlEnterCriticalSection.9419(?,6E01FF00,00000020,6DF7251C,?,?,?,?,?,?,00000000,0000000E,00000000), ref: 6DF72A09
_wcsnicmp.9419(?,?,00000001,6E01FF00,00000020,6DF7251C,?,?,?,?,?,?,00000000,0000000E,00000000), ref: 6DF72A7F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterSection_wcsnicmp
String ID:
API String ID: 2198911780-0
Opcode ID: ba8b7703ceec5c2a7ec6419cbd7027bcf159c9fa8a3bc518bb00327b14d568f5
Instruction ID: 3e1a7aa8f3c703c40f33095c95107a52973080cf1bd052a7fb05df2df4d7630c
Opcode Fuzzy Hash: ba8b7703ceec5c2a7ec6419cbd7027bcf159c9fa8a3bc518bb00327b14d568f5
Instruction Fuzzy Hash: CD512B72D0420AAFDF35CF59D880AEEBBB6BF48714F118056E914AB250D7369D52CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF62280, Relevance: 4.6, APIs: 3, Instructions: 119
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DF62280(signed char __eax, unsigned int* _a4) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				unsigned int _v40;
				char _v44;
				signed int _v48;
				signed char _t35;
				signed int _t37;
				signed int _t55;
				signed int _t56;
				void* _t57;
				signed int _t61;
				signed int _t63;
				unsigned int _t66;
				unsigned int* _t68;
				unsigned int _t74;
				signed int _t76;

				_t35 = __eax;
				_t68 = _a4;
				_v44 = 0;
				asm("lock bts dword [edi], 0x0");
				if((_t76 & 0xfffffff0) < 0) {
					_t66 =  *_t68;
					while(1) {
						L3:
						_t56 = 1;
						_v40 = _t66;
						__eflags = 0x00000001 & _t66;
						if((0x00000001 & _t66) == 0) {
							break;
						}
						_t37 = E6DF7E180(_t35);
						__eflags = _t37;
						if(_t37 != 0) {
							_push("true");
							_push(0xffffffff);
							E6DF897C0();
							_t66 = _v48;
							_t56 = 1;
						}
						_v48 = 0;
						_v24 =  *( *[fs:0x18] + 0x24);
						_v16 = 3;
						_v28 = 0;
						__eflags = _t66 & 0x00000002;
						if((_t66 & 0x00000002) != 0) {
							_v32 = 0;
							_v20 = 0xffffffff;
							_v36 = _t66 & 0xfffffff0;
							_t61 = _t66 & 0x00000008 |  &_v36 | 0x00000007;
							_v48 =  !(_t66 >> 2) & 0xffffff01;
						} else {
							_v32 =  &_v36;
							_t55 = _t66 >> 4;
							__eflags = _t56 - _t55;
							_v20 = _t55;
							asm("sbb ecx, ecx");
							_t61 = (_t56 & 0x00000008) + 0x00000003 |  &_v36;
							__eflags = _t55;
							if(_t55 == 0) {
								_v20 = 0xfffffffe;
							}
						}
						asm("lock cmpxchg [edi], esi");
						_t74 = _t66;
						__eflags = _t74 - _t66;
						if(_t74 == _t66) {
							__eflags = _v48;
							if(_v48 != 0) {
								E6DF8006A(_t68, _t61);
							}
							__eflags =  *0x7ffe036a - 1;
							if(__eflags <= 0) {
								L18:
								_t35 =  &_v16;
								asm("lock btr dword [eax], 0x1");
								if(__eflags >= 0) {
									goto L10;
								}
								while(1) {
									_push(0);
									_push(_t68);
									E6DF8B180();
									_t35 = _v24;
									__eflags = _t35 & 0x00000004;
									if((_t35 & 0x00000004) != 0) {
										goto L10;
									}
								}
								goto L10;
							} else {
								_t63 =  *0x6e036904;
								__eflags = _t63;
								if(__eflags == 0) {
									goto L18;
								} else {
									goto L16;
								}
								while(1) {
									L16:
									__eflags = _v16 & 0x00000002;
									if(__eflags == 0) {
										goto L18;
									}
									asm("pause");
									_t63 = _t63 - 1;
									__eflags = _t63;
									if(__eflags != 0) {
										continue;
									}
									goto L18;
								}
								goto L18;
							}
						} else {
							_t35 = E6DF76B90(_t61,  &_v44);
							_t74 =  *_t68;
							L10:
							_t66 = _t74;
							continue;
						}
					}
					_t57 = _t66 + 1;
					_t35 = _t66;
					asm("lock cmpxchg [edi], ecx");
					__eflags = _t35 - _t66;
					if(_t35 == _t66) {
						goto L1;
					}
					_t35 = E6DF76B90(_t57,  &_v44);
					_t66 =  *_t68;
					goto L3;
				}
				L1:
				return _t35;
			}

0x6df62280
0x6df6228d
0x6df62290
0x6df62298
0x6df6229d
0x6df622a7
0x6df622a9
0x6df622a9
0x6df622a9
0x6df622ae
0x6df622b2
0x6df622b4
0x00000000
0x00000000
0x6df622ba
0x6df622bf
0x6df622c1
0x6df9e1f1
0x6df9e1f6
0x6df9e1f8
0x6df9e1fd
0x6df9e201
0x6df9e201
0x6df622cd
0x6df622d5
0x6df622d9
0x6df622e1
0x6df622e9
0x6df622ec
0x6df623b4
0x6df623bf
0x6df623c7
0x6df623db
0x6df623e5
0x6df622f2
0x6df622f6
0x6df62300
0x6df62303
0x6df62305
0x6df62309
0x6df62311
0x6df62313
0x6df62315
0x6df62317
0x6df62317
0x6df62315
0x6df62323
0x6df62327
0x6df62329
0x6df6232b
0x6df62364
0x6df62369
0x6df623f1
0x6df623f1
0x6df6236f
0x6df62377
0x6df62392
0x6df62392
0x6df62396
0x6df6239b
0x00000000
0x00000000
0x6df623a0
0x6df623a0
0x6df623a2
0x6df623a3
0x6df623a8
0x6df623ac
0x6df623ae
0x00000000
0x00000000
0x6df623b0
0x00000000
0x6df62379
0x6df62379
0x6df6237f
0x6df62381
0x00000000
0x00000000
0x00000000
0x00000000
0x6df62383
0x6df62383
0x6df62387
0x6df62389
0x00000000
0x00000000
0x6df6238b
0x6df6238d
0x6df6238d
0x6df62390
0x00000000
0x00000000
0x00000000
0x6df62390
0x00000000
0x6df62383
0x6df6232d
0x6df62332
0x6df62337
0x6df62339
0x6df62339
0x00000000
0x6df62339
0x6df6232b
0x6df62340
0x6df62343
0x6df62345
0x6df62349
0x6df6234b
0x00000000
0x00000000
0x6df62356
0x6df6235d
0x00000000
0x6df6235d
0x6df6229f
0x6df622a4

APIs

RtlDllShutdownInProgress.9419(00000000), ref: 6DF622BA
ZwWaitForAlertByThreadId.9419(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6DF623A3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlertProgressShutdownThreadWait
String ID:
API String ID: 3332923688-0
Opcode ID: 1241ba2f4b5a1120a92b0c8968152e17607a04e329018d80fd2b3a9cd3aef5a8
Instruction ID: 6ee0c3b9577d445ae3907d365ad8fd8ed64a8957124116b1e83e865e9d711bb8
Opcode Fuzzy Hash: 1241ba2f4b5a1120a92b0c8968152e17607a04e329018d80fd2b3a9cd3aef5a8
Instruction Fuzzy Hash: 964137316083828BD724CF1CC84176AB7E5BBC5B14F044A2DF995DB680D736D9458BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF79702, Relevance: 4.6, APIs: 3, Instructions: 118
nativeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6DF79702(void* __ebx, void* __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __edi;
				intOrPtr _t49;
				intOrPtr* _t53;
				intOrPtr _t54;
				intOrPtr* _t61;
				signed int* _t62;
				signed int _t64;
				intOrPtr _t65;
				void* _t70;
				intOrPtr* _t71;
				signed int _t72;
				signed int _t77;
				signed int _t84;
				signed int _t85;
				intOrPtr _t88;
				signed int _t91;
				intOrPtr _t96;
				intOrPtr _t97;
				signed int _t99;
				intOrPtr _t100;

				_t96 = __edx;
				_v28 = __edx;
				_t70 = __ecx;
				if(__edx == 0) {
					_t49 = _a8;
					if(_t49 == 0 || ( *(_t49 + 0x1c) & 0x00000002) == 0) {
						_t96 =  *0x6e0386c0;
						_v28 = _t96;
						goto L1;
					} else {
						_t96 =  *0x6e0386b8;
						_v28 = _t96;
						goto L30;
					}
				} else {
					L1:
					if(_t96 ==  *0x6e0386b8) {
						L30:
						_v24 = 1;
					} else {
						_v24 = _a4;
					}
				}
				_t84 =  *(_t70 + 4);
				L22();
				_t71 = _t70 + 0xc;
				_t88 = _t84 * 0xc +  *((intOrPtr*)(_t96 + 0x10 + _v24 * 4));
				E6DF62280(_t88 + 8, _t88 + 8);
				_t53 =  *((intOrPtr*)(_t88 + 4));
				if( *_t53 != _t88) {
					_t77 = 3;
					asm("int 0x29");
					_push(_t96);
					_push(_t88);
					_t54 =  *((intOrPtr*)(_t77 + 0x104));
					while(1) {
						_t97 = _t54;
						if(_t54 == 0xfffffffe) {
							goto L26;
						}
						if(_t54 != _t84) {
							if(_t54 != 0xffffffff) {
								_t77 = _t77 | 0xffffffff;
								L27:
								_t54 = _t97;
								asm("lock cmpxchg [edi], ecx");
								if(_t54 != _t97) {
									continue;
								}
							}
						}
						return _t54;
						goto L35;
						L26:
						_t77 = _t84;
						goto L27;
					}
				} else {
					 *((intOrPtr*)(_t71 + 4)) = _t53;
					 *_t71 = _t88;
					 *_t53 = _t71;
					 *((intOrPtr*)(_t88 + 4)) = _t71;
					E6DF5FFB0(_t71, _t88, _t88 + 8);
					if( *((intOrPtr*)(_t96 + 0x100)) !=  *0x7ffe03c0) {
						E6E018214(_t96);
					}
					_v24 = 0;
					_t61 =  *((intOrPtr*)( *[fs:0x18] + 0xf90));
					if(_t61 != 0) {
						_t65 =  *_t61;
						if( *((intOrPtr*)(_t65 + 0x18)) == _t96 &&  *((intOrPtr*)(_t65 + 0x40)) == 3) {
							 *((intOrPtr*)(_t65 + 0x40)) = 4;
							_v24 = 1;
						}
					}
					_t62 = _t96 + 8;
					_t99 = _v24;
					_t91 =  *_t62;
					_t85 = _t62[1];
					_v16 = _t62;
					do {
						_v8 = _t85;
						_t72 = _t91;
						_v12 = _t72;
						_v20 = _t85 + 1;
						if((_t91 & 0xffff0000) == 0) {
							if(_t99 != 0) {
								goto L10;
							} else {
								_v24 = 1;
								_t91 = _t91 & 0x0000ffff | (_t91 & 0xffff0000) + 0x00010000;
								goto L11;
							}
							goto L35;
						} else {
							L10:
							_v24 = _v24 & 0x00000000;
						}
						L11:
						_t64 = _t72;
						asm("lock cmpxchg8b [edi]");
						_t91 = _t64;
					} while (_t91 != _v12 || _t85 != _v8);
					_t100 = _v28;
					if(_v24 != 0) {
						_push( *((intOrPtr*)(_t100 + 0x24)));
						_t64 = E6DF8AB70();
					}
					return _t64;
				}
				L35:
			}

0x6df7970f
0x6df79711
0x6df79715
0x6df7971a
0x6df79836
0x6df7983b
0x6df79847
0x6df7984d
0x00000000
0x6df9e496
0x6df9e496
0x6df9e49c
0x00000000
0x6df9e49c
0x6df79720
0x6df79720
0x6df79726
0x6df9e4a0
0x6df9e4a0
0x6df7972c
0x6df7972f
0x6df7972f
0x6df79726
0x6df79733
0x6df79738
0x6df79741
0x6df79747
0x6df7974f
0x6df79754
0x6df79759
0x6df79858
0x6df79859
0x6df7985d
0x6df7985e
0x6df79865
0x6df79867
0x6df79867
0x6df7986c
0x00000000
0x00000000
0x6df79870
0x6df9e4cf
0x6df9e4d5
0x6df7987b
0x6df7987b
0x6df7987d
0x6df79883
0x00000000
0x6df79885
0x6df79883
0x6df9e4cf
0x6df79878
0x00000000
0x6df79879
0x6df79879
0x00000000
0x6df79879
0x6df7975f
0x6df7975f
0x6df79762
0x6df79764
0x6df7976a
0x6df7976d
0x6df7977e
0x6df9e4af
0x6df9e4af
0x6df79786
0x6df79790
0x6df79798
0x6df7979a
0x6df7979f
0x6df9e4b9
0x6df9e4c3
0x6df9e4c3
0x6df7979f
0x6df797ab
0x6df797ae
0x6df797b2
0x6df797b4
0x6df797b7
0x6df797bb
0x6df797bb
0x6df797bf
0x6df797c1
0x6df797c8
0x6df797d2
0x6df7980d
0x00000000
0x6df7980f
0x6df79811
0x6df79828
0x00000000
0x6df79828
0x00000000
0x6df797d4
0x6df797d4
0x6df797d4
0x6df797d4
0x6df797d9
0x6df797d9
0x6df797e5
0x6df797e9
0x6df797eb
0x6df797fc
0x6df79800
0x6df7982c
0x6df7982f
0x6df7982f
0x6df79808
0x6df79808
0x00000000

APIs

RtlAcquireSRWLockExclusive.9419(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6DF7974F
RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6DF7976D
ZwReleaseWorkerFactoryWorker.9419(?), ref: 6DF7982F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockReleaseWorker$AcquireFactory
String ID:
API String ID: 2301053956-0
Opcode ID: 0a7a83dd4281ced46ff3bb8faf7ac129b37cf7bc4a79336eebaf21bac8f5c17f
Instruction ID: ae89f2124479b0a904086f53cfe0c16deeb2d08ba2af903fc701d19716e99f6f
Opcode Fuzzy Hash: 0a7a83dd4281ced46ff3bb8faf7ac129b37cf7bc4a79336eebaf21bac8f5c17f
Instruction Fuzzy Hash: 07418C769097028FC721CF1DE440A9AB7F5FF88714F01896AE8949B350DB70E945CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6FAD0, Relevance: 4.6, APIs: 3, Instructions: 116
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E6DF6FAD0(signed int* _a4) {
				signed int _v16;
				intOrPtr _v20;
				signed char _v24;
				signed int _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				char _v44;
				char _v45;
				signed int _v48;
				signed char _t34;
				signed int _t36;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				signed int _t53;
				signed int* _t61;
				signed int _t66;
				signed int _t68;

				_t61 = _a4;
				_v44 = 0;
				_t34 = 0;
				asm("lock cmpxchg [edi], ecx");
				_t49 = 0;
				_v40 = 0;
				if(0 != 0) {
					while(1) {
						_t66 = _t49 >> 0x00000001 & 0x00000001;
						__eflags = _t49 & 0x00000001;
						if((_t49 & 0x00000001) == 0) {
							goto L5;
						}
						__eflags = _t66;
						if(_t66 != 0) {
							L9:
							_t36 = E6DF7E180(_t34);
							__eflags = _t36;
							if(_t36 != 0) {
								_push("true");
								_push(0xffffffff);
								E6DF897C0();
								_t49 = _v48;
							}
							_v45 = 0;
							_v24 =  *( *[fs:0x18] + 0x24);
							_v16 = 2;
							_v28 = 0;
							__eflags = _t66;
							if(_t66 != 0) {
								_v32 = 0;
								_v20 = 0xffffffff;
								_v36 = _t49 & 0xfffffff0;
								_t57 = _t49 & 0x00000008 |  &_v36 | 0x00000007;
								__eflags = _t49 & 0x00000004;
								if((_t49 & 0x00000004) == 0) {
									_v45 = 1;
								}
							} else {
								_t47 =  &_v36;
								_v20 = 0xfffffffe;
								_v32 = _t47;
								_t57 = _t47 | 0x00000003;
								__eflags = _t47 | 0x00000003;
							}
							asm("lock cmpxchg [edi], esi");
							_t68 = _t49;
							__eflags = _t68 - _t49;
							if(_t68 == _t49) {
								__eflags = _v45;
								if(_v45 != 0) {
									E6DF8006A(_t61, _t57);
								}
								__eflags =  *0x7ffe036a - 1;
								if(__eflags <= 0) {
									L20:
									_t34 =  &_v16;
									asm("lock btr dword [eax], 0x1");
									if(__eflags >= 0) {
										goto L14;
									}
									while(1) {
										_push(0);
										_push(_t61);
										E6DF8B180();
										_t34 = _v24;
										__eflags = _t34 & 0x00000004;
										if((_t34 & 0x00000004) != 0) {
											goto L14;
										}
									}
									goto L14;
								} else {
									_t51 =  *0x6e036904;
									__eflags = _t51;
									if(__eflags == 0) {
										goto L20;
									} else {
										goto L18;
									}
									while(1) {
										L18:
										__eflags = _v16 & 0x00000002;
										if(__eflags == 0) {
											goto L20;
										}
										asm("pause");
										_t51 = _t51 - 1;
										__eflags = _t51;
										if(__eflags != 0) {
											continue;
										}
										goto L20;
									}
									goto L20;
								}
							} else {
								L13:
								_t34 = E6DF76B90(_t49,  &_v44);
								_t68 =  *_t61;
								L14:
								_t49 = _t68;
								_v40 = _t49;
								continue;
							}
						}
						__eflags = _t49 & 0xfffffff0;
						if((_t49 & 0xfffffff0) <= 0) {
							goto L9;
						}
						L5:
						_t53 = _t49 | 0x00000001;
						__eflags = _t66;
						if(_t66 == 0) {
							__eflags = _t53 + 0x10;
						}
						_t34 = _t49;
						asm("lock cmpxchg [edi], edx");
						__eflags = _t34 - _t49;
						if(_t34 == _t49) {
							goto L1;
						} else {
							goto L13;
						}
					}
				}
				L1:
				return _t34;
			}

0x6df6fadd
0x6df6fae5
0x6df6faed
0x6df6faef
0x6df6faf3
0x6df6faf5
0x6df6fafb
0x6df6fb05
0x6df6fb09
0x6df6fb0c
0x6df6fb0f
0x00000000
0x00000000
0x6df6fb11
0x6df6fb13
0x6df6fb35
0x6df6fb35
0x6df6fb3a
0x6df6fb3c
0x6df9e291
0x6df9e296
0x6df9e298
0x6df9e29d
0x6df9e29d
0x6df6fb48
0x6df6fb50
0x6df6fb54
0x6df6fb5c
0x6df6fb64
0x6df6fb66
0x6df6fbf4
0x6df6fbff
0x6df6fc09
0x6df6fc16
0x6df6fc19
0x6df6fc1c
0x6df6fc22
0x6df6fc22
0x6df6fb6c
0x6df6fb6c
0x6df6fb70
0x6df6fb7a
0x6df6fb7e
0x6df6fb7e
0x6df6fb7e
0x6df6fb85
0x6df6fb89
0x6df6fb8b
0x6df6fb8d
0x6df6fba6
0x6df6fbab
0x6df6fc2f
0x6df6fc2f
0x6df6fbb1
0x6df6fbb9
0x6df6fbd4
0x6df6fbd4
0x6df6fbd8
0x6df6fbdd
0x00000000
0x00000000
0x6df6fbe0
0x6df6fbe0
0x6df6fbe2
0x6df6fbe3
0x6df6fbe8
0x6df6fbec
0x6df6fbee
0x00000000
0x00000000
0x6df6fbf0
0x00000000
0x6df6fbbb
0x6df6fbbb
0x6df6fbc1
0x6df6fbc3
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6fbc5
0x6df6fbc5
0x6df6fbc9
0x6df6fbcb
0x00000000
0x00000000
0x6df6fbcd
0x6df6fbcf
0x6df6fbcf
0x6df6fbd2
0x00000000
0x00000000
0x00000000
0x6df6fbd2
0x00000000
0x6df6fbc5
0x6df6fb8f
0x6df6fb8f
0x6df6fb94
0x6df6fb99
0x6df6fb9b
0x6df6fb9b
0x6df6fb9d
0x00000000
0x6df6fb9d
0x6df6fb8d
0x6df6fb15
0x6df6fb1b
0x00000000
0x00000000
0x6df6fb1d
0x6df6fb1f
0x6df6fb22
0x6df6fb24
0x6df6fb26
0x6df6fb26
0x6df6fb29
0x6df6fb2b
0x6df6fb2f
0x6df6fb31
0x00000000
0x6df6fb33
0x00000000
0x6df6fb33
0x6df6fb31
0x6df6fb05
0x6df6fafd
0x6df6fb02

APIs

RtlDllShutdownInProgress.9419(00000000), ref: 6DF6FB35
ZwWaitForAlertByThreadId.9419(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6DF6FBE3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlertProgressShutdownThreadWait
String ID:
API String ID: 3332923688-0
Opcode ID: 56edfcba7fd66946a403a6cce61669127ab09969756e725d7ce1dc1ca867075d
Instruction ID: 4c54756bf64b598735ce5fcb41771ff55fa91aea589633760de464afbb9298bc
Opcode Fuzzy Hash: 56edfcba7fd66946a403a6cce61669127ab09969756e725d7ce1dc1ca867075d
Instruction Fuzzy Hash: 3B41D271A0D3838BD795CE1C892076B77E1BF85724F104A2DFAA897680D770C901CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7E730, Relevance: 4.6, APIs: 3, Instructions: 89
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DF7E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E6DF89670() < 0) {
					L6DF9DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t62 = _t52 & 0x000000ff;
						_t59 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6e037b9c + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M6DF7E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x6df7e730
0x6df7e736
0x6df7e738
0x6df7e73d
0x6df7e73e
0x6df7e740
0x6df7e749
0x6df7e765
0x6df7e76a
0x6df7e76b
0x6df7e76c
0x6df7e76d
0x6df7e76e
0x6df7e76f
0x6df7e775
0x6df7e777
0x6df7e77e
0x6dfbb675
0x6df7e784
0x6df7e789
0x6df7e7a8
0x6df7e7ac
0x6df7e807
0x6df7e7ae
0x6df7e7ae
0x6df7e7b1
0x6df7e7b4
0x6df7e7b9
0x6df7e7c0
0x6df7e7c4
0x6df7e7ca
0x6df7e7cc
0x00000000
0x6df7e7d3
0x6df7e7d6
0x00000000
0x00000000
0x6df7e7ff
0x6df7e802
0x00000000
0x00000000
0x6df7e7f9
0x6df7e7fc
0x00000000
0x00000000
0x6df7e7f3
0x6df7e7f6
0x00000000
0x00000000
0x6df7e7ed
0x6df7e7f0
0x00000000
0x00000000
0x6df7e7e7
0x6df7e7ea
0x00000000
0x00000000
0x6dfbb685
0x6dfbb688
0x00000000
0x00000000
0x6dfbb682
0x00000000
0x00000000
0x6df7e7cc
0x6df7e7d9
0x6df7e7dc
0x6df7e7de
0x6df7e7de
0x6df7e7ac
0x6df7e7e4
0x6df7e74b
0x6df7e751
0x6df7e759
0x6df7e761
0x6df7e761

APIs

ZwQueryInformationProcess.9419(000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6DFDFF7D,6E0209B0,00000014,6DF5EBD8,?,?,?,00000000), ref: 6DF7E742
RtlRaiseStatus.9419(00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6DFDFF7D,6E0209B0,00000014,6DF5EBD8,?,?,?,00000000), ref: 6DF7E765
RtlAllocateHeap.9419(?,?,?,?,FFFFFFFE,?,?,00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6DFDFF7D), ref: 6DF7E7A3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapInformationProcessQueryRaiseStatus
String ID:
API String ID: 1560743067-0
Opcode ID: 5f0fb0340f9a90319ff18a3a05e9b709029750ef0e91996ffcd7f1567064ee0c
Instruction ID: c8b495bfae97e0e67f594389e1ff1ecdaa3190fb3b5a48303eded6775e215b60
Opcode Fuzzy Hash: 5f0fb0340f9a90319ff18a3a05e9b709029750ef0e91996ffcd7f1567064ee0c
Instruction Fuzzy Hash: ED318C75A1424AAFD704CF5CE841BDAB7E4FB09314F148266FA14CB341D631EC80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7BC2C, Relevance: 4.6, APIs: 3, Instructions: 88
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6DF7BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				void* _t41;
				intOrPtr _t51;

				_t51 =  *0x6e036100;
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E6DF62280(0xd, 0x22610f1a0);
				_t41 =  *0x6e0360f8;
				if(_t41 != 0) {
					 *0x6e0360f8 =  *_t41;
					 *0x6e0360fc =  *0x6e0360fc + 0xffff;
				}
				E6DF5FFB0(_t41, 0x800, 0x22610f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x6e0360f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x6e036100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x6df7bc36
0x6df7bc42
0x6df7bc45
0x6df7bc4a
0x6df7bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x6df7bc50
0x6df7bc50
0x6df7bc58
0x6df7bc5a
0x6df7bc60
0x00000000
0x00000000
0x6dfba4f2
0x6dfba4f6
0x00000000
0x00000000
0x00000000
0x6dfba4fc
0x6df7bc79
0x6df7bc7e
0x6df7bc86
0x6df7bd16
0x6df7bd20
0x6df7bd20
0x6df7bc8d
0x6df7bc94
0x6df7bcbd
0x6df7bcca
0x6df7bccb
0x6df7bccc
0x6df7bccd
0x6df7bcce
0x6df7bcd4
0x6df7bcea
0x6df7bcee
0x6df7bcf2
0x6df7bd00
0x6df7bd04
0x00000000
0x6df7bc96
0x6df7bcab
0x6df7bcaf
0x6df7bd2c
0x6df7bd2c
0x6df7bd09
0x00000000
0x6df7bd09
0x6df7bcb1
0x6df7bcb5
0x6df7bcbb
0x00000000
0x00000000
0x00000000
0x6df7bcbb

APIs

RtlAcquireSRWLockExclusive.9419(?,00000030,00000000,-00000001,6DF5F875,00000000,00000000,00000000,00000001,-00000001), ref: 6DF7BC79
RtlReleaseSRWLockExclusive.9419(?,?,00000030,00000000,-00000001,6DF5F875,00000000,00000000,00000000,00000001,-00000001), ref: 6DF7BC8D
RtlAllocateHeap.9419(?,00000008,000000D0,?,?,00000030,00000000,-00000001,6DF5F875,00000000,00000000,00000000,00000001,-00000001), ref: 6DF7BCA6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAllocateHeapRelease
String ID:
API String ID: 614792542-0
Opcode ID: 5325240aaa01f37896afa8ca3138d83b45f3a132b59c153d4646c41ef7780f56
Instruction ID: e5707c86aa2d7d66d488959f31737030aa542372a915a47fe5db29956220a180
Opcode Fuzzy Hash: 5325240aaa01f37896afa8ca3138d83b45f3a132b59c153d4646c41ef7780f56
Instruction Fuzzy Hash: A431EC32A24A16DBCB21DF9CE4807E673B4FB1A310F11847AE948DF202EB749945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF890AF, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E6DF890AF(intOrPtr __ecx, void* __edx, int _a4) {
				intOrPtr* _v0;
				void* _v8;
				long _v12;
				intOrPtr _v16;
				long _v44;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				long _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E6DF9D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_push( &_v12);
				_t66 = 0x10;
				if(E6DF7E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *(_t73 + 0xc) = _t57;
				memcpy(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v44 = 0;
					_t63 = RtlImageDirectoryEntryToData(_t71, 1, 6,  &_v44);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x6df890af
0x6df890b8
0x6df890bb
0x6df890bf
0x6df890c2
0x6df890c2
0x6df890c8
0x6df890cb
0x6df890cd
0x6dfc14d7
0x6dfc14eb
0x6dfc14eb
0x00000000
0x6dfc14eb
0x6dfc14db
0x6dfc14e6
0x00000000
0x6dfc14f2
0x6dfc14e8
0x00000000
0x6dfc14e8
0x6df890da
0x6df890dd
0x6df890e5
0x00000000
0x6df89139
0x6df890fa
0x6df890fe
0x6df89142
0x00000000
0x6df89142
0x6df89104
0x6df89107
0x6df8910b
0x6df89110
0x6df89118
0x6df89147
0x6df89148
0x6df8914f
0x6df89150
0x6df89151
0x6df89152
0x6df89156
0x6df8915d
0x6df89160
0x6df89168
0x6df8916c
0x6df891bc
0x6df891be
0x00000000
0x6df891be
0x6df8916e
0x6df89173
0x6df89176
0x00000000
0x00000000
0x6df8917c
0x6df89180
0x6df891b5
0x00000000
0x6df891b5
0x6df89182
0x6df89185
0x6df89189
0x00000000
0x00000000
0x6df8918e
0x6df89190
0x6df89198
0x00000000
0x00000000
0x6df891a0
0x00000000
0x6df891ad
0x6df891ad
0x6df891b0
0x6df891b1
0x00000000
0x6df89185
0x6df8911a
0x6df8911c
0x6df8911f
0x6df89125
0x6df89127
0x00000000

APIs

RtlAllocateHeap.9419(?,00000008,00000066,00000066,00000000,00000000,00000000,00000000,00000066,00000000), ref: 6DF890F5
memcpy.9419(00000010,00000000,00000066,00000008,00000066,00000066,00000000,00000000,00000000,00000000,00000066,00000000), ref: 6DF8910B
RtlCompareMemory.9419(00000010,?,00000066,00000000,00000000,00000000,00000000,00000066,00000000), ref: 6DFC14DF

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCompareHeapMemorymemcpy
String ID:
API String ID: 2355910289-0
Opcode ID: 5bee6fe65456da6c020b91007c3b28e6621704686b2fe6c1a2c83c2b708ddb54
Instruction ID: 93fadaf2abc66212993fb4e6ea9ddc7e40fc6addc87f37e765fe1c3c13056e0d
Opcode Fuzzy Hash: 5bee6fe65456da6c020b91007c3b28e6621704686b2fe6c1a2c83c2b708ddb54
Instruction Fuzzy Hash: BF21BE72A04609EFD721CF9DC944E9AF7F8EF48714F11886AEA49AB201D730ED10CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E013EBC, Relevance: 4.6, APIs: 3, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6E013EBC(intOrPtr* __ecx, signed char _a4, signed short _a8) {
				signed int _v8;
				signed char _v20;
				long _v24;
				char _v28;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t22;
				long _t26;
				long _t29;
				signed char _t30;
				signed int _t40;

				_v8 =  *0x6e03d360 ^ _t40;
				_t37 = _a8 & 0x0000ffff;
				if(_t37 == 0) {
					L9:
					_push(6);
					goto L10;
				} else {
					_t22 = _a4;
					if((_t22 & 0x00000001) != 0 || _t37 !=  *((intOrPtr*)(_t22 + 0x34))) {
						goto L9;
					} else {
						_t30 =  *((intOrPtr*)(__ecx));
						if(_t30 == 1 || _t30 == 0) {
							_t39 = 0;
							_v28 =  *((intOrPtr*)(_t22 + 0x30));
							_push( &_v32);
							_push(0);
							_push(0);
							_push(0x10);
							_v24 = 0;
							_push( &_v28);
							_push(0x1f);
							_v20 = _t30;
							_t26 = E6DF8B0B0();
							if(_t26 == 0) {
								L8:
								_t37 = _a4;
								 *(_a4 + 0x36) = (_t30 & 0x000000ff) << 0x0000000e |  *(_a4 + 0x36) & 0x0000bfff;
							} else {
								_t29 = RtlNtStatusToDosError(_t26);
								_t39 = _t29;
								if(_t29 != 0) {
									goto L11;
								} else {
									goto L8;
								}
							}
						} else {
							_push(0x57);
							L10:
							_pop(_t39);
							L11:
							E6DF4CC50(_t39);
						}
					}
				}
				return E6DF8B640(_t39, _t30, _v8 ^ _t40, _t37, 0xbfff, _t39);
			}

0x6e013ecb
0x6e013ece
0x6e013ed8
0x6e013f49
0x6e013f49
0x00000000
0x6e013eda
0x6e013eda
0x6e013edf
0x00000000
0x6e013ee7
0x6e013ee7
0x6e013eec
0x6e013ef9
0x6e013efb
0x6e013f01
0x6e013f02
0x6e013f03
0x6e013f04
0x6e013f09
0x6e013f0c
0x6e013f0d
0x6e013f0f
0x6e013f12
0x6e013f19
0x6e013f27
0x6e013f27
0x6e013f43
0x6e013f1b
0x6e013f1c
0x6e013f21
0x6e013f25
0x00000000
0x00000000
0x00000000
0x00000000
0x6e013f25
0x6e013ef2
0x6e013ef2
0x6e013f4b
0x6e013f4b
0x6e013f4c
0x6e013f4d
0x6e013f4d
0x6e013eec
0x6e013edf
0x6e013f64

APIs

ZwTraceControl.9419(0000001F,00000001,00000010,00000000,00000000,6E0384E0,6E035338,00000000,6E035320,6E0384E0), ref: 6E013F12
RtlNtStatusToDosError.9419(00000000,0000001F,00000001,00000010,00000000,00000000,6E0384E0,6E035338,00000000,6E035320,6E0384E0), ref: 6E013F1C
RtlSetLastWin32Error.9419(00000006,6E035338,00000000,6E035320,6E0384E0), ref: 6E013F4D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Error$ControlLastStatusTraceWin32
String ID:
API String ID: 2516722664-0
Opcode ID: 768a0f6330dd8fb3cf5cf77bb1f668c50d9c476d9df460a323388ee4096129ac
Instruction ID: ee72209e0481b775c4b757f3a3df7c9dd0ce3f8ff8e55c031e6b8bb12569dd70
Opcode Fuzzy Hash: 768a0f6330dd8fb3cf5cf77bb1f668c50d9c476d9df460a323388ee4096129ac
Instruction Fuzzy Hash: 1D110A3164925AAAD710EFD68455BFB7BB8DF05790F420159FA446F241D335CD44C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6E018214, Relevance: 4.6, APIs: 3, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E6E018214(intOrPtr __ecx) {
				intOrPtr _v8;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* __ebx;
				void* __edi;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr _t31;
				char _t32;
				intOrPtr _t37;
				intOrPtr _t39;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t53;

				_t37 =  *0x7ffe03c0;
				_t47 = __ecx;
				_v24 = _t37;
				_v16 = __ecx;
				E6DF62280(__ecx + 0x2c, __ecx + 0x2c);
				_t24 =  *((intOrPtr*)(_t47 + 0x100));
				if(_t37 != _t24) {
					 *((intOrPtr*)(_t47 + 0x100)) = _t37;
					_t37 = _t37 - _t24;
					_v32 = _t37;
					if(_t37 != 0) {
						_t27 = _t47 + 8;
						_t39 =  *_t27;
						_t43 =  *((intOrPtr*)(_t27 + 4));
						_v28 = _t27;
						do {
							_t53 = _t39;
							_t45 = _t43;
							_v8 = _t45;
							asm("lock cmpxchg8b [edi]");
							_t39 = _t53;
							_t43 = _t45;
						} while (_t39 != _t53 || _t43 != _v8);
						_t31 = _v24;
						if(_t31 < 4) {
							_t32 = 4;
						} else {
							_t32 = _t31 + 1;
						}
						_t47 = _v16;
						_push(4);
						_v20 = _t32;
						_push( &_v20);
						_push(8);
						_push( *((intOrPtr*)(_v16 + 0x24)));
						E6DF8AE70();
						E6DF73B7A(_v16);
					}
				}
				return E6DF5FFB0(_t37, _t47, _t47 + 0x2c);
			}

0x6e018220
0x6e018228
0x6e01822a
0x6e01822e
0x6e018236
0x6e01823b
0x6e018243
0x6e018245
0x6e01824b
0x6e01824d
0x6e018251
0x6e018253
0x6e01825a
0x6e01825c
0x6e01825f
0x6e018263
0x6e018263
0x6e018265
0x6e018267
0x6e01827b
0x6e018283
0x6e018285
0x6e018287
0x6e018291
0x6e018298
0x6e01829f
0x6e01829a
0x6e01829a
0x6e01829a
0x6e0182a0
0x6e0182a4
0x6e0182a6
0x6e0182ae
0x6e0182af
0x6e0182b1
0x6e0182b4
0x6e0182bb
0x6e0182bb
0x6e018251
0x6e0182cf

APIs

RtlAcquireSRWLockExclusive.9419(?,?,?,?,?,?,?,6DFB43AB,?,00000000), ref: 6E018236
ZwSetInformationWorkerFactory.9419(?,00000008,?,00000004,?,?,?,?,?,?,?,6DFB43AB,?,00000000), ref: 6E0182B4
RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,?,?,?,6DFB43AB,?,00000000), ref: 6E0182C4

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFactoryInformationReleaseWorker
String ID:
API String ID: 744992574-0
Opcode ID: fa829693cc556a76f5e4bb24ed1fccb79341849d8f7d917e818517fc3fe308bd
Instruction ID: 7c924cb44cfdf6c5387d6700fda2564dc588413eebe1db1bf23cee2aaff9a9a9
Opcode Fuzzy Hash: fa829693cc556a76f5e4bb24ed1fccb79341849d8f7d917e818517fc3fe308bd
Instruction Fuzzy Hash: E72154726087019FC301CF99C480A5AF7E5FB9C720F55492EE699D7640D770E915CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF712BD, Relevance: 4.6, APIs: 3, Instructions: 67
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6DF712BD(intOrPtr __ecx) {
				void* _v8;
				void* _t22;
				signed int _t23;
				signed int _t24;
				void* _t30;
				intOrPtr _t37;
				signed int _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;

				_push(__ecx);
				_t47 =  *[fs:0x30];
				_t37 = __ecx;
				_t40 =  *(_t47 + 0x88);
				_t44 = ( *0x6e038498 & 0x0000ffff) + _t40;
				if(_t44 >= 0xfffe) {
					L4:
					return _t22;
				}
				_t23 =  *(_t47 + 0x8c);
				if(_t44 == _t23) {
					_t24 = _t23 + _t23;
					 *(_t47 + 0x8c) = _t24;
					_t22 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t24 << 2);
					_t41 = _t22;
					_v8 = _t41;
					if(_t41 == 0) {
						 *(_t47 + 0x8c) = _t44;
						goto L4;
					}
					memcpy(_t41,  *(_t47 + 0x90),  *(_t47 + 0x88) << 2);
					_t30 =  *(_t47 + 0x90);
					if(_t30 != 0x6e036660) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t30);
					}
					_t40 =  *(_t47 + 0x88);
					 *(_t47 + 0x90) = _v8;
				}
				 *((intOrPtr*)( *(_t47 + 0x90) + _t40 * 4)) = _t37;
				_t22 =  *(_t47 + 0x88) + 1;
				 *(_t47 + 0x88) = _t22;
				if( *((intOrPtr*)(_t37 + 8)) == 0xddeeddee) {
					 *(_t37 + 0x24) = _t22;
				} else {
					 *(_t37 + 0x7c) = _t22;
				}
				goto L4;
			}

0x6df712c2
0x6df712c5
0x6df712cc
0x6df712d6
0x6df712dc
0x6df712e4
0x6df71313
0x6df71319
0x6df71319
0x6df712e6
0x6df712ee
0x6df7131a
0x6df7131c
0x6df71331
0x6df71336
0x6df71338
0x6df7133d
0x6df7137d
0x00000000
0x6df7137d
0x6df71350
0x6df71355
0x6df71363
0x6dfb5512
0x6dfb5512
0x6df7136c
0x6df71372
0x6df71372
0x6df712f6
0x6df712ff
0x6df71300
0x6df7130d
0x6df71385
0x6df7130f
0x6df7130f
0x6df7130f
0x00000000

APIs

RtlAllocateHeap.9419(?,00000000,?,?,-00000001,?,?,?,6DF7127D,?,00000000,?,6DF9FC21,00000000,00000000), ref: 6DF71331
memcpy.9419(00000000,?,?,?,00000000,?,?,-00000001,?,?,?,6DF7127D,?,00000000,?,6DF9FC21), ref: 6DF71350

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapmemcpy
String ID:
API String ID: 1925790395-0
Opcode ID: 3f8e19df3d154ea23305d265a5ad8ee1f17be5fbc8e58924b425d66b16c60e40
Instruction ID: c5272c7c79e4bd49e6022bc37151084a5a348ac0cccc018cce967cd557e4d725
Opcode Fuzzy Hash: 3f8e19df3d154ea23305d265a5ad8ee1f17be5fbc8e58924b425d66b16c60e40
Instruction Fuzzy Hash: B8215B71614A409FD771CF6CE890BA6B3E9FB49350F10846EE5AAC7651DA34AC84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF6186, Relevance: 4.6, APIs: 3, Instructions: 66
nativeCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6DFF6186(struct _EXCEPTION_RECORD __ecx, void* __edi) {
				intOrPtr _v8;
				signed int _v16;
				void _v224;
				int _v228;
				intOrPtr _v232;
				char _v236;
				char _v240;
				void* __ebx;
				void* __esi;
				void* _t20;
				void* _t21;
				int _t35;
				void* _t36;
				void* _t37;
				struct _EXCEPTION_RECORD _t39;
				void* _t40;
				signed int _t43;
				signed int _t45;

				_t37 = __edi;
				_t29 = _t45;
				_push(__ecx);
				_push(__ecx);
				_v8 =  *((intOrPtr*)(_t45 + 4));
				_t43 = (_t45 & 0xffffffe0) + 4;
				_v16 =  *0x6e03d360 ^ _t43;
				_t39 = __ecx;
				_t20 = E6DFF60E9(__ecx);
				if(_t20 == 0) {
					L8:
					_t21 = 0xc0000001;
				} else {
					_push( &_v240);
					_push(0xba);
					_push( &_v236);
					_push(2);
					_push(0x6df21bc8);
					_push(_t20);
					if(E6DF89650() < 0 || _v232 != 1) {
						goto L8;
					} else {
						_t35 = _v228;
						if((_t35 & 0x00000001) != 0 || _t35 == 0 ||  *((short*)(_t43 + (_t35 >> 1) * 2 - 0xd6)) != 0 || _t35 > ( *(_t39 + 2) & 0x0000ffff)) {
							goto L8;
						} else {
							memmove( *(_t39 + 4),  &_v224, _t35);
							RtlInitUnicodeString(_t39,  *(_t39 + 4));
							_t21 = 0;
						}
					}
				}
				_pop(_t40);
				return E6DF8B640(_t21, _t29, _v16 ^ _t43, _t36, _t37, _t40);
			}

0x6dff6186
0x6dff6189
0x6dff618b
0x6dff618c
0x6dff6197
0x6dff619b
0x6dff61aa
0x6dff61ae
0x6dff61b0
0x6dff61b7
0x6dff622c
0x6dff622c
0x6dff61b9
0x6dff61bf
0x6dff61c0
0x6dff61cb
0x6dff61cc
0x6dff61ce
0x6dff61d3
0x6dff61db
0x00000000
0x6dff61e6
0x6dff61e6
0x6dff61ef
0x00000000
0x6dff620c
0x6dff6217
0x6dff6223
0x6dff6228
0x6dff6228
0x6dff61ef
0x6dff61db
0x6dff6236
0x6dff6242

APIs

Part of subcall function 6DFF60E9: ZwOpenKey.9419(?,80000000,?,?,?,6DFF61B5,?), ref: 6DFF6146
Part of subcall function 6DFF60E9: ZwClose.9419(?,?,80000000,?,?,?,6DFF61B5,?), ref: 6DFF6164
Part of subcall function 6DFF60E9: ZwClose.9419(6DFF61B5,?,80000000,?,?,?,6DFF61B5,?), ref: 6DFF6176

ZwQueryValueKey.9419(00000000,6DF21BC8,00000002,?,000000BA,?,?), ref: 6DFF61D4
memmove.9419(?,?,?,00000000,6DF21BC8,00000002,?,000000BA,?,?), ref: 6DFF6217
RtlInitUnicodeString.9419(?,?,000000BA,?,?), ref: 6DFF6223

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$InitOpenQueryStringUnicodeValuememmove
String ID:
API String ID: 1831829950-0
Opcode ID: 24d59c31813bda43257dc1f0356e3514afa4c6fcb1574bf04d2d0af18f67b42d
Instruction ID: acaf647bee75876aadf782999abbc212f733d715ff530d093b059e9d8fe0dde0
Opcode Fuzzy Hash: 24d59c31813bda43257dc1f0356e3514afa4c6fcb1574bf04d2d0af18f67b42d
Instruction Fuzzy Hash: 9611E971A04219ABFB148B6CDD42FBAB7B4EF04308F00416DFD0592191EFB2DD4186A1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFBDFA, Relevance: 4.6, APIs: 3, Instructions: 64
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6DFFBDFA(unsigned int* __ecx, signed char __edx) {
				char _v8;
				signed int _v12;
				signed char _v16;
				void* __ebx;
				void* __edi;
				signed int _t24;
				intOrPtr _t32;
				intOrPtr _t33;
				char _t35;
				intOrPtr _t37;
				intOrPtr _t38;
				unsigned int* _t39;

				_t20 = __edx;
				_t38 = 0;
				_t39 = __ecx;
				_v16 = __edx;
				if( *0x6e037bc8 == 0) {
					E6DF62280(__edx, __ecx);
					_t20 = _v16;
				}
				_t32 =  *((intOrPtr*)(_t39 + 0x54));
				_t37 =  *((intOrPtr*)(_t39 + 0x44));
				_t35 =  *((intOrPtr*)(_t39 + 0x4c));
				_v16 = _t32;
				_t33 = _t32 + _t20;
				_v8 = _t35;
				if(_t37 == 0) {
					L5:
					if(_t33 <= _t35) {
						goto L9;
					} else {
						_t24 = _t20 + 0x00000fff & 0xfffff000;
						_v12 = _t24;
						if(_t24 + _t35 <  *((intOrPtr*)(_t39 + 0x50))) {
							_push(4);
							_push(0x1000);
							_push( &_v12);
							_push(_t38);
							_push( &_v8);
							_push(0xffffffff);
							if(E6DF89660() >= 0) {
								 *((intOrPtr*)(_t39 + 0x4c)) = _v12 + _v8;
								goto L9;
							}
						}
					}
				} else {
					if(_t33 <=  *((intOrPtr*)(_t39 + 0x58))) {
						if(_t37 != 0) {
							L9:
							_t38 = _v16;
							 *((intOrPtr*)(_t39 + 0x68)) =  *((intOrPtr*)(_t39 + 0x68)) + 1;
							 *((intOrPtr*)(_t39 + 0x54)) = _t33;
						} else {
							goto L5;
						}
					}
				}
				if( *0x6e037bc8 == 0) {
					E6DF5FFB0(_t33, _t38, _t39);
				}
				return _t38;
			}

0x6dffbe05
0x6dffbe07
0x6dffbe10
0x6dffbe12
0x6dffbe15
0x6dffbe18
0x6dffbe1d
0x6dffbe1d
0x6dffbe20
0x6dffbe23
0x6dffbe26
0x6dffbe29
0x6dffbe2c
0x6dffbe2e
0x6dffbe33
0x6dffbe3e
0x6dffbe40
0x00000000
0x6dffbe42
0x6dffbe47
0x6dffbe4c
0x6dffbe54
0x6dffbe56
0x6dffbe58
0x6dffbe60
0x6dffbe61
0x6dffbe65
0x6dffbe66
0x6dffbe6f
0x6dffbe77
0x00000000
0x6dffbe77
0x6dffbe6f
0x6dffbe54
0x6dffbe35
0x6dffbe38
0x6dffbe3c
0x6dffbe7a
0x6dffbe7a
0x6dffbe7d
0x6dffbe80
0x00000000
0x00000000
0x00000000
0x6dffbe3c
0x6dffbe38
0x6dffbe8a
0x6dffbe8d
0x6dffbe8d
0x6dffbe9a

APIs

RtlAcquireSRWLockExclusive.9419(?,?,-00000001,?,00000020,?,?), ref: 6DFFBE18
ZwAllocateVirtualMemory.9419(000000FF,?,00000000,?,00001000,00000004,?,-00000001,?,00000020,?,?), ref: 6DFFBE68
RtlReleaseSRWLockExclusive.9419(?,?,-00000001,?,00000020,?,?), ref: 6DFFBE8D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAllocateMemoryReleaseVirtual
String ID:
API String ID: 1696613717-0
Opcode ID: 3d67790cb6f1c1ad249c6fb6efc7800bfe3419eb01db1332335c7b974fd9c253
Instruction ID: 4408287b674be60b4aeb3e8ff643f140f6e3d31f5d778a0b2c11cc9320e0b587
Opcode Fuzzy Hash: 3d67790cb6f1c1ad249c6fb6efc7800bfe3419eb01db1332335c7b974fd9c253
Instruction Fuzzy Hash: 8A11D075A0474AABD720CFA9C880BABBBF8EF45314F184969EA51D3340C375A9458B92

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD6715, Relevance: 4.6, APIs: 3, Instructions: 62
nativeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6DFD6715(signed short* __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v24;
				void _v548;
				void* _v572;
				char _v592;
				void _v596;
				intOrPtr _v600;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t28;
				signed int _t31;
				void* _t32;
				unsigned int _t35;
				signed short* _t41;
				void* _t43;
				int _t45;
				void* _t47;
				signed int _t48;
				signed int _t50;
				void* _t51;

				_t50 = (_t48 & 0xfffffff8) - 0x254;
				_v8 =  *0x6e03d360 ^ _t50;
				_v600 = __edx;
				_t41 = __ecx;
				memset( &_v596, 0, 0x30);
				_t35 =  *_t41 & 0x0000ffff;
				_t51 = _t50 + 0xc;
				if((_t35 & 0x0000fffe) >= 0x212) {
					_t31 = 0x109;
				} else {
					_t31 = _t35 >> 1;
				}
				_t45 = _t31 + _t31;
				memcpy( &_v548, _t41[2], _t45);
				 *((short*)(_t51 + _t45 + 0x4c)) = 0;
				_v592 = 0;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v596 = 0x32 + _t31 * 2;
				_push( &_v596);
				_push(_v600);
				_t28 = E6DF89AE0();
				_pop(_t43);
				_t47 = 0x100;
				_t32 = 0x30;
				return E6DF8B640(_t28, _t32, _v24 ^ _t51 + 0x0000000c, 0x212, _t43, _t47);
			}

0x6dfd671d
0x6dfd672a
0x6dfd673a
0x6dfd6741
0x6dfd6743
0x6dfd6748
0x6dfd6752
0x6dfd675d
0x6dfd6765
0x6dfd675f
0x6dfd6761
0x6dfd6761
0x6dfd676a
0x6dfd6776
0x6dfd6781
0x6dfd6789
0x6dfd6799
0x6dfd679a
0x6dfd679b
0x6dfd679c
0x6dfd679d
0x6dfd67a6
0x6dfd67ae
0x6dfd67b2
0x6dfd67be
0x6dfd67bf
0x6dfd67c0
0x6dfd67cb

APIs

memset.9419(?,00000000,00000030,00000000,00000000,00000000), ref: 6DFD6743
memcpy.9419(?,?,00000000,00000000,00000000,00000000), ref: 6DFD6776
ZwTraceEvent.9419(?,00000100,00000030,?,?,?,?,00000000,00000000,00000000), ref: 6DFD67B2

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: EventTracememcpymemset
String ID:
API String ID: 2169877366-0
Opcode ID: e8d6f598e82341ddea826411200d3512b1d287f00f1b000e1789a7b42d82637e
Instruction ID: 08e91ec73db63d0fa1f3af2178e54781a03dc7e3f4273c76a93c0ed3fd57380c
Opcode Fuzzy Hash: e8d6f598e82341ddea826411200d3512b1d287f00f1b000e1789a7b42d82637e
Instruction Fuzzy Hash: 051127321087455BD721DF58DC81A9BB7A8EFC5710F00093AFA848B291D774DA19C7D3

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFBE9B, Relevance: 4.6, APIs: 3, Instructions: 60
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6DFFBE9B(unsigned int* __ecx) {
				char _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				signed char _t20;
				void* _t21;
				intOrPtr _t31;
				char _t33;
				intOrPtr _t34;
				intOrPtr _t36;
				unsigned int* _t37;

				_t36 = 0;
				_t37 = __ecx;
				if( *0x6e037bc8 == 0) {
					E6DF62280(_t20, __ecx);
				}
				_t31 =  *((intOrPtr*)(_t37 + 0x58));
				_t34 =  *((intOrPtr*)(_t37 + 0x44));
				_t33 =  *((intOrPtr*)(_t37 + 0x50));
				_v8 = _t33;
				_t21 = _t31 - 4;
				if(_t34 == 0) {
					L5:
					if(_t21 >= _t33) {
						goto L9;
					} else {
						_v12 = 0x1000;
						if(_t33 - 0x1000 >  *((intOrPtr*)(_t37 + 0x4c))) {
							_push(4);
							_push(0x1000);
							_v8 = _t33 - 0x1000;
							_push( &_v12);
							_push(_t36);
							_push( &_v8);
							_push(0xffffffff);
							if(E6DF89660() >= 0) {
								 *((intOrPtr*)(_t37 + 0x50)) = _v8;
								goto L9;
							}
						}
					}
				} else {
					if(_t21 >=  *((intOrPtr*)(_t37 + 0x54))) {
						if(_t34 != 0) {
							L9:
							 *((intOrPtr*)(_t37 + 0x60)) =  *((intOrPtr*)(_t37 + 0x60)) + 1;
							_t36 = _t31 - 4;
							 *((intOrPtr*)(_t37 + 0x58)) = _t36;
						} else {
							goto L5;
						}
					}
				}
				if( *0x6e037bc8 == 0) {
					E6DF5FFB0(_t31, _t36, _t37);
				}
				return _t36;
			}

0x6dffbea6
0x6dffbea8
0x6dffbeb1
0x6dffbeb4
0x6dffbeb4
0x6dffbeb9
0x6dffbebc
0x6dffbebf
0x6dffbec2
0x6dffbec5
0x6dffbeca
0x6dffbed5
0x6dffbed7
0x00000000
0x6dffbed9
0x6dffbee4
0x6dffbeea
0x6dffbeec
0x6dffbef4
0x6dffbef5
0x6dffbefb
0x6dffbefc
0x6dffbf00
0x6dffbf01
0x6dffbf0a
0x6dffbf0f
0x00000000
0x6dffbf0f
0x6dffbf0a
0x6dffbeea
0x6dffbecc
0x6dffbecf
0x6dffbed3
0x6dffbf12
0x6dffbf12
0x6dffbf15
0x6dffbf18
0x00000000
0x00000000
0x00000000
0x6dffbed3
0x6dffbecf
0x6dffbf22
0x6dffbf25
0x6dffbf25
0x6dffbf32

APIs

RtlAcquireSRWLockExclusive.9419(?,00000000,00000000,?,C0000001,?,?,6E036D80,00000000,00000000,?,?,?,6DF7932C,6E020158,00000018), ref: 6DFFBEB4
ZwAllocateVirtualMemory.9419(000000FF,?,00000000,?,00001000,00000004,00000000,00000000,?,C0000001,?,?,6E036D80,00000000,00000000), ref: 6DFFBF03
RtlReleaseSRWLockExclusive.9419(?,00000000,00000000,?,C0000001,?,?,6E036D80,00000000,00000000,?,?,?,6DF7932C,6E020158,00000018), ref: 6DFFBF25

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAllocateMemoryReleaseVirtual
String ID:
API String ID: 1696613717-0
Opcode ID: eee1df028d4a1e18e580cd1e5c85046e70e682e5a7ade0ac7ae447809b86f4e1
Instruction ID: 327ea83582054e0a97a78634e8195e6945a758d98955fd42426a097aed42eb62
Opcode Fuzzy Hash: eee1df028d4a1e18e580cd1e5c85046e70e682e5a7ade0ac7ae447809b86f4e1
Instruction Fuzzy Hash: D111C875904789AFD711CB99C480A9BFBFCFF45354F100869DA41C3650D371AA498B91

Uniqueness

Uniqueness Score: -1.00%

Function 6DFC46A7, Relevance: 4.6, APIs: 3, Instructions: 59
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DFC46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				void* _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t36;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_t36 =  *( *[fs:0x30] + 0x18);
				_v8 = __ecx;
				_v16 = _t36;
				_t38 = RtlAllocateHeap(_t36, 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					memcpy(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E6DF7D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					RtlFreeHeap(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x6dfc46b7
0x6dfc46ba
0x6dfc46bc
0x6dfc46c5
0x6dfc46c8
0x6dfc46d0
0x6dfc46d4
0x6dfc46e6
0x6dfc46e9
0x6dfc46f4
0x6dfc46ff
0x6dfc4705
0x6dfc4706
0x6dfc470c
0x6dfc4713
0x6dfc471b
0x6dfc4723
0x6dfc4725
0x6dfc46d6
0x6dfc46d9
0x6dfc46db
0x6dfc46db
0x6dfc4732

APIs

RtlAllocateHeap.9419(?,00000000,00000030,?,00000000,?,6DFAF5F2,?,00000024,00000000,?), ref: 6DFC46CB
memcpy.9419(00000000,00000000,00000000,00000024,?,00000000,00000030,?,00000000,?,6DFAF5F2,?,00000024,00000000,?), ref: 6DFC46F4
RtlFreeHeap.9419(?,00000000,00000000,00000030,?,00000000,?,6DFAF5F2,?,00000024,00000000,?), ref: 6DFC4725

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreememcpy
String ID:
API String ID: 4030768257-0
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 3ce80929134ebed0665dc6f2d7b333a66e3b1faad4ebbc5181d68c6b526f62f7
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: FF11C272908248BBC7159F5CA8808BEBBB9EF99304F1080AAFA4487351DA319D55D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4A63B, Relevance: 4.6, APIs: 3, Instructions: 59
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF4A63B(intOrPtr __ecx) {
				signed short _t14;
				signed short _t15;
				void* _t23;
				signed int _t24;
				intOrPtr _t27;
				void* _t31;
				signed short _t33;
				void* _t38;

				_t27 = __ecx;
				_t33 =  *0x6e038498;
				 *((short*)(((0 |  *((intOrPtr*)(__ecx + 8)) == 0xddeeddee) - 0x00000001 & 0x00000058) + __ecx + 0x24)) = 0xffff;
				_t38 = _t33 -  *0x6e035cb0; // 0x4
				if(_t38 == 0) {
					_t14 =  *0x6e035cb0; // 0x4
					_t15 = _t14 + _t14;
					 *0x6e035cb0 = _t15;
					_t31 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, (_t15 & 0x0000ffff) << 2);
					if(_t31 != 0) {
						_t33 =  *0x6e038498;
						memcpy(_t31,  *0x6e0356f4, (_t33 & 0x0000ffff) << 2);
						_t23 =  *0x6e0356f4; // 0x6e036640
						if(_t23 != 0x6e036640) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t23);
							_t33 =  *0x6e038498;
						}
						 *0x6e0356f4 = _t31;
						L2:
						_t24 = _t33 & 0x0000ffff;
						 *0x6e038498 = _t33 + 1;
						 *((intOrPtr*)(_t31 + _t24 * 4)) = _t27;
						L3:
						return _t24;
					}
					_t24 =  *0x6e038498;
					 *0x6e035cb0 = _t24;
					goto L3;
				}
				_t31 =  *0x6e0356f4; // 0x6e036640
				goto L2;
			}

0x6df4a63e
0x6df4a643
0x6df4a65e
0x6df4a663
0x6df4a66a
0x6dfa42f5
0x6dfa42fa
0x6dfa42fc
0x6dfa4319
0x6dfa431d
0x6dfa4330
0x6dfa4345
0x6dfa434d
0x6dfa4357
0x6dfa4365
0x6dfa436a
0x6dfa436a
0x6dfa4371
0x6df4a676
0x6df4a676
0x6df4a67b
0x6df4a682
0x6df4a685
0x6df4a688
0x6df4a688
0x6dfa431f
0x6dfa4325
0x00000000
0x6dfa4325
0x6df4a670
0x00000000

APIs

RtlAllocateHeap.9419(?,00000000,?,?,-00000001,?,6DF712AD,?,00000000,?,6DF9FC21,00000000,00000000), ref: 6DFA4314

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 84ea8c69c50930c123042a39b5b0475c06ac01af69abc383109f1da056b2ca2e
Instruction ID: 233b2b06605c1be113d263cc9084546eaee590758abdef2f861ea2f17687ceb0
Opcode Fuzzy Hash: 84ea8c69c50930c123042a39b5b0475c06ac01af69abc383109f1da056b2ca2e
Instruction Fuzzy Hash: 5611E33F528983DFCB368F5CD941A2233B5FB4AB58B650024E608DBAA1DB358C41C330

Uniqueness

Uniqueness Score: -1.00%

Function 6DF528FD, Relevance: 4.6, APIs: 3, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF528FD(void* __edx, signed int _a4) {
				void* __ecx;
				void* _t8;
				char* _t13;
				signed char* _t17;
				void* _t21;
				void* _t22;
				void* _t28;

				_t28 = __edx;
				_t8 = E6DF5EB70(_t22, 0x6e035350);
				_t23 = _a4;
				_t21 = _t8;
				if( !_a4 >= 0) {
					E6DF4B1E1(_t23, 0x14a2, _t28, 0);
				}
				if(E6DF67D50() != 0) {
					_t13 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(E6DF67D50() == 0) {
							_t17 = 0x7ffe0385;
						} else {
							_t17 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t17 & 0x00000020) != 0) {
							L6DFC7016(0x14a2, 0, 0, _t28, 0, 0);
						}
					}
				}
				return _t21;
			}

0x6df5290b
0x6df5290d
0x6df52912
0x6df52915
0x6df5291d
0x6dfa7758
0x6dfa7758
0x6df5292a
0x6dfa776b
0x6df52930
0x6df52930
0x6df52930
0x6df52938
0x6dfa7782
0x6dfa778f
0x6dfa77a1
0x6dfa7791
0x6dfa779a
0x6dfa779a
0x6dfa77a9
0x6dfa77bd
0x6dfa77bd
0x6dfa77a9
0x6dfa7782
0x6df52945

APIs

RtlLeaveCriticalSection.9419(6E035350,00000000,?,6E0384D8,?,?,6DF50936,00000000,?,6E0384D8,?,6E0384D8,?,00000000,?,?), ref: 6DF5290D
RtlGetCurrentServiceSessionId.9419(6E035350,00000000,?,6E0384D8,?,?,6DF50936,00000000,?,6E0384D8,?,6E0384D8,?,00000000,?,?), ref: 6DF52923
RtlGetCurrentServiceSessionId.9419 ref: 6DFA7788

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalLeaveSection
String ID:
API String ID: 3230880662-0
Opcode ID: 2bc3139b1299da69cd0cd5ee8e4b7729b4e3b4c8c29eac90694f1fe99f23fbd0
Instruction ID: 968221a5ef7222a65f05a8092281cd4b7a61f5c3d8c32893dffa730e4892941b
Opcode Fuzzy Hash: 2bc3139b1299da69cd0cd5ee8e4b7729b4e3b4c8c29eac90694f1fe99f23fbd0
Instruction Fuzzy Hash: 8A114E36B58680EBF322836DDD44F2677A8EF92758F194065B9008B7D1DB95DC10C221

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD16FA, Relevance: 4.6, APIs: 3, Instructions: 58nativeCOMMON

Download Yara Rule

APIs

ZwQueryWnfStateNameInformation.9419(6DF2FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6DFD15A3,?,00000568), ref: 6DFD1718
ZwUpdateWnfStateData.9419(6DF2FB74,00000000,00000000,00000000,00000000,00000000,00000000,6DF2FB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6DFD172D
EtwEventWriteNoRegistration.9419(6DF2FB7C,?,00000000,00000000,6DF2FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6DFD174B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: State$DataEventInformationNameQueryRegistrationUpdateWrite
String ID:
API String ID: 4159075219-0
Opcode ID: 79f83d882a291e17d6236c7828abe0f5fba0fde689dfeaff9c2f6140d213093c
Instruction ID: dbaa838f0c8a0fa4a8386e5e0b9dce2f9a8e036579e334ceefe7e2f0cdd41b6a
Opcode Fuzzy Hash: 79f83d882a291e17d6236c7828abe0f5fba0fde689dfeaff9c2f6140d213093c
Instruction Fuzzy Hash: 20F0467360020E7BF300A8FE9CC1FBBB6ACDB49258F050539FB00D60A1F620CC0501A2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF837F5, Relevance: 4.6, APIs: 3, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DF837F5(void* __ecx, long __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				void _t13;
				void* _t20;
				long _t27;
				void* _t28;
				void* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E6DF62280(_t6, 0x6e038550);
				}
				_t29 = E6DF8387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E6DF5FFB0(0x6e038550, _t27, 0x6e038550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *(_t13 + 4) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *(_t29 + 4);
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *(_t13 + 4) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x6df837fa
0x6df837fc
0x6df83805
0x6df83808
0x6df83808
0x6df83814
0x6df83818
0x6df83846
0x6df83848
0x6df8384b
0x6df8384b
0x6df83852
0x00000000
0x6df83854
0x6df83856
0x00000000
0x00000000
0x6df83863
0x00000000
0x6df83863
0x6df8381a
0x6df8381a
0x6df8381f
0x6df8386e
0x6df8386e
0x6df83871
0x6df83873
0x6df83873
0x6df83868
0x00000000
0x6df83868
0x6df83821
0x6df83826
0x00000000
0x00000000
0x6df83828
0x6df8382a
0x6df83841
0x00000000
0x6df83841

APIs

RtlAcquireSRWLockExclusive.9419(6E038550,?,?,?,6DF5ED20,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001), ref: 6DF83808
RtlReleaseSRWLockExclusive.9419(6E038550,?,?,?,6DF5ED20,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001), ref: 6DF8384B
RtlFreeHeap.9419(?,00000000,00000000,?,?,?,6DF5ED20,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?), ref: 6DF83863

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease
String ID:
API String ID: 3645524765-0
Opcode ID: 5a808cde776a721f2c46f081c0586f3ea3ecc22935a12a31a24866e191fc7add
Instruction ID: 3dd54933ca989763e0fab020b1250f718847d3197c45b599ff011b46c5b033e5
Opcode Fuzzy Hash: 5a808cde776a721f2c46f081c0586f3ea3ecc22935a12a31a24866e191fc7add
Instruction Fuzzy Hash: 70012673949A629BC3278B9DD900E267BF6DF82B50716C069E905CB222D730DC00C791

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1879, Relevance: 4.6, APIs: 3, Instructions: 56
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DFD1879(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t25;
				void* _t35;
				intOrPtr _t39;
				void* _t40;

				_push(0x1c);
				_push(0x6e020810);
				E6DF9D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t40 - 0x2c)) = __ecx;
				 *(_t40 - 0x20) = 0xc;
				 *(_t40 - 0x1c) =  *(_t40 - 0x1c) & 0x00000000;
				if( *(_t40 + 0x28) != 0) {
					 *(_t40 - 4) =  *(_t40 - 4) & 0x00000000;
					_push(4);
					_push(0x1000);
					_push(_t40 - 0x20);
					_push(0);
					_push(_t40 - 0x1c);
					_push(0xffffffff);
					_t39 = E6DF89660();
					 *((intOrPtr*)(_t40 - 0x28)) = _t39;
					 *(_t40 - 4) = 0xfffffffe;
					if(_t39 < 0) {
						L8:
						_t34 =  *(_t40 - 0x1c);
						if( *(_t40 - 0x1c) != 0) {
							E6DFD1AD6(_t34);
						}
					} else {
						_t35 =  *(_t40 - 0x1c);
						if(_t35 == 0) {
							L7:
							if(_t39 < 0) {
								goto L8;
							}
						} else {
							memset(_t35, 0,  *(_t40 - 0x20));
							_t39 = E6DF52CD0( *(_t40 - 0x1c),  *((intOrPtr*)(_t40 - 0x2c)), 1);
							if(_t39 < 0) {
								goto L8;
							} else {
								 *((intOrPtr*)( *(_t40 - 0x1c) + 8)) = 0x12;
								 *( *(_t40 + 0x28)) =  *(_t40 - 0x1c);
								_t39 = 0;
								goto L7;
							}
						}
					}
					_t25 = _t39;
				} else {
					_t25 = 0xc000000d;
				}
				return E6DF9D0D1(_t25);
			}

0x6dfd1879
0x6dfd187b
0x6dfd1880
0x6dfd1885
0x6dfd1888
0x6dfd188f
0x6dfd1897
0x6dfd18a3
0x6dfd18a7
0x6dfd18a9
0x6dfd18b1
0x6dfd18b2
0x6dfd18b7
0x6dfd18b8
0x6dfd18bf
0x6dfd18d7
0x6dfd18da
0x6dfd18e3
0x6dfd1925
0x6dfd1925
0x6dfd192a
0x6dfd192c
0x6dfd192c
0x6dfd18e5
0x6dfd18e5
0x6dfd18ea
0x6dfd1921
0x6dfd1923
0x00000000
0x00000000
0x6dfd18ec
0x6dfd18f2
0x6dfd1907
0x6dfd190b
0x00000000
0x6dfd190d
0x6dfd1910
0x6dfd191d
0x6dfd191f
0x00000000
0x6dfd191f
0x6dfd190b
0x6dfd18ea
0x6dfd1931
0x6dfd1899
0x6dfd1899
0x6dfd1899
0x6dfd1938

APIs

ZwAllocateVirtualMemory.9419(000000FF,00000000,00000000,0000000C,00001000,00000004,6E020810,0000001C,6DFD1616), ref: 6DFD18BA
memset.9419(00000000,00000000,0000000C,000000FF,00000000,00000000,0000000C,00001000,00000004,6E020810,0000001C,6DFD1616), ref: 6DFD18F2
RtlInitializeSid.9419(00000000,?,00000001,6E020810,0000001C,6DFD1616), ref: 6DFD1902

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateInitializeMemoryVirtualmemset
String ID:
API String ID: 1463077056-0
Opcode ID: 435eb446126f5ce8e45cb997974f595d8f24247ccb1ceaa222239c5b5b9cc45a
Instruction ID: c25133b61acbae4ecf90bb4f8f6c7e90dc9ec94bc2ba4cab70113b91b40dd318
Opcode Fuzzy Hash: 435eb446126f5ce8e45cb997974f595d8f24247ccb1ceaa222239c5b5b9cc45a
Instruction Fuzzy Hash: 97115471D0521D9BEF51CF98C840FEEB670BF08728F198219EA117B2D0C7748C418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF43E80, Relevance: 4.6, APIs: 3, Instructions: 55
nativeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6DF43E80(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t14;
				void* _t15;
				signed char* _t18;
				intOrPtr _t26;
				void* _t30;
				intOrPtr _t31;
				signed char* _t32;
				signed int _t34;

				_v12 =  *0x6e03d360 ^ _t34;
				_t14 =  *[fs:0x18];
				_t26 = _a4;
				_t31 =  *((intOrPtr*)(_t14 + 0xf60));
				 *((intOrPtr*)(_t14 + 0xf60)) = _t26;
				_t15 = E6DF67D50();
				_t32 = 0x7ffe0390;
				if(_t15 != 0) {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x236;
				} else {
					_t18 = 0x7ffe0390;
				}
				if( *_t18 != 0) {
					if(_t26 == _t31) {
						goto L3;
					}
					_v24 = _t31;
					_v50 = 0x545;
					_v20 = _t26;
					if(E6DF67D50() != 0) {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x236;
					}
					_push( &_v56);
					_push(8);
					_push(0x402);
					_push( *_t32 & 0x000000ff);
					E6DF89AE0();
					goto L3;
				} else {
					L3:
					return E6DF8B640(_t31, _t26, _v12 ^ _t34, _t30, _t31, _t32);
				}
			}

0x6df43e8f
0x6df43e92
0x6df43e99
0x6df43e9e
0x6df43ea4
0x6df43eaa
0x6df43eaf
0x6df43eb6
0x6dfa0224
0x6df43ebc
0x6df43ebc
0x6df43ebc
0x6df43ec1
0x6dfa0230
0x00000000
0x00000000
0x6dfa023b
0x6dfa023e
0x6dfa0242
0x6dfa024c
0x6dfa0257
0x6dfa0257
0x6dfa0263
0x6dfa0264
0x6dfa0266
0x6dfa026b
0x6dfa026c
0x00000000
0x6df43ec7
0x6df43ec7
0x6df43ed9
0x6df43ed9

APIs

RtlGetCurrentServiceSessionId.9419(00000000,?,?), ref: 6DF43EAA
RtlGetCurrentServiceSessionId.9419(00000000,?,?), ref: 6DFA0245
ZwTraceEvent.9419(?,00000402,00000008,?,00000000,?,?), ref: 6DFA026C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: b8356526cba9da6fc10fb99d5675fcf58c2998ef5d8a6ec85b73065d59b94f44
Instruction ID: 16b15b16f812c454376ce40d2c9d37f642d87ce81adb85c5b6c7255c04f78fe6
Opcode Fuzzy Hash: b8356526cba9da6fc10fb99d5675fcf58c2998ef5d8a6ec85b73065d59b94f44
Instruction Fuzzy Hash: F7110272A016489FD721CFADC884BAEBBF8FF45300F0544A6E9059B652DB34DD04C750

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF60E9, Relevance: 4.6, APIs: 3, Instructions: 54nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6DF4F108: RtlOpenCurrentUser.9419(02000000,00000000,?,00000000,02000000,?,6DFFCFA7,?,?,?), ref: 6DF4F12C

ZwOpenKey.9419(?,80000000,?,?,?,6DFF61B5,?), ref: 6DFF6146

Part of subcall function 6DF89600: LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

ZwClose.9419(?,?,80000000,?,?,?,6DFF61B5,?), ref: 6DFF6164
ZwClose.9419(6DFF61B5,?,80000000,?,?,?,6DFF61B5,?), ref: 6DFF6176

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen$CurrentInitializeThunkUser
String ID:
API String ID: 1635656305-0
Opcode ID: d8b8869ce113b2de9058bfd13b40e888fd05bfc7897ef67bb0000fec09593a97
Instruction ID: d9c9722970bbd0cd8b5f58c7b01da26d9727776a608ba2281b70cd2c6e344e62
Opcode Fuzzy Hash: d8b8869ce113b2de9058bfd13b40e888fd05bfc7897ef67bb0000fec09593a97
Instruction Fuzzy Hash: 7411217090411EAFEF00DFA9C940AAFBBB8EF49714F104169E914E2251DB758A41CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6E0014FB, Relevance: 4.5, APIs: 3, Instructions: 48
nativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6E0014FB(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				void _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				void* _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_v8 =  *0x6e03d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				memset( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E6DF67D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				return E6DF8B640(E6DF89AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34,  *_t21 & 0x000000ff);
			}

0x6e0014fb
0x6e00150a
0x6e001514
0x6e001519
0x6e00151b
0x6e001526
0x6e00152c
0x6e001534
0x6e001537
0x6e00153a
0x6e001545
0x6e001557
0x6e001547
0x6e001550
0x6e001550
0x6e001562
0x6e001563
0x6e001565
0x6e00157f

APIs

memset.9419(?,00000000,00000030,-00010018), ref: 6E00151B
RtlGetCurrentServiceSessionId.9419(?,-00010018), ref: 6E00153E
ZwTraceEvent.9419(?,00020402,00000010,?,?,-00010018), ref: 6E00156B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTracememset
String ID:
API String ID: 4204234202-0
Opcode ID: b8c58cd779511f2a8bb8e2797619ba855fab995c5d5b358d15f3e02e475dbdfb
Instruction ID: a0d07c1b6a072885c2c4d0c1beeff8f3268cba6dd1ec5b2dd8fba02b6d1b601b
Opcode Fuzzy Hash: b8c58cd779511f2a8bb8e2797619ba855fab995c5d5b358d15f3e02e475dbdfb
Instruction Fuzzy Hash: 85018C71A00248AFDB00DFADC841EAEBBB8EF45714F404066FA15EB281DA74DE04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6DF470C0, Relevance: 4.5, APIs: 3, Instructions: 48
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6DF470C0(signed int* __ecx) {
				char _t27;
				void* _t34;
				signed int _t38;
				signed int* _t40;

				_t40 = __ecx;
				if(__ecx == 0) {
					return _t27;
				}
				_t38 = 0;
				if( *((intOrPtr*)(__ecx + 4)) <= 0) {
					L6:
					if(( *_t40 & 0x00000001) != 0) {
						_t25 =  &(_t40[2]); // 0x0
						_t27 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *_t25);
					}
					_t40[2] = _t40[2] & 0x00000000;
					_t40[1] = _t40[1] & 0x00000000;
					 *_t40 =  *_t40 & 0x00000000;
					return _t27;
				}
				do {
					_t2 =  &(_t40[2]); // 0x0
					_t27 =  *_t2;
					_t34 =  *(_t27 + _t38 * 4);
					if(_t34 != 0) {
						 *(_t34 + 8) =  *(_t34 + 8) & 0;
						 *((intOrPtr*)(_t34 + 4)) = 0;
						if( *(_t34 + 0xc) != 0) {
							_push( *(_t34 + 0xc));
							E6DF895D0();
							 *(_t34 + 0xc) =  *(_t34 + 0xc) & 0x00000000;
						}
						_t19 =  &(_t40[2]); // 0x0
						 *( *_t19 + _t38 * 4) =  *( *_t19 + _t38 * 4) & 0x00000000;
						_t27 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t34);
					}
					_t38 = _t38 + 1;
					_t5 =  &(_t40[1]); // 0xd8964f0
				} while (_t38 <  *_t5);
				goto L6;
			}

0x6df470c3
0x6df470c7
0x6df470f9
0x6df470f9
0x6df470ca
0x6df470cf
0x6df470e3
0x6df470e7
0x6dfa22d2
0x6dfa22e0
0x6dfa22e0
0x6df470ed
0x6df470f1
0x6df470f5
0x00000000
0x6df470f5
0x6df470d2
0x6df470d2
0x6df470d2
0x6df470d5
0x6df470da
0x6df470fc
0x6df470ff
0x6df47105
0x6df47107
0x6df4710a
0x6df4710f
0x6df4710f
0x6df47113
0x6df47119
0x6df47126
0x6df47126
0x6df470dc
0x6df470dd
0x6df470dd
0x00000000

APIs

ZwClose.9419(?,7FFFFFFF,6DF917F0,?,6DF47096,7FFFFFFF,?,?,?,?,6DFD430E,?,6E0208D0,00000008,6DF79B80,?), ref: 6DF4710A
RtlFreeHeap.9419(?,00000000,7FFFFFFF,7FFFFFFF,6DF917F0,?,6DF47096,7FFFFFFF,?,?,?,?,6DFD430E,?,6E0208D0,00000008), ref: 6DF47126

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFreeHeap
String ID:
API String ID: 1266433183-0
Opcode ID: 06d75836c9573aa0e55f1f59fba811012c8e74f5e68e5d7ca759bd447d74ee88
Instruction ID: ae14a7eff05a1ead233d41bdcf6b58e23cd51fd4ec100ae84af6489d4dbe9fd3
Opcode Fuzzy Hash: 06d75836c9573aa0e55f1f59fba811012c8e74f5e68e5d7ca759bd447d74ee88
Instruction Fuzzy Hash: FF118E32955B42DFD3218E1DC880B22BBE1FB50722F19C868D5994B952D778E880CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E00138A, Relevance: 4.5, APIs: 3, Instructions: 48
nativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6E00138A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				void _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				void* _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_v8 =  *0x6e03d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				memset( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E6DF67D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				return E6DF8B640(E6DF89AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34,  *_t21 & 0x000000ff);
			}

0x6e00138a
0x6e001399
0x6e0013a3
0x6e0013a8
0x6e0013aa
0x6e0013b5
0x6e0013bb
0x6e0013c3
0x6e0013c6
0x6e0013c9
0x6e0013d4
0x6e0013e6
0x6e0013d6
0x6e0013df
0x6e0013df
0x6e0013f1
0x6e0013f2
0x6e0013f4
0x6e00140e

APIs

memset.9419(?,00000000,00000030,7FFE0380,?,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6E0013AA
RtlGetCurrentServiceSessionId.9419(?,7FFE0380,?,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6E0013CD
ZwTraceEvent.9419(?,00020402,00000010,?,?,7FFE0380,?,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6E0013FA

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTracememset
String ID:
API String ID: 4204234202-0
Opcode ID: 72974d62e188e0700c25c65cc4c93a9df23193e636cbca30c8c03650a4202fcd
Instruction ID: 3125d4d43441bd8e62a025d446c071f1005a54f6c3eccff622e68267e5d9c8a6
Opcode Fuzzy Hash: 72974d62e188e0700c25c65cc4c93a9df23193e636cbca30c8c03650a4202fcd
Instruction Fuzzy Hash: 63019E71A04208AFDB00DFA9C882FAEBBB8EF44714F004066F900EB281DB74DE04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF42BC2, Relevance: 4.5, APIs: 3, Instructions: 48
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6DF42BC2(intOrPtr* __ecx, void* __edx) {
				char _v8;
				void* _t12;
				void* _t22;

				_push(__ecx);
				 *__ecx = 0;
				if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) != 0) {
					_push(__ecx);
					_push(1);
					_push(4 + (0 | __edx != 0x00000000) * 2);
					_push(0xfffffffe);
					_t12 = E6DF89740();
					if(_t12 < 0) {
						L2:
						return _t12;
					}
					_push(4);
					_v8 = 0;
					_push( &_v8);
					_push(5);
					_push(0xfffffffe);
					_t22 = E6DF895B0();
					if(_t22 >= 0) {
						_t12 = 0;
					} else {
						_push( *__ecx);
						E6DF895D0();
						 *__ecx = 0;
						_t12 = _t22;
					}
					goto L2;
				}
				_t12 = 0;
				goto L2;
			}

0x6df42bc7
0x6df42bd4
0x6df42bdc
0x6df9f909
0x6df9f90d
0x6df9f916
0x6df9f917
0x6df9f919
0x6df9f920
0x6df42be4
0x6df42be9
0x6df42be9
0x6df9f927
0x6df9f92c
0x6df9f92f
0x6df9f930
0x6df9f932
0x6df9f939
0x6df9f93d
0x6df9f94c
0x6df9f93f
0x6df9f93f
0x6df9f941
0x6df9f946
0x6df9f948
0x6df9f948
0x00000000
0x6df9f94e
0x6df42be2
0x00000000

APIs

ZwOpenThreadToken.9419(000000FE,00000000,00000001,00000000,00000000,?,00000000,?,6DF42293), ref: 6DF9F919
ZwSetInformationThread.9419(000000FE,00000005,?,00000004,?,000000FE,00000000,00000001,00000000,00000000,?,00000000,?,6DF42293), ref: 6DF9F934
ZwClose.9419(00000000,000000FE,00000005,?,00000004,?,000000FE,00000000,00000001,00000000,00000000,?,00000000,?,6DF42293), ref: 6DF9F941

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CloseInformationOpenToken
String ID:
API String ID: 2125750564-0
Opcode ID: 8149fc37f5361f3ddda0cc1258df4859c8b48f732f3bc0479c981f32c362c90f
Instruction ID: 17a9c0271cedf1c42a7ec252ebc26236acc7e0549c0fffa3aee8d5e4aa426555
Opcode Fuzzy Hash: 8149fc37f5361f3ddda0cc1258df4859c8b48f732f3bc0479c981f32c362c90f
Instruction Fuzzy Hash: C201F472648219BFE3118F7D9C40E6776F9EBC1364F214139B658CA181EE71CC00C791

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFFE3F, Relevance: 4.5, APIs: 3, Instructions: 46
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6DFFFE3F(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				void _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				void* _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x6e03d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				memset( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E6DF67D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				return E6DF8B640(E6DF89AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31,  *_t18 & 0x000000ff);
			}

0x6dfffe3f
0x6dfffe4e
0x6dfffe58
0x6dfffe5d
0x6dfffe5f
0x6dfffe6a
0x6dfffe72
0x6dfffe75
0x6dfffe78
0x6dfffe83
0x6dfffe95
0x6dfffe85
0x6dfffe8e
0x6dfffe8e
0x6dfffea0
0x6dfffea1
0x6dfffea3
0x6dfffebd

APIs

memset.9419(?,00000000,00000030,?,?,?,?,?,?,?,?,?,?,?,6E0110FA,00000000), ref: 6DFFFE5F
RtlGetCurrentServiceSessionId.9419(?,?,?,?,?,?,?,?,?,?,?,?,6E0110FA,00000000,00008000,00000000), ref: 6DFFFE7C
ZwTraceEvent.9419(?,00020402,00000010,?,?,?,?), ref: 6DFFFEA9

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTracememset
String ID:
API String ID: 4204234202-0
Opcode ID: 7eeff52792ade41eda3778ca43601dfa0e2d5786ca84291e8fc71e46823f6765
Instruction ID: 33910b86c8877a6e76c15152306b8bb36fbc063f9cf6b54880eaa09d4aa22c2c
Opcode Fuzzy Hash: 7eeff52792ade41eda3778ca43601dfa0e2d5786ca84291e8fc71e46823f6765
Instruction Fuzzy Hash: A9018471E04248AFDB14DFADD845FAEB7B8EF44714F014066FA00AB291DA74DD01C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7174B, Relevance: 4.5, APIs: 3, Instructions: 35
nativeCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E6DF7174B(intOrPtr* __edx, intOrPtr* _a4, intOrPtr _a8) {
				void* _t8;
				intOrPtr* _t10;
				intOrPtr* _t11;

				_push(_a8);
				_t10 = _a4;
				_t11 = __edx;
				_push(_t10);
				_push(__edx);
				_push(0xffffffff);
				_t8 = E6DF896E0();
				if(_t8 == 0xc0000045) {
					if(E6DFF3C60( *_t11,  *_t10) == 0) {
						goto L1;
					}
					_push(_a8);
					_push(_t10);
					_push(_t11);
					_push(0xffffffff);
					return E6DF896E0();
				}
				L1:
				return _t8;
			}

0x6df71754
0x6df71757
0x6df7175a
0x6df7175c
0x6df7175d
0x6df7175e
0x6df71765
0x6df7176d
0x6dfb562d
0x00000000
0x00000000
0x6dfb5633
0x6dfb5636
0x6dfb5637
0x6dfb5638
0x00000000
0x6dfb563a
0x6df71773
0x00000000

APIs

ZwFreeVirtualMemory.9419(000000FF,00000000,?,?,00000000,?,00000000,00000001,?,6E004827,00000000,00008000,?), ref: 6DF71760
RtlFlushSecureMemoryCache.9419(00000000,?,000000FF,00000000,?,?,00000000,?,00000000,00000001,?,6E004827,00000000,00008000,?), ref: 6DFB5626
ZwFreeVirtualMemory.9419(000000FF,00000000,?,?,00000000,?,000000FF,00000000,?,?,00000000,?,00000000,00000001,?,6E004827), ref: 6DFB563A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FreeVirtual$CacheFlushSecure
String ID:
API String ID: 1071305192-0
Opcode ID: f0014fd22a3ccdcef066bb8511370c6efaaa91dcfe2efb6e0748b705229a7119
Instruction ID: 7580a82ccd2699b2978b7c01ad2f1aed4e6f0230ff1a3eead685e2e3eef091d4
Opcode Fuzzy Hash: f0014fd22a3ccdcef066bb8511370c6efaaa91dcfe2efb6e0748b705229a7119
Instruction Fuzzy Hash: 38E0653210C1647E9B211E5EAC48CAB7F6AEBD63B4B214316FA7816191D6325C15C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6746D, Relevance: 4.5, APIs: 3, Instructions: 31
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6DF6746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E6DF5EB70(__ecx, 0x6e0379a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E6DF895D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t21 - 0x50));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x6df6746d
0x6df6746d
0x6df6746d
0x6df67471
0x6df67488
0x6dfaf92d
0x6df6748e
0x6df67491
0x6df67495
0x6dfaf937
0x6dfaf93a
0x6dfaf94e
0x6dfaf953
0x6dfaf956
0x6dfaf956
0x6df67495
0x00000000
0x6df67488
0x6df67473
0x6df67478
0x6df6747d
0x6df67481
0x00000000
0x6df67481
0x6df6747d
0x6df6747a
0x00000000

APIs

ZwClose.9419(00000000,6DF670EF,00000024,00000000,?), ref: 6DFAF93A
RtlFreeHeap.9419(?,00000000,?,00000000,6DF670EF,00000024,00000000,?), ref: 6DFAF94E

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFreeHeap
String ID:
API String ID: 1266433183-0
Opcode ID: ae3ea9c290b1bab23f010482ad6f78dd9d44c82c9beceb359adb0e6279de44c5
Instruction ID: 4b9ab26549d08cb79c36822293c892100a1c732e948e72928509ef02ac885f9f
Opcode Fuzzy Hash: ae3ea9c290b1bab23f010482ad6f78dd9d44c82c9beceb359adb0e6279de44c5
Instruction Fuzzy Hash: 36F0E235D681C6EADB42CB7CC844B6ABBB1FF05358F054215E960ABD60E724DE00C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 6DF42CDB, Relevance: 4.5, APIs: 3, Instructions: 21
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DF42CDB(void* __ecx) {
				void* _t9;

				_t9 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x2c)) != 0) {
					_push(0);
					_push( *((intOrPtr*)(__ecx + 0x2c)));
					E6DF895C0();
				}
				if( *_t9 != 0) {
					_push( *_t9);
					E6DF895D0();
				}
				return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t9);
			}

0x6df42cde
0x6df42ce4
0x6df9f970
0x6df9f972
0x6df9f975
0x6df9f975
0x6df42ced
0x6df42d02
0x6df42d04
0x6df42d04
0x6df42d01

APIs

RtlFreeHeap.9419(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6DF42CD7), ref: 6DF42CFB
ZwClose.9419(?,?,?,?,?,?,?,?,?,?,?,6DF42CD7), ref: 6DF42D04
ZwSetEvent.9419(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6DF42CD7), ref: 6DF9F975

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventFreeHeap
String ID:
API String ID: 4036969103-0
Opcode ID: a2301cbb80807bd86986fb20a83a6222ed7f6f329ba40549649f5f350f115ca8
Instruction ID: 485e7724796ed35709c7d2ad573db3743336bda7d5ec3260646082636f1b6272
Opcode Fuzzy Hash: a2301cbb80807bd86986fb20a83a6222ed7f6f329ba40549649f5f350f115ca8
Instruction Fuzzy Hash: 4AE08632459250EFD7315B2CED00F417AB1BF00724F118439E241598A58BB55C81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6DF9DEF0, Relevance: 4.5, APIs: 3, Instructions: 18
nativeCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E6DF9DEF0(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v0;
				void* _v532;
				char _v724;
				intOrPtr _v728;
				intOrPtr _v732;
				void* _v820;
				void* _v1344;
				char _v1536;
				void* _v1544;
				void* _v1548;
				void* _v1552;
				void* _t23;
				intOrPtr* _t34;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;

				_t43 = _t45;
				_t46 =  &_v724;
				_push(_t46);
				E6DF9DDD0(_t23, __ecx, __edx, _t40, _t41);
				_t37 = _v0;
				 *((intOrPtr*)(_t46 + 0xc4)) =  *((intOrPtr*)(_t46 + 0xc4)) + 4;
				 *((intOrPtr*)(_a4 + 0xc)) = _v0;
				 *_t46 = 0x10007;
				_t33 = _t46;
				_push(1);
				_push(_t46);
				_push(_a4);
				_push(E6DF8AAE0());
				L1();
				_push(_t43);
				_t47 =  &_v1536;
				_push(_t47);
				E6DF9DDD0(_t26, _t33, _t37, _t40, _t41);
				 *((intOrPtr*)(_t47 + 0xc4)) =  *((intOrPtr*)(_t47 + 0xc4)) + 4;
				_t34 = _t47 + 0x2d0;
				 *_t47 = 0x10007;
				 *((intOrPtr*)(_t34 + 0xc)) = _v732;
				 *(_t34 + 0x10) =  *(_t34 + 0x10) & 0x00000000;
				 *(_t34 + 8) =  *(_t34 + 8) & 0x00000000;
				 *_t34 = _v728;
				 *((intOrPtr*)(_t34 + 4)) = 1;
				_push(1);
				_push(_t47);
				_push(_t34);
				_push(E6DF8AAE0());
				L1();
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("invalid");
				return  *((intOrPtr*)(_t47 + 8));
			}

0x6df9def1
0x6df9def3
0x6df9defa
0x6df9defb
0x6df9df00
0x6df9df06
0x6df9df0e
0x6df9df11
0x6df9df18
0x6df9df1a
0x6df9df1c
0x6df9df1d
0x6df9df25
0x6df9df26
0x6df9df30
0x6df9df33
0x6df9df3a
0x6df9df3b
0x6df9df40
0x6df9df48
0x6df9df52
0x6df9df59
0x6df9df5c
0x6df9df63
0x6df9df67
0x6df9df69
0x6df9df72
0x6df9df74
0x6df9df75
0x6df9df7b
0x6df9df7c
0x6df9df81
0x6df9df82
0x6df9df83
0x6df9df84
0x6df9df85
0x6df9df86
0x6df9df87
0x6df9df88
0x6df9df89
0x6df9df8a
0x6df9df8b
0x6df9df8c
0x6df9df8d
0x6df9df8e
0x6df9df8f
0x6df9df9c
0x6df9df9f

APIs

RtlCaptureContext.9419(?,?,6DFA49EA,40010006), ref: 6DF9DEFB
ZwRaiseException.9419(6DF8B627,?,00000001,?,?,6DFA49EA,40010006), ref: 6DF9DF20
RtlRaiseStatus.9419(00000000,6DF8B627,?,00000001,?,?,6DFA49EA,40010006), ref: 6DF9DF26

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Raise$CaptureContextExceptionStatus
String ID:
API String ID: 2613446992-0
Opcode ID: b88dc4b10795e55da266462dcb8a7ba652cc049ad2ff05fc8b118b39c15a66a9
Instruction ID: d67ccd6e110d8d8b59ac71ff87236e8ecb0a12a8c457d227770ac9735edb5548
Opcode Fuzzy Hash: b88dc4b10795e55da266462dcb8a7ba652cc049ad2ff05fc8b118b39c15a66a9
Instruction Fuzzy Hash: 09E08671528244EBEB10DF08CD46F9EB7E8FF80348F018009F6480F254D7B4AD508B82

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4F4E3, Relevance: 4.5, APIs: 3, Instructions: 15
nativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6DF4F4E3(void* __eflags) {

				 *( *[fs:0x18] + 0xfca) =  *( *[fs:0x18] + 0xfca) & 0x0000efff;
				L6DF5EEF0(0x6e037b60);
				 *0x6e037b78 =  *0x6e037b78 & 0x00000000;
				E6DF5EB70(0xefff, 0x6e037b60);
				_push(0);
				_push( *0x6e037b1c);
				return E6DF895C0();
			}

0x6df4f4f5
0x6df4f4fc
0x6df4f501
0x6df4f509
0x6df4f50e
0x6df4f510
0x6df4f51c

APIs

RtlEnterCriticalSection.9419(6E037B60,00000000,6DF508CF,?,?,?,?,?,?,6DFA0AF4,?), ref: 6DF4F4FC
RtlLeaveCriticalSection.9419(6E037B60,6E037B60,00000000,6DF508CF,?,?,?,?,?,?,6DFA0AF4,?), ref: 6DF4F509
ZwSetEvent.9419(00000000,6E037B60,6E037B60,00000000,6DF508CF,?,?,?,?,?,?,6DFA0AF4,?), ref: 6DF4F516

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 97211bf84505af169060f6bac1c3baf08e5656a1665ec55b09e72f1910d0ab55
Instruction ID: 1af782e66ed45e5873087aba5a1cf1ff219960e03d5b6b1fefdcfd8f35cab360
Opcode Fuzzy Hash: 97211bf84505af169060f6bac1c3baf08e5656a1665ec55b09e72f1910d0ab55
Instruction Fuzzy Hash: 31D0A733615676E7DF315B28DC50FD632B4AF01328F160870EB01669D14B246C51539C

Uniqueness

Uniqueness Score: -1.00%

Function 6E011D55, Relevance: 3.2, APIs: 2, Instructions: 226
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6E011D55(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t101;
				signed int _t112;
				unsigned int _t113;
				signed int _t121;
				signed int _t128;
				signed int _t130;
				signed char _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t144;
				signed int _t149;
				signed int _t150;
				void* _t154;
				signed int* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				intOrPtr _t171;
				signed int _t172;
				intOrPtr _t175;
				signed int* _t178;
				signed int _t179;
				signed int _t180;
				signed char _t181;
				signed char _t183;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				void* _t191;
				void* _t197;

				_t137 = __ecx;
				_push(0x64);
				_push(0x6e021070);
				E6DF9D08C(__ebx, __edi, __esi);
				 *(_t191 - 0x24) = __edx;
				 *((intOrPtr*)(_t191 - 0x20)) = __ecx;
				 *((intOrPtr*)(_t191 - 0x38)) = __ecx;
				_t135 = 0;
				 *(_t191 - 0x40) = 0;
				_t171 =  *((intOrPtr*)(__ecx + 0xc));
				_t189 =  *(__ecx + 8);
				 *(_t191 - 0x28) = _t189;
				 *((intOrPtr*)(_t191 - 0x3c)) = _t171;
				 *(_t191 - 0x50) = _t189;
				_t187 = __edx << 0xf;
				 *(_t191 - 0x4c) = _t187;
				_t190 = 0x8000;
				 *(_t191 - 0x34) = 0x8000;
				_t172 = _t171 - _t187;
				if(_t172 <= 0x8000) {
					_t190 = _t172;
					 *(_t191 - 0x34) = _t172;
				}
				 *(_t191 - 0x68) = _t135;
				 *(_t191 - 0x64) = _t135;
				L3:
				while(1) {
					if( *(_t191 + 8) != 0) {
						L22:
						 *(_t191 + 8) = _t135;
						E6E01337F(_t137, 1, _t191 - 0x74);
						_t44 =  *((intOrPtr*)(_t191 - 0x20)) + 0x14; // 0x6e011825
						_t175 =  *_t44;
						 *(_t191 - 0x58) = _t175;
						_t139 =  *((intOrPtr*)(_t191 - 0x20)) + 0x14;
						 *(_t191 - 0x44) = _t139;
						_t197 = _t175 - 0xffffffff;
						if(_t197 == 0) {
							 *_t139 =  *(_t191 - 0x24);
							E6E0133B6(_t191 - 0x74);
							 *(_t191 - 0x40) = 1;
							_t101 =  *( *((intOrPtr*)(_t191 - 0x38)) + 4);
							_t141 =  *(_t191 - 0x24);
							asm("bt [eax], ecx");
							_t103 = (_t101 & 0xffffff00 | __eflags > 0x00000000) & 0x000000ff;
							if(__eflags == 0) {
								goto L41;
							} else {
								_t103 = _t187 - 1 + _t190;
								__eflags = _t187 - 1 + _t190 -  *((intOrPtr*)(_t191 - 0x3c));
								if(_t187 - 1 + _t190 >=  *((intOrPtr*)(_t191 - 0x3c))) {
									goto L41;
								} else {
									__eflags = _t190 - 1;
									if(__eflags > 0) {
										_t143 =  *(_t191 - 0x28);
										_t178 = _t143 + (_t187 >> 5) * 4;
										_t144 = _t143 + (_t187 - 1 + _t190 >> 5) * 4;
										 *(_t191 - 0x50) = _t144;
										_t112 =  *_t178;
										 *(_t191 - 0x54) = _t112;
										_t113 = _t112 | 0xffffffff;
										__eflags = _t178 - _t144;
										if(_t178 != _t144) {
											_t103 = _t113 << _t187;
											__eflags =  *_t178 & _t103;
											if(( *_t178 & _t103) != 0) {
												goto L41;
											} else {
												_t103 =  *(_t191 - 0x50);
												while(1) {
													_t178 =  &(_t178[1]);
													__eflags = _t178 - _t103;
													if(_t178 == _t103) {
														break;
													}
													__eflags =  *_t178 - _t135;
													if( *_t178 != _t135) {
														goto L41;
													} else {
														continue;
													}
													goto L42;
												}
												_t103 = (_t103 | 0xffffffff) >>  !(_t187 - 1 + _t190);
												__eflags = _t103;
												_t149 =  *_t178;
												goto L38;
											}
										} else {
											_t154 = 0x20;
											_t103 = _t113 >> _t154 - _t190 << _t187;
											_t149 =  *(_t191 - 0x54);
											L38:
											_t150 = _t149 & _t103;
											__eflags = _t150;
											asm("sbb cl, cl");
											_t135 =  ~_t150 + 1;
											_t141 =  *(_t191 - 0x24);
											goto L39;
										}
									} else {
										if(__eflags != 0) {
											goto L41;
										} else {
											_t103 =  *(_t191 - 0x28);
											asm("bt [eax], edi");
											if(__eflags >= 0) {
												L40:
												_t136 =  *((intOrPtr*)(_t191 - 0x20));
												asm("lock btr [eax], ecx");
												_t84 = _t136 + 8; // 0xffffffa4
												 *((intOrPtr*)(_t191 - 0x60)) = (_t141 << 0xc) +  *_t84;
												 *((intOrPtr*)(_t191 - 0x5c)) = 0x1000;
												_push(0x4000);
												_push(_t191 - 0x5c);
												_push(_t191 - 0x60);
												_push(0xffffffff);
												_t103 = E6DF896E0();
											} else {
												L39:
												__eflags = _t135;
												if(_t135 == 0) {
													goto L41;
												} else {
													goto L40;
												}
											}
										}
									}
								}
							}
						} else {
							E6E0133B6(_t191 - 0x74);
							_t172 = _t191 - 0x58;
							E6DF7E18B( *(_t191 - 0x44), _t172, 4, _t135,  *0x6e035880);
							_t121 =  *( *((intOrPtr*)(_t191 - 0x38)) + 4);
							asm("bt [eax], ecx");
							_t103 = (_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff;
							if(((_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff) == 0) {
								goto L41;
							} else {
								_t137 =  *((intOrPtr*)(_t191 - 0x20));
								continue;
							}
						}
					} else {
						 *(_t191 - 4) = _t135;
						_t103 = _t187 - 1 + _t190;
						 *(_t191 - 0x30) = _t103;
						if(_t103 <  *((intOrPtr*)(_t191 - 0x3c))) {
							__eflags = _t190 - 1;
							if(__eflags > 0) {
								_t179 =  *(_t191 - 0x28);
								_t161 = _t179 + (_t187 >> 5) * 4;
								 *(_t191 - 0x2c) = _t161;
								_t128 = _t179 + ( *(_t191 - 0x30) >> 5) * 4;
								 *(_t191 - 0x44) = _t128;
								_t180 =  *_t161;
								__eflags = _t161 - _t128;
								if(_t161 != _t128) {
									_t103 = (_t128 | 0xffffffff) << _t187;
									__eflags = _t103 & _t180;
									if((_t103 & _t180) != 0) {
										goto L5;
									} else {
										_t130 =  *(_t191 - 0x2c);
										_t164 =  *(_t191 - 0x44);
										while(1) {
											_t130 = _t130 + 4;
											 *(_t191 - 0x2c) = _t130;
											_t180 =  *_t130;
											__eflags = _t130 - _t164;
											if(_t130 == _t164) {
												break;
											}
											__eflags = _t180;
											if(_t180 == 0) {
												continue;
											} else {
												goto L5;
											}
											goto L19;
										}
										_t103 = (_t130 | 0xffffffff) >>  !( *(_t191 - 0x30));
										__eflags = _t103;
										goto L17;
									}
								} else {
									_t167 = 0x20;
									_t103 = (_t128 | 0xffffffff) >> _t167 - _t190 << _t187;
									L17:
									_t183 =  ~(_t180 & _t103);
									asm("sbb dl, dl");
									goto L18;
								}
							} else {
								if(__eflags != 0) {
									goto L5;
								} else {
									_t103 =  *(_t191 - 0x28);
									asm("bt [eax], edi");
									_t183 =  ~(_t172 & 0xffffff00 | __eflags > 0x00000000);
									asm("sbb dl, dl");
									L18:
									_t181 = _t183 + 1;
									__eflags = _t181;
								}
							}
						} else {
							L5:
							_t181 = _t135;
						}
						L19:
						 *(_t191 - 0x19) = _t181;
						_t163 = _t181 & 0x000000ff;
						 *(_t191 - 0x48) = _t163;
						 *(_t191 - 4) = 0xfffffffe;
						if(_t163 == 0) {
							L41:
							_t136 =  *((intOrPtr*)(_t191 - 0x20));
						} else {
							_t137 =  *((intOrPtr*)(_t191 - 0x20));
							goto L22;
						}
					}
					L42:
					__eflags =  *(_t191 - 0x40);
					if( *(_t191 - 0x40) != 0) {
						_t91 = _t136 + 0x14; // 0x6e0210c4
						_t142 = _t91;
						 *_t91 = 0xffffffff;
						__eflags = 0;
						asm("lock or [eax], edx");
						_t103 = E6DF7DFDF(_t91, 1, _t142);
					}
					return E6DF9D0D1(_t103);
				}
			}

0x6e011d55
0x6e011d55
0x6e011d57
0x6e011d5c
0x6e011d63
0x6e011d66
0x6e011d69
0x6e011d6c
0x6e011d6e
0x6e011d71
0x6e011d74
0x6e011d77
0x6e011d7a
0x6e011d7d
0x6e011d82
0x6e011d85
0x6e011d88
0x6e011d8d
0x6e011d90
0x6e011d94
0x6e011d96
0x6e011d98
0x6e011d98
0x6e011d9b
0x6e011d9e
0x00000000
0x6e011da1
0x6e011da5
0x6e011e78
0x6e011e78
0x6e011e82
0x6e011e8a
0x6e011e8a
0x6e011e8d
0x6e011e92
0x6e011e95
0x6e011e98
0x6e011e9b
0x6e011ede
0x6e011ee3
0x6e011ee8
0x6e011ef2
0x6e011ef5
0x6e011ef8
0x6e011efe
0x6e011f03
0x00000000
0x6e011f09
0x6e011f0c
0x6e011f0e
0x6e011f11
0x00000000
0x6e011f17
0x6e011f17
0x6e011f1a
0x6e011f31
0x6e011f34
0x6e011f3f
0x6e011f42
0x6e011f45
0x6e011f47
0x6e011f4a
0x6e011f4d
0x6e011f4f
0x6e011f63
0x6e011f65
0x6e011f67
0x00000000
0x6e011f69
0x6e011f69
0x6e011f72
0x6e011f72
0x6e011f75
0x6e011f77
0x00000000
0x00000000
0x6e011f6e
0x6e011f70
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e011f70
0x6e011f83
0x6e011f83
0x6e011f85
0x00000000
0x6e011f85
0x6e011f51
0x6e011f53
0x6e011f5a
0x6e011f5c
0x6e011f87
0x6e011f87
0x6e011f87
0x6e011f8b
0x6e011f8d
0x6e011f90
0x00000000
0x6e011f90
0x6e011f1c
0x6e011f1c
0x00000000
0x6e011f22
0x6e011f22
0x6e011f25
0x6e011f28
0x6e011f97
0x6e011f97
0x6e011f9d
0x6e011fa4
0x6e011fa7
0x6e011faa
0x6e011fb1
0x6e011fb9
0x6e011fbd
0x6e011fbe
0x6e011fc0
0x6e011f2a
0x6e011f93
0x6e011f93
0x6e011f95
0x00000000
0x00000000
0x00000000
0x00000000
0x6e011f95
0x6e011f28
0x6e011f1c
0x6e011f1a
0x6e011f11
0x6e011e9d
0x6e011ea0
0x6e011eae
0x6e011eb4
0x6e011ebc
0x6e011ec2
0x6e011ec8
0x6e011ecd
0x00000000
0x6e011ed3
0x6e011ed3
0x00000000
0x6e011ed3
0x6e011ecd
0x6e011dab
0x6e011dab
0x6e011db1
0x6e011db3
0x6e011db9
0x6e011dbf
0x6e011dc2
0x6e011dda
0x6e011ddd
0x6e011de0
0x6e011de9
0x6e011dec
0x6e011def
0x6e011df1
0x6e011df3
0x6e011e0a
0x6e011e0c
0x6e011e0e
0x00000000
0x6e011e10
0x6e011e10
0x6e011e13
0x6e011e16
0x6e011e16
0x6e011e19
0x6e011e1c
0x6e011e1e
0x6e011e20
0x00000000
0x00000000
0x6e011e22
0x6e011e24
0x00000000
0x6e011e26
0x00000000
0x6e011e26
0x00000000
0x6e011e24
0x6e011e30
0x6e011e30
0x00000000
0x6e011e30
0x6e011df5
0x6e011df7
0x6e011e01
0x6e011e32
0x6e011e34
0x6e011e36
0x00000000
0x6e011e36
0x6e011dc4
0x6e011dc4
0x00000000
0x6e011dc6
0x6e011dc6
0x6e011dc9
0x6e011dcf
0x6e011dd1
0x6e011e38
0x6e011e38
0x6e011e38
0x6e011e38
0x6e011dc4
0x6e011dbb
0x6e011dbb
0x6e011dbb
0x6e011dbb
0x6e011e3a
0x6e011e3a
0x6e011e3d
0x6e011e40
0x6e011e43
0x6e011e6f
0x6e011fc7
0x6e011fc7
0x6e011e75
0x6e011e75
0x00000000
0x6e011e75
0x6e011e6f
0x6e011fca
0x6e011fca
0x6e011fce
0x6e011fd0
0x6e011fd0
0x6e011fd3
0x6e011fd9
0x6e011fde
0x6e011fe4
0x6e011fe4
0x6e011fee
0x6e011fee

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51236483de7f498167e48297b81ee19d1f09c42437904128e057f8ebccf814a6
Instruction ID: b7697fd996ddf2fa224955a64304d949290b554b06370467fb30661a295af525
Opcode Fuzzy Hash: 51236483de7f498167e48297b81ee19d1f09c42437904128e057f8ebccf814a6
Instruction Fuzzy Hash: 97816A31E182598FDB08CFE8C890AECB7F1BF59354B14422DE011AF398DB319949CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD0FEC, Relevance: 3.2, APIs: 2, Instructions: 185
nativeCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E6DFD0FEC(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t121;
				signed int _t126;
				signed int _t129;
				void* _t131;
				void* _t151;
				intOrPtr* _t152;
				intOrPtr _t155;
				signed int _t156;
				void* _t175;
				signed int _t177;
				signed int _t186;
				intOrPtr _t187;
				signed int _t189;
				void* _t195;

				_push(0x58);
				_push(0x6e0207d0);
				E6DF9D0E8(__ebx, __edi, __esi);
				 *(_t195 - 0x54) = __edx;
				 *(_t195 - 0x50) = __ecx;
				 *((intOrPtr*)(_t195 - 0x5c)) =  *((intOrPtr*)(_t195 + 0xc));
				 *((intOrPtr*)(_t195 - 0x4c)) = 0;
				 *((intOrPtr*)(_t195 - 0x30)) = 0xc0000001;
				 *((intOrPtr*)(_t195 - 0x34)) = 0;
				 *(_t195 - 0x40) = 0;
				 *((intOrPtr*)(_t195 - 0x38)) = 0;
				 *((intOrPtr*)(_t195 - 0x3c)) = 0;
				_t185 = 0;
				 *((intOrPtr*)(_t195 - 0x48)) = 0;
				 *((intOrPtr*)(_t195 - 4)) = 0;
				if(( *(_t195 + 8) & 0x00000004) == 0) {
					E6DFD1D0B(__ecx | 0xffffffff, __ecx);
				}
				_t110 = E6DFD1976(_t195 - 0x34);
				 *((intOrPtr*)(_t195 - 0x30)) = _t110;
				if(_t110 < 0) {
					 *((intOrPtr*)(_t195 - 0x34)) = 0;
				} else {
					 *((intOrPtr*)(_t195 - 0x2c)) =  *((intOrPtr*)(_t195 - 0x34));
					_t185 = 1;
					 *(_t195 - 0x44) = 1;
				}
				_t149 = _t195 - 0x40;
				_t175 = E6DFD19C8(_t195 - 0x40, _t195 - 0x48);
				 *((intOrPtr*)(_t195 - 0x30)) = _t175;
				if(_t175 >= 0) {
					 *((intOrPtr*)(_t195 + _t185 * 4 - 0x2c)) =  *(_t195 - 0x40);
					_t186 = _t185 + 1;
					 *(_t195 - 0x44) = _t186;
					_push(0);
					_push(2);
					_push(0x1fffff);
					_push(_t195 - 0x38);
					_push(0xffffffff);
					_push(0xffffffff);
					_push(0xffffffff);
					_t117 = E6DF898C0();
					 *((intOrPtr*)(_t195 - 0x30)) = _t117;
					if(_t117 < 0) {
						 *((intOrPtr*)(_t195 - 0x38)) = 0;
					} else {
						 *((intOrPtr*)(_t195 + _t186 * 4 - 0x2c)) =  *((intOrPtr*)(_t195 - 0x38));
						_t186 = _t186 + 1;
						 *(_t195 - 0x44) = _t186;
					}
					_push(0);
					_push(2);
					_push(0x1fffff);
					_push(_t195 - 0x3c);
					_push(0xffffffff);
					_push(0xfffffffe);
					_push(0xffffffff);
					_t119 = E6DF898C0();
					 *((intOrPtr*)(_t195 - 0x30)) = _t119;
					if(_t119 < 0) {
						 *((intOrPtr*)(_t195 - 0x3c)) = 0;
					} else {
						 *((intOrPtr*)(_t195 + _t186 * 4 - 0x2c)) =  *((intOrPtr*)(_t195 - 0x3c));
						 *(_t195 - 0x44) = _t186 + 1;
					}
					_t187 = E6DFD1CE4(_t149 | 0xffffffff);
					 *((intOrPtr*)(_t195 - 0x58)) = _t187;
					_t151 = 0xfffffffe;
					_t121 = E6DFD1D43(_t151);
					_t152 =  *((intOrPtr*)(_t195 - 0x48));
					 *_t152 = 0xf0;
					 *((intOrPtr*)(_t152 + 0xa8)) = 1;
					 *((intOrPtr*)(_t152 + 0xac)) = 0;
					 *((intOrPtr*)(_t152 + 4)) = _t187;
					 *((intOrPtr*)(_t152 + 8)) = _t121;
					 *((intOrPtr*)(_t152 + 0xb8)) =  *((intOrPtr*)(_t195 - 0x38));
					 *((intOrPtr*)(_t152 + 0xbc)) = 0;
					 *((intOrPtr*)(_t152 + 0xc0)) =  *((intOrPtr*)(_t195 - 0x3c));
					 *((intOrPtr*)(_t152 + 0xc4)) = 0;
					 *((intOrPtr*)(_t152 + 0xd0)) =  *((intOrPtr*)(_t195 - 0x34));
					 *((intOrPtr*)(_t152 + 0xd4)) = 0;
					 *((intOrPtr*)(_t152 + 0xd8)) = 0;
					 *((intOrPtr*)(_t152 + 0xdc)) = 0;
					 *((intOrPtr*)(_t152 + 0xe0)) = 0xc0000001;
					 *(_t152 + 0xe4) =  *(_t195 + 8);
					_t177 =  *0x7ffe0004;
					if(_t177 < 0x1000000) {
						while(1) {
							_t189 =  *0x7ffe0324;
							 *(_t195 - 0x64) = 0x7ffe0324;
							_t126 =  *0x7ffe0320;
							 *(_t195 - 0x68) = _t126;
							if(0x7ffe0324 ==  *0x7ffe0328) {
								break;
							}
							asm("pause");
						}
						_t129 = ((_t126 * _t177 >> 0x00000020 << 0x00000020 | _t126 * _t177) >> 0x18) + (_t189 << 8) * _t177;
					} else {
						 *(_t195 - 0x68) = 0x7ffe0320;
						_t129 = ( *0x7ffe0320 * _t177 >> 0x00000020 << 0x00000020 | 0x7ffe0320 * _t177) >> 0x18;
					}
					_t155 =  *((intOrPtr*)(_t195 - 0x48));
					 *(_t155 + 0xe8) = _t129;
					 *((intOrPtr*)(_t155 + 0xf0)) = 1;
					 *((intOrPtr*)(_t155 + 0xf4)) = 1;
					_t156 = 0x14;
					_t131 = memcpy(_t155 + 0xf8,  *(_t195 - 0x50), _t156 << 2);
					_t185 =  *(_t195 - 0x54);
					memcpy(_t131,  *(_t195 - 0x54), 0xb3 << 2);
					_t175 = E6DFD0B13( *((intOrPtr*)(_t195 - 0x58)),  *(_t195 - 0x40),  *(_t195 - 0x54), _t195 - 0x2c,  *(_t195 - 0x44),  *(_t195 + 8), _t195 - 0x4c);
					 *((intOrPtr*)(_t195 - 0x30)) = _t175;
					if(_t175 >= 0) {
						_t136 =  *((intOrPtr*)(_t195 - 0x4c));
						if( *((intOrPtr*)(_t195 - 0x4c)) == 0) {
							L20:
							_t175 = 0;
							 *((intOrPtr*)(_t195 - 0x30)) = 0;
						} else {
							_t175 = E6DFD1D6A(0,  *((intOrPtr*)(_t195 - 0x34)), _t136,  *((intOrPtr*)(_t195 - 0x5c)));
							 *((intOrPtr*)(_t195 - 0x30)) = _t175;
							if(_t175 >= 0) {
								goto L20;
							}
						}
					}
				}
				 *((intOrPtr*)(_t195 - 4)) = 0xfffffffe;
				E6DFD1242(0);
				return E6DF9D130(0, _t175, _t185);
			}

0x6dfd0fec
0x6dfd0fee
0x6dfd0ff3
0x6dfd0ff8
0x6dfd0ffb
0x6dfd1001
0x6dfd1006
0x6dfd1009
0x6dfd1010
0x6dfd1013
0x6dfd1016
0x6dfd1019
0x6dfd101c
0x6dfd101e
0x6dfd1021
0x6dfd1028
0x6dfd102e
0x6dfd102e
0x6dfd1036
0x6dfd103b
0x6dfd1040
0x6dfd1050
0x6dfd1042
0x6dfd1045
0x6dfd104a
0x6dfd104b
0x6dfd104b
0x6dfd1056
0x6dfd105e
0x6dfd1060
0x6dfd1065
0x6dfd106e
0x6dfd1072
0x6dfd1073
0x6dfd1076
0x6dfd1077
0x6dfd107e
0x6dfd1082
0x6dfd1083
0x6dfd1085
0x6dfd1087
0x6dfd1089
0x6dfd108e
0x6dfd1093
0x6dfd10a2
0x6dfd1095
0x6dfd1098
0x6dfd109c
0x6dfd109d
0x6dfd109d
0x6dfd10a5
0x6dfd10a6
0x6dfd10a8
0x6dfd10ac
0x6dfd10ad
0x6dfd10af
0x6dfd10b1
0x6dfd10b3
0x6dfd10b8
0x6dfd10bd
0x6dfd10cc
0x6dfd10bf
0x6dfd10c2
0x6dfd10c7
0x6dfd10c7
0x6dfd10d7
0x6dfd10d9
0x6dfd10de
0x6dfd10df
0x6dfd10e4
0x6dfd10e7
0x6dfd10ed
0x6dfd10f7
0x6dfd10fd
0x6dfd1100
0x6dfd1106
0x6dfd110c
0x6dfd1115
0x6dfd111b
0x6dfd1124
0x6dfd112a
0x6dfd1130
0x6dfd1136
0x6dfd113c
0x6dfd1149
0x6dfd114f
0x6dfd115b
0x6dfd1177
0x6dfd117c
0x6dfd117e
0x6dfd1181
0x6dfd1183
0x6dfd118f
0x00000000
0x00000000
0x6dfd1236
0x6dfd1236
0x6dfd11a4
0x6dfd115d
0x6dfd1164
0x6dfd1169
0x6dfd116d
0x6dfd11a6
0x6dfd11a9
0x6dfd11bb
0x6dfd11c1
0x6dfd11c9
0x6dfd11cd
0x6dfd11d4
0x6dfd11d9
0x6dfd11f4
0x6dfd11f6
0x6dfd11fb
0x6dfd11fd
0x6dfd1202
0x6dfd121b
0x6dfd121b
0x6dfd121d
0x6dfd1204
0x6dfd1212
0x6dfd1214
0x6dfd1219
0x00000000
0x00000000
0x6dfd1219
0x6dfd1202
0x6dfd11fb
0x6dfd1220
0x6dfd1227
0x6dfd1233

APIs

ZwDuplicateObject.9419(000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000), ref: 6DFD1089
ZwDuplicateObject.9419(000000FF,000000FE,000000FF,?,001FFFFF,00000002,00000000,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6E0207D0,00000058), ref: 6DFD10B3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: DuplicateObject
String ID:
API String ID: 3677547684-0
Opcode ID: 6219ec195d977347068fddafa183f3e2e37e1e70a745722beb56629ec58456f7
Instruction ID: 49743e2dd3cd06c42d520d283fafc63ec3c3ed8f4e6436e22750d6fcd03657c7
Opcode Fuzzy Hash: 6219ec195d977347068fddafa183f3e2e37e1e70a745722beb56629ec58456f7
Instruction Fuzzy Hash: 6D711EB1D042199FDB40CF9DD880A8DBBB5BF49324F29823EE919AB394D7725942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7B230, Relevance: 3.2, APIs: 2, Instructions: 173
nativeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6DF7B230(signed char _a4, signed short _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				char _v84;
				intOrPtr _v92;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				short _v122;
				char _v124;
				void* _v140;
				signed int _v152;
				signed int _v156;
				intOrPtr _v160;
				void* _v164;
				signed int _v184;
				signed int _v188;
				intOrPtr _v200;
				char _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				signed int _v216;
				signed int _v220;
				char _v221;
				signed int _v252;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t80;
				char _t82;
				long _t95;
				void* _t105;
				intOrPtr _t106;
				signed int _t112;
				signed int _t118;
				signed int _t120;
				void* _t126;
				signed int _t128;
				void* _t131;
				signed int _t133;
				signed int _t134;
				signed int _t137;

				_t139 = (_t137 & 0xfffffff8) - 0xe0;
				_v8 =  *0x6e03d360 ^ (_t137 & 0xfffffff8) - 0x000000e0;
				_t106 = _a12;
				_v212 = _a20;
				_t80 = 0;
				_v208 = _t106;
				_v220 = 0;
				if(_t106 == 0) {
					_push("true");
					L36:
					_pop(_t80);
					L8:
					_pop(_t126);
					_pop(_t131);
					return E6DF8B640(_t80, _t105, _v8 ^ _t139, _t122, _t126, _t131);
				}
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t133 = _a8 & 0x0000ffff;
				if(_t133 == 0) {
					L35:
					_push(6);
					goto L36;
				}
				_t122 = _a4;
				if((_t122 & 0x00000001) != 0 || _t133 !=  *((intOrPtr*)(_t122 + 0x34))) {
					goto L35;
				} else {
					_t134 = _v152;
					_t128 = _v156;
					if( *((intOrPtr*)(_t122 + 0xc4)) != 0) {
						_t82 =  *((intOrPtr*)(_t122 + 0xc5));
						__eflags = _v160 - _t82;
						_v221 = _t82;
						_t80 = _v220;
						if(_v160 <= _t82) {
							L22:
							__eflags =  *(_t122 + 0xc0) & 0x00000040;
							if(( *(_t122 + 0xc0) & 0x00000040) == 0) {
								L24:
								__eflags =  *(_t122 + 0xb8) & _t128 |  *(_t122 + 0xbc) & _t134;
								if(( *(_t122 + 0xb8) & _t128 |  *(_t122 + 0xbc) & _t134) == 0) {
									L30:
									_t80 = _v220;
									L31:
									_v221 = 0;
									L6:
									if( *((char*)(_t122 + 0x4c)) != 0) {
										_t112 =  *((intOrPtr*)(_t122 + 0x4d));
										__eflags = _v160 - _t112;
										if(_v160 > _t112) {
											__eflags = _t112;
											if(_t112 != 0) {
												goto L7;
											}
										}
										__eflags =  *(_t122 + 0x48) & 0x00000040;
										if(( *(_t122 + 0x48) & 0x00000040) == 0) {
											L12:
											__eflags =  *(_t122 + 0x40) & _t128 |  *(_t122 + 0x44) & _t134;
											if(( *(_t122 + 0x40) & _t128 |  *(_t122 + 0x44) & _t134) == 0) {
												L17:
												_t80 = _v220;
												goto L7;
											}
											_t118 =  *(_t122 + 0x3c) & _t134;
											__eflags = ( *(_t122 + 0x38) & _t128) -  *(_t122 + 0x38);
											if(( *(_t122 + 0x38) & _t128) !=  *(_t122 + 0x38)) {
												goto L17;
											}
											__eflags = _t118 -  *(_t122 + 0x3c);
											if(_t118 !=  *(_t122 + 0x3c)) {
												goto L17;
											}
											L15:
											_v200 = 0;
											_v120 = _a16;
											_v116 = _v212;
											_v112 = 0;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											_v122 = 0;
											_push( &_v204);
											_push(0x78);
											_push(0x300);
											_push( *((intOrPtr*)(_t122 + 0x30)));
											_v124 = 0;
											_v92 = 0;
											_t95 = E6DF89AE0();
											__eflags = _t95;
											if(_t95 != 0) {
												_t80 = RtlNtStatusToDosError(_t95);
											}
											_v220 = _t80;
											goto L7;
										}
										__eflags = _t128 | _t134;
										if((_t128 | _t134) == 0) {
											goto L15;
										}
										goto L12;
									}
									L7:
									if(_v221 != 0) {
										L34:
										_t122 =  &_v84;
										E6E01571C(_t80,  &_v84);
										_t80 = _v220;
									}
									goto L8;
								}
								_t120 =  *(_t122 + 0xb0);
								_v216 =  *((intOrPtr*)(_t122 + 0xb4));
								_v216 = _v216 & _t134;
								_t122 = _a4;
								__eflags = (_t120 & _t128) - _t120;
								if((_t120 & _t128) != _t120) {
									goto L30;
								}
								__eflags = _v216 -  *((intOrPtr*)(_t122 + 0xb4));
								if(__eflags != 0) {
									goto L30;
								}
								_t106 = _v208;
								L28:
								_v221 = 1;
								_push( &_v84);
								_push(_v212);
								_push(_a16);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_t80 = L6E015BA5(_t105, _a4, _t106, _t128, _t134, __eflags);
								_v252 = _t80;
								__eflags = _t80;
								if(_t80 != 0) {
									goto L34;
								}
								_t134 = _v184;
								_t128 = _v188;
								_t122 = _a4;
								goto L6;
							}
							__eflags = _t128 | _t134;
							if(__eflags == 0) {
								goto L28;
							}
							goto L24;
						}
						__eflags = _v221 - _t80;
						if(_v221 != _t80) {
							goto L31;
						}
						goto L22;
					}
					_v221 = 0;
					goto L6;
				}
			}

0x6df7b238
0x6df7b245
0x6df7b24f
0x6df7b252
0x6df7b256
0x6df7b258
0x6df7b25c
0x6df7b264
0x6dfba2f6
0x6dfba3de
0x6dfba3de
0x6df7b2c0
0x6df7b2c7
0x6df7b2c8
0x6df7b2d3
0x6df7b2d3
0x6df7b270
0x6df7b271
0x6df7b272
0x6df7b273
0x6df7b274
0x6df7b27b
0x6dfba3dc
0x6dfba3dc
0x00000000
0x6dfba3dc
0x6df7b281
0x6df7b287
0x00000000
0x6df7b297
0x6df7b297
0x6df7b29b
0x6df7b2a5
0x6dfba2fd
0x6dfba303
0x6dfba307
0x6dfba30b
0x6dfba30f
0x6dfba31b
0x6dfba31b
0x6dfba322
0x6dfba32a
0x6dfba33a
0x6dfba33c
0x6dfba3aa
0x6dfba3aa
0x6dfba3ae
0x6dfba3ae
0x6df7b2af
0x6df7b2b3
0x6df7b2d6
0x6df7b2d9
0x6df7b2dd
0x6dfba3b8
0x6dfba3ba
0x00000000
0x00000000
0x6dfba3c0
0x6df7b2e3
0x6df7b2e7
0x6df7b2ef
0x6df7b2f9
0x6df7b2fb
0x6df7b377
0x6df7b377
0x00000000
0x6df7b377
0x6df7b305
0x6df7b307
0x6df7b30a
0x00000000
0x00000000
0x6df7b30c
0x6df7b30f
0x00000000
0x00000000
0x6df7b311
0x6df7b324
0x6df7b32d
0x6df7b335
0x6df7b33b
0x6df7b33f
0x6df7b340
0x6df7b341
0x6df7b342
0x6df7b343
0x6df7b34c
0x6df7b34d
0x6df7b34f
0x6df7b354
0x6df7b357
0x6df7b35e
0x6df7b365
0x6df7b36a
0x6df7b36c
0x6df7b381
0x6df7b381
0x6df7b36e
0x00000000
0x6df7b36e
0x6df7b2eb
0x6df7b2ed
0x00000000
0x00000000
0x00000000
0x6df7b2ed
0x6df7b2b5
0x6df7b2ba
0x6dfba3c5
0x6dfba3c5
0x6dfba3ce
0x6dfba3d3
0x6dfba3d3
0x00000000
0x6df7b2ba
0x6dfba33e
0x6dfba34e
0x6dfba352
0x6dfba356
0x6dfba359
0x6dfba35b
0x00000000
0x00000000
0x6dfba363
0x6dfba367
0x00000000
0x00000000
0x6dfba369
0x6dfba36d
0x6dfba374
0x6dfba379
0x6dfba37a
0x6dfba382
0x6dfba388
0x6dfba389
0x6dfba38a
0x6dfba38b
0x6dfba38c
0x6dfba38d
0x6dfba392
0x6dfba396
0x6dfba398
0x00000000
0x00000000
0x6dfba39a
0x6dfba39e
0x6dfba3a2
0x00000000
0x6dfba3a2
0x6dfba326
0x6dfba328
0x00000000
0x00000000
0x00000000
0x6dfba328
0x6dfba311
0x6dfba315
0x00000000
0x00000000
0x00000000
0x6dfba315
0x6df7b2ab
0x00000000
0x6df7b2ab

APIs

ZwTraceEvent.9419(?,00000300,00000078,?,FFFFFFFE,000000FF), ref: 6DF7B365
RtlNtStatusToDosError.9419(00000000,?,00000300,00000078,?,FFFFFFFE,000000FF), ref: 6DF7B381

Part of subcall function 6DF4CCC0: DbgPrint.9419(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6DFA4E05
Part of subcall function 6DF4CCC0: DbgPrint.9419(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6DFA4E0F
Part of subcall function 6DF4CCC0: DbgPrint.9419(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6DFA4E1C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$ErrorEventStatusTrace
String ID:
API String ID: 4205894102-0
Opcode ID: e0f3f46e4f4ffba5fac316759958beea28bf230c0b54774a1680a09aa7e139a3
Instruction ID: 04da5de4d4bd1bf879c169d69bcb77277b8d30463bff8bfff6898426fa0d6f24
Opcode Fuzzy Hash: e0f3f46e4f4ffba5fac316759958beea28bf230c0b54774a1680a09aa7e139a3
Instruction Fuzzy Hash: ED617F3161D786CBD716CF68D440BAFBBE1BF86700F08895EE9988B241D771D884CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF58A0A, Relevance: 3.1, APIs: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DF58A0A(void* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				void _t53;
				signed int _t55;
				void* _t62;
				void* _t63;
				unsigned int _t75;
				long _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x6e03d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E6DF8B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E6DF5E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x6df21180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E6DF71DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E6DF83C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E6DF58999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x6df58a0a
0x6df58a1c
0x6df58a23
0x6df58a2e
0x6df58a30
0x6df58a36
0x6df58a3c
0x6df58a3e
0x6df58a4a
0x6df58a52
0x6df58a9c
0x6df58aae
0x6df58a58
0x6df58a5e
0x6df58a6a
0x6df58a6f
0x6df58a75
0x6df58a7d
0x6df58a85
0x6df58a86
0x6df58a89
0x6df58a93
0x6df58a99
0x6df58a9b
0x00000000
0x6df58aaf
0x6df58abe
0x6df58ac3
0x6df58acb
0x6df58ad7
0x6df58ae0
0x6df58af1
0x00000000
0x6df58af1
0x6df58acd
0x6df58ad5
0x6df58afb
0x6df58afd
0x6df58aff
0x6df58b07
0x6df58b22
0x6df58b24
0x6df58b2a
0x6df58b2e
0x6df58b3f
0x6df58b78
0x6df58b41
0x6df58b52
0x6df58b54
0x6df58b5c
0x6df58b74
0x6df58b74
0x6df58b5c
0x6df58b3f
0x6df58b5e
0x6df58b61
0x6df58b64
0x6df58b64
0x6df58b6c
0x6df58b6c
0x6df58b11
0x6dfa9cd5
0x6dfa9cd5
0x6df58b17
0x6df58b1a
0x6df58b1a
0x00000000
0x6df58ad5
0x6df58a89

APIs

RtlImageNtHeaderEx.9419(00000001,?,00000000,00000000,?,00000040,-00000054,00000000), ref: 6DF58A6A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage
String ID:
API String ID: 1925295642-0
Opcode ID: e975be54541bdbd4db2942eab85c1255a2fc4858b1a8f6e8c7c845bb46de088e
Instruction ID: e6f15ad679aa4efcb483b0d56cc1efca078435a4d503fb58c9384a85040c1738
Opcode Fuzzy Hash: e975be54541bdbd4db2942eab85c1255a2fc4858b1a8f6e8c7c845bb46de088e
Instruction Fuzzy Hash: BD41B3B1A5422DABDB24CF1DC888AE9B7F8FB55300F1141E9D918D7212E7719E90CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF71520, Relevance: 3.1, APIs: 2, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6DF71520(signed int* _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int* _v16;
				signed int _v20;
				short _v46;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t40;
				intOrPtr _t44;
				signed int _t50;
				signed int _t51;
				intOrPtr _t52;
				signed int _t55;
				void* _t63;
				signed int _t64;
				signed int _t69;
				signed int _t70;
				signed int _t72;
				void* _t74;
				signed int _t75;
				signed int* _t78;
				void* _t79;
				signed int _t80;

				_t82 = (_t80 & 0xfffffff8) - 0x34;
				_v8 =  *0x6e03d360 ^ (_t80 & 0xfffffff8) - 0x00000034;
				_t72 = _a12;
				_t78 = _a4;
				if((_t72 & 0xe0000000) != 0 || (_t72 & 0x11000000) == 0x11000000) {
					_t40 = 0xc00000f1;
					goto L3;
				} else {
					_t69 = _a8;
					__eflags = _t69 & 0xff000000;
					if((_t69 & 0xff000000) != 0) {
						_t40 = 0xc00000f0;
						L3:
						_pop(_t74);
						_pop(_t79);
						_pop(_t63);
						return E6DF8B640(_t40, _t63, _v8 ^ _t82, _t72, _t74, _t79);
					}
					__eflags = _t72 & 0x04000000;
					if((_t72 & 0x04000000) != 0) {
						L17:
						_t40 = 0;
						goto L3;
					}
					_t44 =  *[fs:0x30];
					_t64 = 0;
					_t78[1] = _t78[1] | 0xffffffff;
					_t78[2] = 0;
					_t78[3] = 0;
					_t78[4] = 0;
					__eflags =  *((intOrPtr*)(_t44 + 0x64)) - 1;
					if( *((intOrPtr*)(_t44 + 0x64)) <= 1) {
						_t78[5] = 0;
						_t70 = 0;
						L11:
						_t78[5] = _t72 & 0x09000000 | _t70;
						__eflags = _t72 & 0x10000000;
						if((_t72 & 0x10000000) != 0) {
							L19:
							_t64 = 1;
							L13:
							 *_t78 =  *_t78 | 0xffffffff;
							__eflags = _t64;
							if(__eflags != 0) {
								E6DF71624(_t64, _t72, __eflags);
								__eflags =  *_t78 - 0xffffffff;
								if( *_t78 != 0xffffffff) {
									goto L14;
								}
								_t78[5] = _t78[5] | 0x01000000;
							}
							L14:
							_t75 = 0x7ffe0382;
							_t50 =  *( *[fs:0x30] + 0x50);
							__eflags = _t50;
							if(_t50 != 0) {
								__eflags =  *_t50;
								if( *_t50 == 0) {
									goto L15;
								}
								_t51 =  *( *[fs:0x30] + 0x50) + 0x228;
								L16:
								__eflags =  *_t51;
								if( *_t51 != 0) {
									_t52 =  *[fs:0x30];
									__eflags =  *(_t52 + 0x240) & 0x00000002;
									if(( *(_t52 + 0x240) & 0x00000002) == 0) {
										goto L17;
									}
									_v16 = _t78;
									_v46 = 0x1723;
									_v20 = _t78[5];
									_t55 = E6DF67D50();
									__eflags = _t55;
									if(_t55 != 0) {
										_t75 =  *( *[fs:0x30] + 0x50) + 0x228;
										__eflags = _t75;
									}
									_push( &_v52);
									_push(8);
									_push(0x10402);
									_push( *_t75 & 0x000000ff);
									E6DF89AE0();
								}
								goto L17;
							}
							L15:
							_t51 = _t75;
							goto L16;
						}
						__eflags =  *0x6e036900 - _t64;
						if( *0x6e036900 != _t64) {
							goto L19;
						}
						goto L13;
					}
					__eflags = _t72 & 0x02000000;
					if((_t72 & 0x02000000) != 0) {
						L18:
						_t70 = 0x20007d0;
						L10:
						_t78[5] = _t70;
						goto L11;
					}
					__eflags = _t69;
					if(_t69 == 0) {
						goto L18;
					}
					_t70 = _t69 & 0x00ffffff;
					__eflags = _t70;
					goto L10;
				}
			}

0x6df71528
0x6df71532
0x6df71536
0x6df7153b
0x6df71545
0x6df71554
0x00000000
0x6df7156d
0x6df7156d
0x6df71570
0x6df71576
0x6df9e2f1
0x6df71559
0x6df7155d
0x6df7155e
0x6df7155f
0x6df7156a
0x6df7156a
0x6df7157c
0x6df71582
0x6df71601
0x6df71601
0x00000000
0x6df71601
0x6df71584
0x6df7158a
0x6df7158c
0x6df71590
0x6df71593
0x6df71596
0x6df71599
0x6df7159d
0x6df9e2fb
0x6df9e2fe
0x6df715b8
0x6df715c1
0x6df715c4
0x6df715ca
0x6df7160f
0x6df7160f
0x6df715d4
0x6df715d4
0x6df715d7
0x6df715d9
0x6df71615
0x6df7161a
0x6df7161d
0x00000000
0x00000000
0x6df9e305
0x6df9e305
0x6df715db
0x6df715e1
0x6df715eb
0x6df715ee
0x6df715f0
0x6df9e311
0x6df9e314
0x00000000
0x00000000
0x6df9e323
0x6df715f8
0x6df715f8
0x6df715fb
0x6df9e32a
0x6df9e330
0x6df9e337
0x00000000
0x00000000
0x6df9e342
0x6df9e346
0x6df9e34e
0x6df9e352
0x6df9e357
0x6df9e359
0x6df9e364
0x6df9e364
0x6df9e364
0x6df9e36a
0x6df9e36e
0x6df9e370
0x6df9e375
0x6df9e376
0x6df9e376
0x00000000
0x6df715fb
0x6df715f6
0x6df715f6
0x00000000
0x6df715f6
0x6df715cc
0x6df715d2
0x00000000
0x00000000
0x00000000
0x6df715d2
0x6df715a3
0x6df715a9
0x6df71608
0x6df71608
0x6df715b5
0x6df715b5
0x00000000
0x6df715b5
0x6df715ab
0x6df715ad
0x00000000
0x00000000
0x6df715af
0x6df715af
0x00000000
0x6df715af

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a412f704be522eec4c0678caffb79ffe44574201873ee1831ea226388202ba
Instruction ID: a736e429795e39cba09d70b2421b3d8e9a6051b2615741b4eebe11bacb67fb8a
Opcode Fuzzy Hash: 19a412f704be522eec4c0678caffb79ffe44574201873ee1831ea226388202ba
Instruction Fuzzy Hash: 8B41E431A197418FE335CF1CE8A0BA677F5BB45714F045A2EE8A6CB680D734D848CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7D976, Relevance: 3.1, APIs: 2, Instructions: 102
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6DF7D976(void* __ecx, void* __edx, signed char _a4) {
				char _v12;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				void* _t39;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t47;
				void* _t49;
				void* _t51;
				intOrPtr _t54;

				_push(__ecx);
				_push(__ecx);
				_t51 = __edx;
				_push(0);
				_push(0);
				_push(0);
				_push(1);
				_push(5);
				_push(0);
				_push(0);
				_t39 = __ecx;
				_push( &_v12);
				_push(__edx);
				_push(0x80100080);
				_push(__ecx);
				_t49 = E6DF89A50();
				if((_a4 & 0x00000003) != 0) {
					_t42 =  *[fs:0x18];
					_t29 =  *((intOrPtr*)(_t42 + 0xfdc));
					if(_t29 < 0) {
						_t42 = _t42 + _t29;
					}
					if(_t42 ==  *((intOrPtr*)(_t42 + 0x18))) {
						_t30 =  *((intOrPtr*)(_t42 + 0xe30));
					} else {
						_t30 =  *((intOrPtr*)(_t42 + 0x14c0));
					}
					if(_t30 == 0 && _t49 == 0xc0000034) {
						_t32 =  *[fs:0x18];
						_t43 =  *((intOrPtr*)(_t32 + 0xfdc));
						if(_t43 < 0) {
							_t32 = _t32 + _t43;
						}
						if(_t32 ==  *((intOrPtr*)(_t32 + 0x18))) {
							_t54 =  *((intOrPtr*)(_t32 + 0xe30));
						} else {
							_t54 =  *((intOrPtr*)(_t32 + 0x14c0));
						}
						_t33 =  *[fs:0x18];
						_t44 =  *((intOrPtr*)(_t33 + 0xfdc));
						if(_t44 < 0) {
							_t33 = _t33 + _t44;
						}
						if(_t33 ==  *((intOrPtr*)(_t33 + 0x18))) {
							 *((intOrPtr*)(_t33 + 0xe30)) = 1;
						} else {
							 *(_t33 + 0x14c4) =  *(_t33 + 0x14c4) & 0x00000000;
							 *((intOrPtr*)(_t33 + 0x14c0)) = 1;
						}
						_push(0);
						_push(0);
						_push(0);
						_push(1);
						_push(5);
						_push(0);
						_push(0);
						_push( &_v12);
						_push(_t51);
						_push(0x80100080);
						_push(_t39);
						_t49 = E6DF89A50();
						if(_t49 < 0) {
							_t49 = 0xc0000034;
						}
						_t37 =  *[fs:0x18];
						_t47 =  *((intOrPtr*)(_t37 + 0xfdc));
						if(_t47 < 0) {
							_t37 = _t37 + _t47;
						}
						if(_t37 ==  *((intOrPtr*)(_t37 + 0x18))) {
							 *((intOrPtr*)(_t37 + 0xe30)) = _t54;
						} else {
							 *(_t37 + 0x14c4) =  *(_t37 + 0x14c4) & 0x00000000;
							 *((intOrPtr*)(_t37 + 0x14c0)) = _t54;
						}
					}
				}
				return _t49;
			}

0x6df7d97b
0x6df7d97c
0x6df7d981
0x6df7d983
0x6df7d984
0x6df7d985
0x6df7d986
0x6df7d988
0x6df7d98a
0x6df7d98b
0x6df7d98f
0x6df7d991
0x6df7d992
0x6df7d993
0x6df7d998
0x6df7d9a2
0x6df7d9a4
0x6df7d9b0
0x6df7d9b7
0x6df7d9bf
0x6df7d9c1
0x6df7d9c1
0x6df7d9c6
0x6dfbb22c
0x6df7d9cc
0x6df7d9cc
0x6df7d9cc
0x6df7d9d4
0x6df7d9de
0x6df7d9e4
0x6df7d9ec
0x6df7d9ee
0x6df7d9ee
0x6df7d9f4
0x6dfbb237
0x6df7d9fa
0x6df7d9fa
0x6df7d9fa
0x6df7da00
0x6df7da06
0x6df7da0e
0x6df7da10
0x6df7da10
0x6df7da18
0x6df7da78
0x6df7da1a
0x6df7da1a
0x6df7da21
0x6df7da21
0x6df7da29
0x6df7da2a
0x6df7da2b
0x6df7da2c
0x6df7da2d
0x6df7da2f
0x6df7da30
0x6df7da34
0x6df7da35
0x6df7da36
0x6df7da3b
0x6df7da41
0x6df7da45
0x6df7da71
0x6df7da71
0x6df7da47
0x6df7da4d
0x6df7da55
0x6df7da57
0x6df7da57
0x6df7da5c
0x6df7da80
0x6df7da5e
0x6df7da5e
0x6df7da65
0x6df7da65
0x6df7da6b
0x6df7d9d4
0x6df7d9ad

APIs

ZwCreateFile.9419(00000000,80100080,00000018,?,00000000,00000000,00000005,00000001,00000000,00000000,00000000,?,02BE0000,00000000,00000000), ref: 6DF7D999
ZwCreateFile.9419(00000000,80100080,00000018,00000003,00000000,00000000,00000005,00000001,00000000,00000000,00000000,00000000,00000000,80100080,00000018,?), ref: 6DF7DA3C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 01fd6d0b1617e47efc59362f2c498d5b79c56f1f200e48efda339238b57eee85
Instruction ID: b81965109277ac79a1ed1c9cdb87208ad2d928dc44088846b4c1689396a64b7d
Opcode Fuzzy Hash: 01fd6d0b1617e47efc59362f2c498d5b79c56f1f200e48efda339238b57eee85
Instruction Fuzzy Hash: A73130B2654145DFE329CA19DC94FF633BDF781718F0580BAE809DF252E661E901C790

Uniqueness

Uniqueness Score: -1.00%

Function 6DF761A0, Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6DF761A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E6DF75E50(0x6df267cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E6E019D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E6DF4F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x6df761b3
0x6df761b5
0x6df761bd
0x6df761c3
0x6df761c7
0x6df761d2
0x6df761ff
0x6df761ff
0x6df76201
0x6df76207
0x6df76207
0x6df761d4
0x6df761d9
0x00000000
0x00000000
0x6df761df
0x6df761e2
0x00000000
0x00000000
0x6df761e6
0x6df761e8
0x6df761ee
0x6df761ee
0x6df761f9
0x6dfb762f
0x6dfb7632
0x6dfb7635
0x6dfb7639
0x6dfb7640
0x6dfb766e
0x6dfb7675
0x00000000
0x00000000
0x6dfb7681
0x6dfb7689
0x6dfb768d
0x6dfb7691
0x6dfb7695
0x6dfb7699
0x6dfb76af
0x6dfb76b5
0x6dfb76b7
0x6dfb76b7
0x6dfb76d7
0x6dfb76dc
0x00000000
0x6dfb76dc
0x6dfb76a2
0x6dfb76a9
0x6dfb7651
0x6dfb7653
0x6dfb7653
0x6dfb7656
0x6dfb7656
0x00000000
0x6dfb7656
0x6dfb7644
0x6dfb7646
0x6dfb7648
0x6dfb7648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694bf1fdbe03b70e0d10a8d0b9a695852a91e8e7b48127cd4233e9aa7fd486d0
Instruction ID: cbb7682a162c5f1596b0871ce03f81710272c90f1b0303558dccf6f6c41af95c
Opcode Fuzzy Hash: 694bf1fdbe03b70e0d10a8d0b9a695852a91e8e7b48127cd4233e9aa7fd486d0
Instruction Fuzzy Hash: 48318071A197029FD360CF1DD800B66B7E5FB88B00F05496EF99497351E7B0D804CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7A080, Relevance: 3.1, APIs: 2, Instructions: 90
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DF7A080(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a8) {
				signed short _v0;
				signed short _v4;
				signed int _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				intOrPtr _t34;
				signed int _t37;
				void* _t39;
				intOrPtr _t43;
				intOrPtr _t44;
				void* _t48;
				signed int _t49;
				intOrPtr* _t51;
				signed int _t53;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t66;
				void* _t70;
				void* _t74;

				_push(0x1c);
				_push(0x6e0201e0);
				E6DF9D08C(__ebx, __edi, __esi);
				_t48 = _a8;
				_t28 =  *((intOrPtr*)(_t48 + 0x10));
				if(_t28 != 0) {
					if(_t28 == 0xffffffff) {
						goto L1;
					} else {
						_push(_t28);
						_v32 = E6DF895D0();
					}
				} else {
					L1:
					_v32 = _v32 & 0x00000000;
				}
				_t70 =  *_t48;
				_v36 = _t70;
				if(_t70 == 0 || _t70 == 0xffffffff) {
					L4:
					_t49 = 6;
					memset(_t48, 0, _t49 << 2);
					return E6DF9D0D1(_v32);
				} else {
					_t66 =  *(_t48 + 0x14) & 0x04000000;
					_v28 = _t66;
					_v40 = _t66;
					E6DF62280(_t28, 0x6e0385ec);
					_v4 = _v4 & 0x00000000;
					_t13 = _t70 + 8; // 0x8
					_t51 = _t13;
					_t34 =  *_t51;
					if(_t34 == 0) {
						L9:
						_v4 = 0xfffffffe;
						E6DF7A142();
						_push( *(_t70 + 0x1c) & 0x0000ffff);
						_t37 =  *(_t70 + 2) & 0x0000ffff;
						_push(_t37);
						L15();
						if(_t37 != 0) {
							_t52 =  *0x6e0365c4;
							if( *0x6e0365c4 != 0) {
								E6DFFBC40(_t52, _t37);
							}
						}
						_t53 = 8;
						_t39 = memset(_t70, 0, _t53 << 2);
						_t74 = _t74 + 0xc;
						if(_v28 == _t39) {
							E6DF7A185();
						}
						goto L4;
					} else {
						_t61 =  *((intOrPtr*)(_t51 + 4));
						if( *((intOrPtr*)(_t34 + 4)) != _t51 ||  *_t61 != _t51) {
							_push("true");
							asm("int 0x29");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t59 = ((_v0 & 0x0000ffff) << 0x10) + (_v4 & 0x0000ffff);
							_t43 =  *0x6e0365c4;
							if(_t43 != 0) {
								if(_t59 == 0 || _t59 >  *((intOrPtr*)(_t43 + 0x60))) {
									goto L16;
								} else {
									_t44 =  *((intOrPtr*)( *((intOrPtr*)(_t43 + 0x64)) - (_t59 << 2)));
								}
							} else {
								L16:
								_t44 = 0;
							}
							return _t44;
						} else {
							 *_t61 = _t34;
							 *((intOrPtr*)(_t34 + 4)) = _t61;
							goto L9;
						}
					}
				}
			}

0x6df7a080
0x6df7a082
0x6df7a087
0x6df7a08c
0x6df7a08f
0x6df7a094
0x6df7a137
0x00000000
0x6df7a13d
0x6dfb98ec
0x6dfb98f2
0x6dfb98f2
0x6df7a09a
0x6df7a09a
0x6df7a09a
0x6df7a09a
0x6df7a09e
0x6df7a0a0
0x6df7a0a5
0x6df7a0ac
0x6df7a0ae
0x6df7a0b3
0x6df7a0bd
0x6df7a0c0
0x6df7a0c3
0x6df7a0c9
0x6df7a0cc
0x6df7a0d4
0x6df7a0d9
0x6df7a0dd
0x6df7a0dd
0x6df7a0e0
0x6df7a0e4
0x6df7a0f7
0x6df7a0f7
0x6df7a0fe
0x6df7a107
0x6df7a108
0x6df7a10c
0x6df7a10d
0x6df7a114
0x6dfb990b
0x6dfb9913
0x6dfb991b
0x6dfb991b
0x6dfb9913
0x6df7a11c
0x6df7a121
0x6df7a121
0x6df7a126
0x6df7a12a
0x6df7a12a
0x00000000
0x6df7a0e6
0x6df7a0e6
0x6df7a0ec
0x6df7a14d
0x6df7a150
0x6df7a152
0x6df7a153
0x6df7a154
0x6df7a155
0x6df7a156
0x6df7a157
0x6df7a158
0x6df7a159
0x6df7a15a
0x6df7a15b
0x6df7a15c
0x6df7a15d
0x6df7a15e
0x6df7a15f
0x6df7a170
0x6df7a172
0x6df7a179
0x6dfb9927
0x00000000
0x6dfb9936
0x6dfb993e
0x6dfb993e
0x6df7a17f
0x6df7a17f
0x6df7a17f
0x6df7a17f
0x6df7a182
0x6df7a0f2
0x6df7a0f2
0x6df7a0f4
0x00000000
0x6df7a0f4
0x6df7a0ec
0x6df7a0e4

APIs

RtlAcquireSRWLockExclusive.9419(6E0385EC,6E0201E0,0000001C,6DF43075,?,00000000,00008000), ref: 6DF7A0D4
ZwClose.9419(?,6E0201E0,0000001C,6DF43075,?,00000000,00008000), ref: 6DFB98ED

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLock
String ID:
API String ID: 1365838287-0
Opcode ID: 72dd52f68e42bc5736b5c26aac64b478c1e435396389e433471cfcc852f6671c
Instruction ID: 60f35bf9d59cef32c37129fb5975dab40e88d8fe44a6e05adc9df70e1df87d8b
Opcode Fuzzy Hash: 72dd52f68e42bc5736b5c26aac64b478c1e435396389e433471cfcc852f6671c
Instruction Fuzzy Hash: D421F472904606EBEB24CF6CE800FAA77F5AF04324F16856AD9189B280DB31C941CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6DF83FA0, Relevance: 3.1, APIs: 2, Instructions: 62
nativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E6DF83FA0(intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				void* _t7;
				intOrPtr _t8;
				intOrPtr* _t19;
				intOrPtr* _t24;
				intOrPtr* _t26;

				_t26 = _a4;
				if(_t26 == 0) {
					return 0xc00000ef;
				}
				_t19 = _a8;
				if(_t19 == 0) {
					_t7 = 0xc00000f0;
					L8:
					return _t7;
				}
				_t24 = _a12;
				if(_t24 == 0) {
					_t7 = 0xc00000f1;
					L7:
					goto L8;
				}
				_t8 =  *0x6e038648;
				if(_t8 != 0) {
					 *_t26 = _t8;
					 *_t19 =  *0x6e0384a0;
					 *_t24 =  *0x6e0384a8;
					 *((intOrPtr*)(_t24 + 4)) =  *0x6e0384ac;
					L6:
					_t7 = 0;
					goto L7;
				}
				_push(_t24);
				_push(_t19);
				_push(_t26);
				_t7 = E6DF8A480();
				if(_t7 < 0) {
					goto L7;
				}
				 *0x6e0384a0 =  *_t19;
				 *0x6e0384a8 =  *_t24;
				 *0x6e0384ac =  *((intOrPtr*)(_t24 + 4));
				asm("lock cmpxchg [edx], ecx");
				if(0 != 0) {
					_push( *_t26);
					_push(0xffffffff);
					E6DF897A0();
					 *_t26 =  *0x6e038648;
				}
				goto L6;
			}

0x6df83fa6
0x6df83fab
0x00000000
0x6dfbe7f5
0x6df83fb2
0x6df83fb7
0x6df84024
0x6df84004
0x00000000
0x6df84004
0x6df83fba
0x6df83fbf
0x6df8402b
0x6df84003
0x00000000
0x6df84003
0x6df83fc1
0x6df83fc8
0x6df8400a
0x6df84011
0x6df84018
0x6df8401f
0x6df84001
0x6df84001
0x00000000
0x6df84001
0x6df83fca
0x6df83fcb
0x6df83fcc
0x6df83fcd
0x6df83fd4
0x00000000
0x00000000
0x6df83fdf
0x6df83fe6
0x6df83fee
0x6df83ff5
0x6df83ffb
0x6dfbe7ff
0x6dfbe801
0x6dfbe803
0x6dfbe80d
0x6dfbe80d
0x00000000

APIs

ZwInitializeNlsFiles.9419(00000028,00000008,?,?,?,00000000,?,6DF83F28,00000000,6E0365D4,6DFA8546,?,00000008,00000028,?), ref: 6DF83FCD
ZwUnmapViewOfSection.9419(000000FF,00000028,00000028,00000008,?,?,?,00000000,?,6DF83F28,00000000,6E0365D4,6DFA8546,?,00000008,00000028), ref: 6DFBE803

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FilesInitializeSectionUnmapView
String ID:
API String ID: 146624528-0
Opcode ID: 1f2fe1fdee13dbef2ed65b5d3e2286510f7565c8c2969adf2ecb2a98387e9ece
Instruction ID: e090031fff192a90f3248fc31e32837a67e9be0306e72657bcee7cf3896d3c7c
Opcode Fuzzy Hash: 1f2fe1fdee13dbef2ed65b5d3e2286510f7565c8c2969adf2ecb2a98387e9ece
Instruction Fuzzy Hash: D81137712446539FDB21CE1ED880A17B7F9FB4E3247258069E914CB745E731D8408BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7DF4C, Relevance: 3.1, APIs: 2, Instructions: 62
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DF7DF4C(signed int __eax, void* __ecx, signed int* __edx, char _a4) {
				char _v8;
				signed int _v32;
				signed int _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v49;
				void* _v50;
				void* __ebx;
				void* __edi;
				intOrPtr* _t71;
				signed int _t74;
				signed int _t75;
				intOrPtr _t80;
				intOrPtr* _t81;
				signed int _t87;
				char _t92;
				signed int* _t99;
				signed int _t102;
				signed int _t104;
				unsigned int _t109;
				signed int _t113;
				signed int _t114;
				signed int _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				intOrPtr* _t119;
				char _t124;
				signed int _t125;
				signed int _t130;
				signed int _t132;
				void* _t134;
				signed int _t136;
				signed int _t137;
				intOrPtr* _t138;
				void* _t141;
				signed int _t144;
				signed int _t146;
				signed int _t150;
				void* _t152;

				_push(__ecx);
				_push(__ecx);
				_push(_t134);
				_t94 = __edx;
				_t141 = __ecx;
				asm("lock xadd [esi+0x2c], eax");
				if((__eax | 0xffffffff) == 1) {
					_t108 =  *((intOrPtr*)(__ecx + 0x28));
					if( *((intOrPtr*)(__ecx + 0x28)) != 0) {
						E6DF4A745(__edx, _t108, __edx, _t134);
					}
					_t71 = _t141 + 4;
					_t124 =  *_t71;
					if( *((intOrPtr*)(_t124 + 4)) != _t71) {
						L9:
						_t109 = 3;
						asm("int 0x29");
						_t152 = (_t150 & 0xfffffff8) - 0x1c;
						_v36 = _v36 & 0x00000000;
						_push(_t94);
						 *((char*)(_t152 + 0xb)) = _t124;
						 *(_t152 + 0x18) = _t109;
						_push(_t141);
						_push(_t134);
						_t99 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + ((_t109 >> 0x00000005 & 0x0000007f) + 0x97) * 4;
						_t74 = 0;
						_t125 =  *_t99;
						 *(_t152 + 0x1c) = _t99;
						 *(_t152 + 0x12) = 0;
						if(_t125 != 0) {
							while((_t125 & 0x00000001) == 0) {
								_t74 = _t125;
								if((_t125 & 0x00000002) != 0) {
									asm("lock cmpxchg [ebx], ecx");
									if(_t74 != _t125) {
										goto L40;
									}
								} else {
									_t144 = _t125 | 0x00000002;
									asm("lock cmpxchg [ebx], ecx");
									if(_t74 != _t125) {
										L40:
										_t125 = _t74;
										if(_t74 != 0) {
											continue;
										} else {
										}
									} else {
										while(1) {
											L14:
											_t102 = _t144 & 0xfffffffc;
											 *(_t152 + 0x24) = _t102;
											_t136 = _t102;
											if( *((intOrPtr*)(_t102 + 0x10)) == 0) {
												goto L42;
											}
											L15:
											_t137 =  *((intOrPtr*)(_t136 + 0x10));
											 *((intOrPtr*)(_t102 + 0x10)) = _t137;
											while(_t137 != 0) {
												_t130 =  *((intOrPtr*)(_t137 + 0xc));
												_v32 = _t130;
												if( *_t137 !=  *((intOrPtr*)(_t152 + 0x20))) {
													L46:
													_t137 = _t130;
													continue;
												} else {
													_t114 =  *(_t137 + 8);
													if(_t137 != _t102) {
														 *(_t130 + 8) = _t114;
														_t115 =  *(_t137 + 8);
														_t80 =  *((intOrPtr*)(_t137 + 0xc));
														if(_t115 != 0) {
															 *((intOrPtr*)(_t115 + 0xc)) = _t80;
														} else {
															 *((intOrPtr*)(_t102 + 0x10)) = _t80;
															 *((intOrPtr*)( *((intOrPtr*)(_t137 + 0xc)) + 0x10)) =  *((intOrPtr*)(_t137 + 0xc));
														}
														goto L23;
													} else {
														if(_t114 != 0) {
															_t114 = _t114 ^ (_t114 ^ _t144) & 0x00000003;
														}
														_t87 = _t144;
														asm("lock cmpxchg [ebx], edx");
														_t102 =  *(_t152 + 0x24);
														if(_t87 != _t144) {
															_t144 = _t87;
															goto L14;
														} else {
															_t132 =  *(_t137 + 8);
															_t118 = _t114 & 0xffffff00 | _t114 == 0x00000000;
															 *(_t152 + 0x12) = _t118;
															if(_t132 != 0) {
																 *(_t132 + 0xc) =  *(_t132 + 0xc) & 0x00000000;
																 *((intOrPtr*)(_t132 + 0x10)) =  *((intOrPtr*)(_t137 + 0x10));
																 *(_t152 + 0x12) = _t118;
															}
															_t130 = _v32;
															L23:
															_t116 = 2;
															_t41 = _t137 + 0x14; // 0x14
															_t81 = _t41;
															_t117 =  *_t81;
															 *_t81 = _t116;
															if(_t117 == 2) {
																goto L46;
															} else {
																if(_t117 == 0) {
																	 *(_t137 + 8) = _v36;
																	_v36 = _t137;
																}
																if( *((char*)(_t152 + 0x13)) != 0) {
																	goto L46;
																}
															}
														}
													}
												}
												break;
											}
											_t74 = _v36;
											if(_t74 != 0) {
												do {
													_push( *((intOrPtr*)(_t74 + 4)));
													_t146 =  *(_t74 + 8);
													E6DF89BF0();
													_t74 = _t146;
												} while (_t146 != 0);
											}
											if( *(_t152 + 0x12) == 0) {
												_t113 =  *( *(_t152 + 0x1c));
												while(1) {
													_t104 = _t113 & 0x00000001;
													asm("sbb edx, edx");
													_t74 = _t113;
													asm("lock cmpxchg [esi], edx");
													if(_t74 == _t113) {
														break;
													}
													_t113 = _t74;
												}
												if(_t104 != 0) {
													_t74 = E6DFFCF30(_t74);
												}
											}
											goto L30;
											do {
												L42:
												_t75 = _t136;
												_t136 =  *(_t136 + 8);
												 *(_t136 + 0xc) = _t75;
											} while ( *((intOrPtr*)(_t136 + 0x10)) == 0);
											goto L15;
										}
									}
								}
								goto L30;
							}
						}
						L30:
						return _t74;
					} else {
						_t119 =  *((intOrPtr*)(_t71 + 4));
						if( *_t119 != _t71) {
							goto L9;
						} else {
							 *_t119 = _t124;
							 *((intOrPtr*)(_t124 + 4)) = _t119;
							_t138 =  *((intOrPtr*)(_t141 + 0x30));
							 *_t94 =  *((intOrPtr*)(_t141 + 0x38));
							 *_a4 =  *((intOrPtr*)(_t141 + 0x3c));
							_t92 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t141);
							if(_t138 != 0) {
								 *_t138 = 1;
								_t92 =  &_v8;
								asm("lock or [eax], ecx");
								_push(0);
								L10();
							}
							goto L2;
						}
					}
				} else {
					_t92 = _a4;
					 *__edx =  *__edx & 0x00000000;
					 *_t92 =  *_t92 & 0x00000000;
					L2:
					return _t92;
				}
			}

0x6df7df51
0x6df7df52
0x6df7df55
0x6df7df56
0x6df7df58
0x6df7df5d
0x6df7df63
0x6df7df77
0x6df7df7c
0x6df7dfd3
0x6df7dfd3
0x6df7df7e
0x6df7df81
0x6df7df86
0x6df7dfda
0x6df7dfdc
0x6df7dfdd
0x6df7dfe7
0x6df7dff0
0x6df7dff5
0x6df7dff8
0x6df7e005
0x6df7e00f
0x6df7e010
0x6df7e011
0x6df7e014
0x6df7e016
0x6df7e018
0x6df7e01c
0x6df7e022
0x6df7e028
0x6df7e031
0x6df7e036
0x6dfbb47d
0x6dfbb483
0x00000000
0x00000000
0x6df7e03c
0x6df7e03e
0x6df7e043
0x6df7e049
0x6dfbb489
0x6dfbb489
0x6dfbb48d
0x00000000
0x00000000
0x6dfbb493
0x00000000
0x6df7e04f
0x6df7e04f
0x6df7e051
0x6df7e054
0x6df7e058
0x6df7e05e
0x00000000
0x00000000
0x6df7e064
0x6df7e064
0x6df7e067
0x6df7e06a
0x6df7e076
0x6df7e079
0x6df7e07f
0x6dfbb4cc
0x6dfbb4cc
0x00000000
0x6df7e085
0x6df7e085
0x6df7e08a
0x6df7e11c
0x6df7e11f
0x6df7e122
0x6df7e127
0x6df7e164
0x6df7e129
0x6df7e129
0x6df7e12f
0x6df7e12f
0x00000000
0x6df7e090
0x6df7e092
0x6dfbb4b2
0x6dfbb4b2
0x6df7e09e
0x6df7e0a0
0x6df7e0a4
0x6df7e0aa
0x6dfbb4d3
0x00000000
0x6df7e0b0
0x6df7e0b0
0x6df7e0b5
0x6df7e0b8
0x6df7e0be
0x6dfbb4b9
0x6dfbb4c0
0x6dfbb4c3
0x6dfbb4c3
0x6df7e0c4
0x6df7e0c8
0x6df7e0ca
0x6df7e0cb
0x6df7e0cb
0x6df7e0ce
0x6df7e0ce
0x6df7e0d3
0x00000000
0x6df7e0d9
0x6df7e0db
0x6df7e0e1
0x6df7e0e4
0x6df7e0e4
0x6df7e0ed
0x00000000
0x00000000
0x6df7e0ed
0x6df7e0d3
0x6df7e0aa
0x6df7e08a
0x00000000
0x6df7e07f
0x6df7e0f3
0x6df7e0f9
0x6df7e0fb
0x6df7e0fb
0x6df7e0fe
0x6df7e101
0x6df7e106
0x6df7e108
0x6df7e0fb
0x6df7e111
0x6df7e138
0x6df7e13a
0x6df7e13e
0x6df7e148
0x6df7e14e
0x6df7e150
0x6df7e156
0x00000000
0x00000000
0x6df7e16c
0x6df7e16c
0x6df7e15a
0x6df7e15d
0x6df7e15d
0x6df7e15a
0x00000000
0x6dfbb498
0x6dfbb498
0x6dfbb498
0x6dfbb49a
0x6dfbb49d
0x6dfbb4a0
0x00000000
0x6dfbb4a6
0x6df7e04f
0x6df7e049
0x00000000
0x6df7e036
0x6df7e028
0x6df7e113
0x6df7e119
0x6df7df88
0x6df7df88
0x6df7df8d
0x00000000
0x6df7df8f
0x6df7df8f
0x6df7df91
0x6df7df97
0x6df7df9a
0x6df7dfa5
0x6df7dfb0
0x6df7dfb7
0x6df7dfb9
0x6df7dfbf
0x6df7dfc4
0x6df7dfc7
0x6df7dfcc
0x6df7dfcc
0x00000000
0x6df7dfb7
0x6df7df8d
0x6df7df65
0x6df7df65
0x6df7df68
0x6df7df6b
0x6df7df6e
0x6df7df74
0x6df7df74

APIs

RtlFreeHeap.9419(?,00000000,?,00000000,?,?,?,?,?,6DF43DAD,?,00000000,6E01F4D0,00000084,6DF43A18,00000000), ref: 6DF7DFB0
RtlWakeAddressAllNoFence.9419(00000000), ref: 6DF7DFCC

Part of subcall function 6DF4A745: RtlAcquireSRWLockExclusive.9419(?,?,00000000,?,6DF7DFD8,00000000,?,?,?,?,?,6DF43DAD,?,00000000,6E01F4D0,00000084), ref: 6DF4A757
Part of subcall function 6DF4A745: RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,6DF7DFD8,00000000,?,?,?,?,?,6DF43DAD,?,00000000,6E01F4D0), ref: 6DF4A774

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAddressFenceFreeHeapReleaseWake
String ID:
API String ID: 4187599678-0
Opcode ID: eb68034816a1b22d4d42b68bfa87daaead973648ca8f5c3e9f107cae683dcf72
Instruction ID: 83e15ea9da0830954939f17a288e19f1fc2821d3e29af50f48fefe06d1877610
Opcode Fuzzy Hash: eb68034816a1b22d4d42b68bfa87daaead973648ca8f5c3e9f107cae683dcf72
Instruction Fuzzy Hash: 5811BE72205641DFC329CF18D950BA2B7FAFF89320F41816AE5098B6A0E770EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4B6F0, Relevance: 3.1, APIs: 2, Instructions: 62
nativeCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E6DF4B6F0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short _a16) {
				signed int _v8;
				char _v20;
				char _v40;
				short _v44;
				intOrPtr _v48;
				short _v50;
				char _v52;
				void* _v68;
				void* _v92;
				short _v128;
				char _v132;
				void* __edi;
				void* __esi;
				long _t19;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t31;
				intOrPtr _t36;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0x80;
				_v8 =  *0x6e03d360 ^ (_t39 & 0xfffffff8) - 0x00000080;
				_t26 = _a4;
				_t29 = _a16;
				if(_a8 == 0 || _t26 == 0) {
					_t19 = 0x57;
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v128 = 0;
					_v48 = _a12;
					_v44 = _t29;
					_t29 = 0;
					_v40 = 0;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v52 = 0;
					_v20 = 0;
					_push( &_v132);
					_push(0x78);
					_push(0x700);
					_push(_t26);
					_v50 = 0;
					_t19 = E6DF89AE0();
					if(_t19 != 0) {
						_t19 = RtlNtStatusToDosError(_t19);
					}
				}
				_pop(_t31);
				_pop(_t36);
				return E6DF8B640(_t19, _t25, _v8 ^ _t41, _t29, _t31, _t36);
			}

0x6df4b6f8
0x6df4b705
0x6df4b709
0x6df4b70c
0x6df4b716
0x6df4b795
0x6df4b71c
0x6df4b722
0x6df4b723
0x6df4b724
0x6df4b725
0x6df4b731
0x6df4b73e
0x6df4b744
0x6df4b748
0x6df4b74a
0x6df4b74e
0x6df4b74f
0x6df4b750
0x6df4b751
0x6df4b752
0x6df4b756
0x6df4b75e
0x6df4b75f
0x6df4b761
0x6df4b766
0x6df4b767
0x6df4b76c
0x6df4b773
0x6df4b78c
0x6df4b78c
0x6df4b773
0x6df4b77c
0x6df4b77d
0x6df4b788

APIs

ZwTraceEvent.9419(?,00000700,00000078,?,?,00000000), ref: 6DF4B76C
RtlNtStatusToDosError.9419(00000000,?,00000700,00000078,?,?,00000000), ref: 6DF4B78C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorEventStatusTrace
String ID:
API String ID: 1132987938-0
Opcode ID: 4edc256df172f193992f0573017ddd80f91b3e596d12c3d32940daee0ed2698d
Instruction ID: af3b2aadacef138f39bd5e506b9542e3faecb963fe92c8edeed623ff81d56aa8
Opcode Fuzzy Hash: 4edc256df172f193992f0573017ddd80f91b3e596d12c3d32940daee0ed2698d
Instruction Fuzzy Hash: 87119132508B469BD711CF289840A5F7BE5BF89310F01C929FE99DB251E7B1E8008B92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5FC01, Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6DF5FC01(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t22;
				char* _t23;
				signed char* _t30;
				char _t37;
				void* _t44;
				intOrPtr _t46;
				void* _t47;

				_push(0x14);
				_push(0x6e01fbd0);
				E6DF9D08C(__ebx, __edi, __esi);
				_t46 = __edx;
				 *((intOrPtr*)(_t47 - 0x20)) = __edx;
				_t44 = __ecx;
				_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t22 != 0) {
					if( *_t22 == 0) {
						goto L1;
					}
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					L2:
					if( *_t23 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L3;
						}
						if(E6DF67D50() == 0) {
							_t30 = 0x7ffe0385;
						} else {
							_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t30 & 0x00000020) == 0) {
							goto L3;
						}
						_t37 = 0;
						L6DFC7016(0x14a3, _t46, 0,  *((intOrPtr*)(_t47 + 8)), 0, 0);
						L4:
						 *((char*)(_t47 - 0x19)) = _t37;
						 *((intOrPtr*)(_t47 - 4)) = _t37;
						 *((intOrPtr*)(_t47 - 0x24)) = 1;
						L6DF8B7CD();
						 *((char*)(_t47 - 0x19)) = E6DF894B0(_t44, _t46,  *((intOrPtr*)(_t47 + 8)),  *((intOrPtr*)(_t47 + 0xc)));
						 *((intOrPtr*)(_t47 - 4)) = 0xfffffffe;
						 *((intOrPtr*)(_t47 - 0x24)) = 0;
						E6DF5FC77(_t37, _t46);
						return E6DF9D0D1( *((intOrPtr*)(_t47 - 0x19)));
					}
					L3:
					_t37 = 0;
					goto L4;
				}
				L1:
				_t23 = 0x7ffe0384;
				goto L2;
			}

0x6df5fc01
0x6df5fc03
0x6df5fc08
0x6df5fc0d
0x6df5fc0f
0x6df5fc12
0x6df5fc1a
0x6df5fc1f
0x6dfabe4d
0x00000000
0x00000000
0x6dfabe5c
0x6df5fc2a
0x6df5fc2d
0x6dfabe73
0x00000000
0x00000000
0x6dfabe80
0x6dfabe92
0x6dfabe82
0x6dfabe8b
0x6dfabe8b
0x6dfabe9a
0x00000000
0x00000000
0x6dfabea0
0x6dfabeaf
0x6df5fc35
0x6df5fc35
0x6df5fc38
0x6df5fc3b
0x6df5fc44
0x6df5fc56
0x6df5fc59
0x6df5fc60
0x6df5fc67
0x6df5fc74
0x6df5fc74
0x6df5fc33
0x6df5fc33
0x00000000
0x6df5fc33
0x6df5fc25
0x6df5fc25
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1629e2284e64f04d1e1797a593a9abeaaa5d5b269e97e155c3299b72fc02c407
Instruction ID: 87ad8a49b191a8a4329740005de8e5bff0409432be9e91e65d5a01c1e5649545
Opcode Fuzzy Hash: 1629e2284e64f04d1e1797a593a9abeaaa5d5b269e97e155c3299b72fc02c407
Instruction Fuzzy Hash: C821063160468ADFE712CF9CC894BAD7BB4FF15748F0544A4EA049B7A1C7348E10C762

Uniqueness

Uniqueness Score: -1.00%

Function 6DF42ED8, Relevance: 3.1, APIs: 2, Instructions: 59
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DF42ED8(intOrPtr __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				signed int _t12;
				intOrPtr* _t20;
				intOrPtr _t23;
				void* _t28;
				intOrPtr* _t30;
				signed int _t33;
				intOrPtr _t36;

				_push(__ecx);
				_t30 = __edx;
				_v8 = __ecx;
				if( *0x7ffe036a <= 1) {
					L2:
					_t20 = _t30 + 0x14;
					asm("lock btr dword [ebx], 0x0");
					if(_t36 >= 0) {
						_t12 = 0;
					} else {
						_push(_a4);
						_push( *_t30);
						_t33 = E6DF8B180();
						if(_t33 == 0x102) {
							_t23 = 4;
							 *_t20 = _t23;
							if( *_t20 != 2) {
								E6DF7E2BB(_v8, _t30);
							} else {
								_push(0);
								_push( *_t30);
								_t33 = E6DF8B180();
							}
						}
						_t5 = _t33 - 0x101; // -257
						asm("sbb eax, eax");
						_t12 =  ~_t5 & _t33;
					}
					L6:
					return _t12;
				}
				_t28 = 0;
				_t36 = _a8;
				if(_t36 > 0) {
					while(( *(_t30 + 0x14) & 0x00000001) != 0) {
						asm("pause");
						_t28 = _t28 + 1;
						if(_t28 < _a8) {
							continue;
						}
						goto L2;
					}
					_t12 = 0;
					goto L6;
				}
				goto L2;
			}

0x6df42edd
0x6df42ee7
0x6df42ee9
0x6df42eec
0x6df42ef5
0x6df42ef6
0x6df42ef9
0x6df42efe
0x6df42f43
0x6df42f00
0x6df42f01
0x6df42f04
0x6df42f0b
0x6df42f13
0x6df9fb2d
0x6df9fb2e
0x6df9fb33
0x6df9fb4a
0x6df9fb35
0x6df9fb35
0x6df9fb37
0x6df9fb3e
0x6df9fb3e
0x6df9fb33
0x6df42f19
0x6df42f21
0x6df42f23
0x6df42f25
0x6df42f27
0x6df42f2b
0x6df42f2b
0x6df42eee
0x6df42ef0
0x6df42ef3
0x6df42f2e
0x6df42f35
0x6df42f37
0x6df42f3b
0x00000000
0x00000000
0x00000000
0x6df42f3d
0x6df42f3f
0x00000000
0x6df42f3f
0x00000000

APIs

ZwWaitForAlertByThreadId.9419(?,-00000001,?,00000001,?,?,?,6DFBB59C,00000000,0000000A,-00000001,00000000,?,?,00000000,?), ref: 6DF42F06

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlertThreadWait
String ID:
API String ID: 2760959157-0
Opcode ID: 633e11130d8cc3b5c9424e1a96c0f5419c8dbbe88a3093266db12018ed7ebb6a
Instruction ID: ca6968dda8b77f20c50771bf5c1aa5aecfa6e80ebebbd18515ad4dcb552f7a35
Opcode Fuzzy Hash: 633e11130d8cc3b5c9424e1a96c0f5419c8dbbe88a3093266db12018ed7ebb6a
Instruction Fuzzy Hash: 11112532B5801AFAD732CE2CC840AA6BBA6FF46360F60C075E504DB151E7779940C691

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8B640, Relevance: 3.1, APIs: 2, Instructions: 57
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6DF8B640(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				intOrPtr _t12;
				signed int _t13;
				signed int _t15;
				signed int _t17;
				intOrPtr* _t29;
				intOrPtr* _t31;

				if(__ecx !=  *0x6e03d360) {
					_t29 = _t31;
					_push(__ecx);
					_push(__ecx);
					 *0x6e035e88 = __eax;
					 *0x6e035e84 = __ecx;
					 *0x6e035e80 = __edx;
					 *0x6e035e7c = __ebx;
					 *0x6e035e78 = __esi;
					 *0x6e035e74 = __edi;
					 *0x6e035ea0 = ss;
					 *0x6e035e94 = cs;
					 *0x6e035e70 = ds;
					 *0x6e035e6c = es;
					 *0x6e035e68 = fs;
					 *0x6e035e64 = gs;
					asm("pushfd");
					_pop( *0x6e035e98);
					 *0x6e035e8c =  *_t29;
					 *0x6e035e90 = _v0;
					 *0x6e035e9c =  &_a4;
					 *0x6e035dd8 = 0x10001;
					_t12 =  *0x6e035e90; // 0x0
					 *0x6e035d94 = _t12;
					 *0x6e035d88 = 0xc0000409;
					 *0x6e035d8c = 1;
					 *0x6e035d98 = 1;
					_t13 = 4;
					 *((intOrPtr*)(0x6e035d9c + _t13 * 0)) = 2;
					_t15 = 4;
					 *((intOrPtr*)(_t29 + _t15 * 0 - 8)) =  *0x6e03d360;
					_t17 = 4;
					 *((intOrPtr*)(_t29 + (_t17 << 0) - 8)) =  *0x6e03d364;
					E6DFFB590(0x6df21650);
					_push(0xc0000409);
					_push(0xffffffff);
					return E6DF897C0();
				} else {
					return __eax;
				}
			}

0x6df8b646
0x6df8b66e
0x6df8b670
0x6df8b671
0x6df8b672
0x6df8b677
0x6df8b67d
0x6df8b683
0x6df8b689
0x6df8b68f
0x6df8b695
0x6df8b69c
0x6df8b6a3
0x6df8b6aa
0x6df8b6b1
0x6df8b6b8
0x6df8b6bf
0x6df8b6c0
0x6df8b6c9
0x6df8b6d1
0x6df8b6d9
0x6df8b6de
0x6df8b6e8
0x6df8b6ed
0x6df8b6f2
0x6df8b6fc
0x6df8b706
0x6df8b712
0x6df8b716
0x6df8b722
0x6df8b72c
0x6df8b732
0x6df8b73c
0x6df8b745
0x6df8b74a
0x6df8b74f
0x6df8b759
0x6df8b648
0x6df8b648
0x6df8b648

APIs

RtlUnhandledExceptionFilter.9419(6DF21650,6DF8B627,6DF8B627,?,6DF9D13A,6DF4B1DE,6E01F7A8,00000090,6DF4B16E,00000003,6DF8B627,0000000A,00000001,00000000,0000000A,6DF8B627), ref: 6DF8B745
ZwTerminateProcess.9419(000000FF,C0000409,6DF21650,6DF8B627,6DF8B627,?,6DF9D13A,6DF4B1DE,6E01F7A8,00000090,6DF4B16E,00000003,6DF8B627,0000000A,00000001,00000000), ref: 6DF8B751

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessTerminateUnhandled
String ID:
API String ID: 2272017760-0
Opcode ID: 172af53d52a127c73d4e77d8c8915d7a4831a9b23d1a3a7bb6ec8a37197271ea
Instruction ID: 7477c7f3717734690168b79163cec0c7c1b57b69ec0b955f3c8ccf839e963672
Opcode Fuzzy Hash: 172af53d52a127c73d4e77d8c8915d7a4831a9b23d1a3a7bb6ec8a37197271ea
Instruction Fuzzy Hash: 9C2122BE414B069EEB28CF18D586A047BB4FB4B324F24452BE5088B3B4E3B19880CF45

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44CB0, Relevance: 3.1, APIs: 2, Instructions: 56
memoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DF44CB0(void* __ecx, intOrPtr _a4, intOrPtr _a8, signed int _a12, void* _a16) {
				int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t21;
				intOrPtr _t22;
				void* _t26;
				void* _t32;
				void* _t34;
				long _t36;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t41;

				_t35 = __ecx;
				_push(__ecx);
				_push(_t32);
				_t41 = _a4;
				_push(_t38);
				if(_t41 == 0) {
					L8:
					E6E0188F5(_t32, _t35, _t37, _t38, _t41, __eflags);
					_t21 = 0xc000000d;
					L6:
					return _t21;
				}
				_t22 =  *((intOrPtr*)(_t41 + 0x4c));
				if(_t22 == 0) {
					goto L8;
				}
				_t38 = _a8;
				if( *((intOrPtr*)(_t22 + 0xa8)) != _t38 || ( *(_t41 + 0x84) & 0x00000001) != 0) {
					goto L8;
				} else {
					_t34 = _a16;
					_t36 =  *(_t34 + 2) & 0x0000ffff;
					_v8 = _t36;
					_t26 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6e0384c4 + 0x80000, _t36);
					 *(_t41 + 0x78) = _t26;
					if(_t26 == 0) {
						_t21 = 0xc0000017;
					} else {
						memcpy(_t26, _t34, _v8);
						 *((intOrPtr*)(_t41 + 0x7c)) = _t38;
						asm("lock inc dword [eax]");
						 *(_t41 + 0x84) =  *(_t41 + 0x84) | 0x00000001;
						 *(_t41 + 0x80) = _a12 | 0x00040000;
						_t21 = 0;
					}
					goto L6;
				}
			}

0x6df44cb0
0x6df44cb5
0x6df44cb6
0x6df44cb8
0x6df44cbb
0x6df44cbe
0x6df44d50
0x6df44d50
0x6df44d55
0x6df44d40
0x6df44d46
0x6df44d46
0x6df44cc4
0x6df44cc9
0x00000000
0x00000000
0x6df44ccf
0x6df44cd8
0x00000000
0x6df44ce3
0x6df44ce3
0x6df44cf0
0x6df44cfc
0x6df44d02
0x6df44d07
0x6df44d0c
0x6df44d49
0x6df44d0e
0x6df44d13
0x6df44d18
0x6df44d26
0x6df44d2c
0x6df44d38
0x6df44d3e
0x6df44d3e
0x00000000
0x6df44d0c

APIs

RtlAllocateHeap.9419(?,?,?), ref: 6DF44D02
memcpy.9419(00000000,?,?), ref: 6DF44D13

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapmemcpy
String ID:
API String ID: 1925790395-0
Opcode ID: 9c3b2b8641bd05d1a868a851770d6745f753866320d8929546f5a6b23dca7caa
Instruction ID: f3edc9ff8fbd0d520babe00a4575f6251b4c9ac6dbfe125d3ea1613b41cc3144
Opcode Fuzzy Hash: 9c3b2b8641bd05d1a868a851770d6745f753866320d8929546f5a6b23dca7caa
Instruction Fuzzy Hash: 5611A072604605AFE712CF5DD841BA77BF8FF49314F018469EAA9DB212DB71EC408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD2E14, Relevance: 3.1, APIs: 2, Instructions: 51
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6DFD2E14(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				signed char* _t27;
				void* _t33;
				intOrPtr _t35;
				void* _t42;
				intOrPtr _t44;
				void* _t45;
				intOrPtr _t47;
				signed int _t48;

				_v8 =  *0x6e03d360 ^ _t48;
				_v20 = __ecx;
				_v66 = 0xd22;
				_t41 = _a24;
				_v40 = _a20;
				_v16 = _a12;
				_v36 = _a24;
				_v32 = __edx;
				_v28 = _a4;
				_v24 = _a8;
				_v12 = _a16;
				_t26 = E6DF67D50();
				_t44 = _t42;
				_t47 = _t45;
				_t35 = _t33;
				if(_t26 == 0) {
					_t27 = 0x7ffe038e;
				} else {
					_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
				}
				_push( &_v72);
				_push(0x20);
				_push(0x20402);
				_push( *_t27 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t35, _v8 ^ _t48, _t41, _t44, _t47);
			}

0x6dfd2e23
0x6dfd2e2c
0x6dfd2e2f
0x6dfd2e38
0x6dfd2e3f
0x6dfd2e49
0x6dfd2e4f
0x6dfd2e52
0x6dfd2e55
0x6dfd2e58
0x6dfd2e5b
0x6dfd2e5e
0x6dfd2e63
0x6dfd2e64
0x6dfd2e65
0x6dfd2e68
0x6dfd2e7a
0x6dfd2e6a
0x6dfd2e73
0x6dfd2e73
0x6dfd2e85
0x6dfd2e86
0x6dfd2e88
0x6dfd2e8d
0x6dfd2ea0

APIs

RtlGetCurrentServiceSessionId.9419(00000000,?,?), ref: 6DFD2E5E
ZwTraceEvent.9419(?,00020402,00000020,?), ref: 6DFD2E8E

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: b1866f900269f1fcec96861bc7c4cb599492459272c0fb78f7178db56de93428
Instruction ID: 6e77ee36908055510e917612d774cde4cba495bcf484b3b08703883c0360ccd3
Opcode Fuzzy Hash: b1866f900269f1fcec96861bc7c4cb599492459272c0fb78f7178db56de93428
Instruction Fuzzy Hash: DA110AB1A002199FCB00DF9DC541AAEB7B4FF48340F10406AF905E7351D634AE01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6E01F13B, Relevance: 3.0, APIs: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.9419(?,02000000,?,?,02000000,00000000), ref: 6E01F182
ZwCreateKey.9419(?,02000000,00000018,00000000,00000000,00000000,6E01F056), ref: 6E01F19F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: b48985ecd78a2887d5ad7a8519b875d9000acacac0a11861ac442c6c79285e06
Instruction ID: 4009f4bad23d9eb0df3227d2758bef5af052e20bc0756cb502a8033d9a07a9d2
Opcode Fuzzy Hash: b48985ecd78a2887d5ad7a8519b875d9000acacac0a11861ac442c6c79285e06
Instruction Fuzzy Hash: 1F014C71A0524AAFEB109ED9C844FFFBBBCEF85311F10802AB814E7200D73089048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF495F0, Relevance: 3.0, APIs: 2, Instructions: 47
nativeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6DF495F0(intOrPtr _a4, char _a8) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t10;
				void* _t17;
				void* _t18;
				char* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				intOrPtr _t29;

				_t29 = _a4;
				_push(_t25);
				if(_t29 == 0 || _a8 < 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E6E0188F5(_t17, _t18, _t23, _t25, _t29, __eflags);
					_t10 = 0xc000000d;
				} else {
					_push(4);
					_push( &_a8);
					_push(4);
					_push( *((intOrPtr*)(_t29 + 0x24)));
					_t27 = E6DF8AE70();
					if(E6DF67D50() != 0) {
						_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t21 = 0x7ffe0386;
					}
					if( *_t21 != 0) {
						__eflags = _t27;
						if(_t27 >= 0) {
							E6E018C75(_t29, _a8);
						}
					}
					_t10 = _t27;
				}
				return _t10;
			}

0x6df495f9
0x6df495fc
0x6df495ff
0x6df4964d
0x6df49652
0x6df49616
0x6df49616
0x6df4961b
0x6df4961c
0x6df4961e
0x6df49626
0x6df4962f
0x6dfa3a8b
0x6df49635
0x6df49635
0x6df49635
0x6df4963d
0x6dfa3a96
0x6dfa3a98
0x6dfa3aa3
0x6dfa3aa3
0x6dfa3a98
0x6df49643
0x6df49643
0x6df4964a

APIs

ZwSetInformationWorkerFactory.9419(?,00000004,00000000,00000004,00000000,?,?,6DF6F9CB,00000000,00000001,00000000,00000001,?,00000000,00000000), ref: 6DF49621
RtlGetCurrentServiceSessionId.9419(?,00000004,00000000,00000004,00000000,?,?,6DF6F9CB,00000000,00000001,00000000,00000001,?,00000000,00000000), ref: 6DF49628

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFactoryInformationServiceSessionWorker
String ID:
API String ID: 2490488586-0
Opcode ID: b99ca973338ded875cf695b9a21ffe936fa816212ff8a6ca1792bfe0ad1d1fa1
Instruction ID: 2f8e8a59f8af5ddb3137253a003e4c113f1933cc7a902fe766843265b7f704ea
Opcode Fuzzy Hash: b99ca973338ded875cf695b9a21ffe936fa816212ff8a6ca1792bfe0ad1d1fa1
Instruction Fuzzy Hash: 9701F776B19644EBD7118B9CCA00F6537A9AB81738F14C15DEE148F291DF34ED808799

Uniqueness

Uniqueness Score: -1.00%

Function 6E018966, Relevance: 3.0, APIs: 2, Instructions: 46
nativeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6E018966(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t21;
				signed int _t35;

				_t32 = __edx;
				_v8 =  *0x6e03d360 ^ _t35;
				_t34 = _a8;
				_t33 = _a12;
				_v28 = _a4;
				_v62 = 0x1c24;
				_v36 = __ecx;
				_v32 = __edx;
				_v24 = _a8;
				_v20 = _a12;
				_v16 = _a16;
				if(E6DF67D50() == 0) {
					_t21 = 0x7ffe0386;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x18);
				_push(0x403);
				_push( *_t21 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), 0x1c24, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x6e018966
0x6e018975
0x6e01897d
0x6e018986
0x6e018989
0x6e01898f
0x6e018993
0x6e018996
0x6e018999
0x6e01899c
0x6e01899f
0x6e0189a9
0x6e0189bb
0x6e0189ab
0x6e0189b4
0x6e0189b4
0x6e0189c6
0x6e0189c7
0x6e0189c9
0x6e0189ce
0x6e0189e4

APIs

RtlGetCurrentServiceSessionId.9419(00000000,?), ref: 6E0189A2
ZwTraceEvent.9419(?,00000403,00000018,?,00000000,?), ref: 6E0189CF

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 566e2c8fb706831a5193bc8a84b611018489abd413fbd881614698f3b8bb89b3
Instruction ID: 8260a9c1e6519ac9c7d096086cc396cb9dc1cddd69e2dbe926488bfcec51587c
Opcode Fuzzy Hash: 566e2c8fb706831a5193bc8a84b611018489abd413fbd881614698f3b8bb89b3
Instruction Fuzzy Hash: 670129B1A0421DABDB00CFA9D8419EEB7F8FF49304F10445AE901EB341D7749A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E018ED6, Relevance: 3.0, APIs: 2, Instructions: 44
nativeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6E018ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x6e03d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E6DF67D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x6e018ed6
0x6e018ee5
0x6e018eed
0x6e018ef0
0x6e018efa
0x6e018f03
0x6e018f0c
0x6e018f15
0x6e018f24
0x6e018f27
0x6e018f31
0x6e018f43
0x6e018f33
0x6e018f3c
0x6e018f3c
0x6e018f4e
0x6e018f4f
0x6e018f51
0x6e018f56
0x6e018f69

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,?,?,?,?,?,?,?,?,6DFB3B1B,?,?,?), ref: 6E018F2A
ZwTraceEvent.9419(?,00020402,0000001C,?), ref: 6E018F57

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 5f05e28a545910c4dbafebfadb920e78a0f3494748e81cc2c6a627b3ab0f3454
Instruction ID: ab64d13fa132c05bb2c533f3d7ac8e6b35cd9cc36d561c3c3b7a6152d6884fbd
Opcode Fuzzy Hash: 5f05e28a545910c4dbafebfadb920e78a0f3494748e81cc2c6a627b3ab0f3454
Instruction Fuzzy Hash: FB110C70A042499FDB04DFA9C441BAEB7F4FB08304F0442AAE919EB782E7349A40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E019CB3, Relevance: 3.0, APIs: 2, Instructions: 44
nativeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6E019CB3(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x6e03d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c22;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E6DF67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), 0x1c22, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x6e019cb3
0x6e019cc2
0x6e019cca
0x6e019cd3
0x6e019cd6
0x6e019cda
0x6e019cdd
0x6e019ce0
0x6e019ce3
0x6e019ce6
0x6e019cf0
0x6e019d02
0x6e019cf2
0x6e019cfb
0x6e019cfb
0x6e019d0d
0x6e019d0e
0x6e019d10
0x6e019d15
0x6e019d2b

APIs

RtlGetCurrentServiceSessionId.9419(?,?,7FFE0386,?,?,?,?,?,?,?,?,?,?,6DFA1AF4,?,?), ref: 6E019CE9
ZwTraceEvent.9419(?,00000402,00000014,?,?,?,7FFE0386), ref: 6E019D16

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: f997fdb23133ba0b086021a3475385ee90584b234d3139fce2f48148911c2379
Instruction ID: 0240d38e0ee905e709942233d996c78bf40be84e44cdcbaa067b578978b56033
Opcode Fuzzy Hash: f997fdb23133ba0b086021a3475385ee90584b234d3139fce2f48148911c2379
Instruction Fuzzy Hash: EA011E71A05219AFDB00DFA9D941AEEB7B8EF49314F51405AFA05EB351D734AD00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E018A62, Relevance: 3.0, APIs: 2, Instructions: 44
nativeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6E018A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x6e03d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E6DF67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x6e018a62
0x6e018a71
0x6e018a79
0x6e018a82
0x6e018a85
0x6e018a89
0x6e018a8c
0x6e018a8f
0x6e018a92
0x6e018a95
0x6e018a9f
0x6e018ab1
0x6e018aa1
0x6e018aaa
0x6e018aaa
0x6e018abc
0x6e018abd
0x6e018abf
0x6e018ac4
0x6e018ada

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,?,?,?,?,?,?,?,?,6DFB971E,?,?,?), ref: 6E018A98
ZwTraceEvent.9419(?,00020402,00000014,?,?,?,?), ref: 6E018AC5

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 2410e05572cc53d9e69e2c6ea3e0d79140991863f94263926ddced4128136df2
Instruction ID: b47c95e3198ea7cd11b84a1558aad536441cb1aeeb5cfeeb279992e5c9df0041
Opcode Fuzzy Hash: 2410e05572cc53d9e69e2c6ea3e0d79140991863f94263926ddced4128136df2
Instruction Fuzzy Hash: D2012171A0421DAFDB00DFA9D9419EEB7B8EF49354F50405AFA05EB351D734AE00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E018ADD, Relevance: 3.0, APIs: 2, Instructions: 44
nativeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6E018ADD(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x6e03d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c23;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E6DF67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x403);
				_push( *_t18 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), 0x1c23, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x6e018add
0x6e018aec
0x6e018af4
0x6e018afd
0x6e018b00
0x6e018b04
0x6e018b07
0x6e018b0a
0x6e018b0d
0x6e018b10
0x6e018b1a
0x6e018b2c
0x6e018b1c
0x6e018b25
0x6e018b25
0x6e018b37
0x6e018b38
0x6e018b3a
0x6e018b3f
0x6e018b55

APIs

RtlGetCurrentServiceSessionId.9419(?,?,7FFE0386,?,?,?,?,?,?,?,?,?,?,?,6DFA1B21,?), ref: 6E018B13
ZwTraceEvent.9419(?,00000403,00000014,?,?,?,7FFE0386), ref: 6E018B40

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: f12957819e80d7760da01f8ac6d82c6d03de43873fab6985e855f2af3beb1358
Instruction ID: a2d8156481a6e64c6a5fa6dfa008625ec9a6447e01cb750d5b445735a9afb4ab
Opcode Fuzzy Hash: f12957819e80d7760da01f8ac6d82c6d03de43873fab6985e855f2af3beb1358
Instruction Fuzzy Hash: 4D015EB1A04209AFDB00CFA9D8819EEB7B8FF48300F10005AF900EB340D734AA00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E0189E7, Relevance: 3.0, APIs: 2, Instructions: 44
nativeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6E0189E7(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x6e03d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c21;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E6DF67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x403);
				_push( *_t18 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), 0x1c21, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x6e0189e7
0x6e0189f6
0x6e0189fe
0x6e018a07
0x6e018a0a
0x6e018a0e
0x6e018a11
0x6e018a14
0x6e018a17
0x6e018a1a
0x6e018a24
0x6e018a36
0x6e018a26
0x6e018a2f
0x6e018a2f
0x6e018a41
0x6e018a42
0x6e018a44
0x6e018a49
0x6e018a5f

APIs

RtlGetCurrentServiceSessionId.9419(?,?,7FFE0386,?,?,?,?,?,?,?,?,?,?,?,6DFA1AC9,?), ref: 6E018A1D
ZwTraceEvent.9419(?,00000403,00000014,?,?,?,7FFE0386), ref: 6E018A4A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: b7816e87f1ec286b23b722c1f2c7ca0d38d29281b0634332868b71de1463ee12
Instruction ID: 2b8eedcf5482567feda2d2fd193517d8cfc79f6a40f020c34fad03239d43418a
Opcode Fuzzy Hash: b7816e87f1ec286b23b722c1f2c7ca0d38d29281b0634332868b71de1463ee12
Instruction Fuzzy Hash: 4A015E71A04209AFDB00CFA9D9819EEB7B8FF48340F50405AE901EB340D7349A018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF50FFD, Relevance: 3.0, APIs: 2, Instructions: 43
nativeCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E6DF50FFD(WCHAR* __ecx) {
				signed int _v8;
				void* _v172;
				char _v180;
				char _v184;
				void* __edi;
				void* __esi;
				signed int _t12;
				intOrPtr _t19;
				intOrPtr _t23;
				void* _t25;
				intOrPtr _t26;
				WCHAR* _t28;
				intOrPtr _t29;
				signed int _t30;

				_t32 = (_t30 & 0xffffffe0) - 0xb8;
				_v8 =  *0x6e03d360 ^ (_t30 & 0xffffffe0) - 0x000000b8;
				_t28 = __ecx;
				_t25 = E6DF5106F(__ecx);
				if(_t25 == 0 ||  *_t28 == 0) {
					_t12 = 0;
				} else {
					RtlInitUnicodeString( &_v172, _t28);
					_push( &_v184);
					_push(0x78);
					_push( &_v172);
					_push(2);
					_push( &_v180);
					_push(_t25);
					_t12 = E6DF89650() & 0xffffff00 | _t18 > 0x00000000;
				}
				_pop(_t26);
				_pop(_t29);
				return E6DF8B640(_t12, _t19, _v8 ^ _t32, _t23, _t26, _t29);
			}

0x6df51005
0x6df51012
0x6df5101b
0x6df51022
0x6df51026
0x6df5106b
0x6df5102e
0x6df51034
0x6df5103d
0x6df5103e
0x6df51044
0x6df51045
0x6df5104b
0x6df5104c
0x6df51054
0x6df51054
0x6df5105e
0x6df5105f
0x6df5106a

APIs

Part of subcall function 6DF5106F: ZwOpenKey.9419(00000000,00000001,6DF210F8,?,?,6DF51022,?), ref: 6DF5108D

RtlInitUnicodeString.9419(?,?,?,00000000), ref: 6DF51034
ZwQueryValueKey.9419(00000000,?,00000002,?,00000078,?,?,?,?,00000000), ref: 6DF5104D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenQueryStringUnicodeValue
String ID:
API String ID: 1506694742-0
Opcode ID: 64f31a93afa48671b0af8c7542f04d7161f0a975bdf82075f86e8b3b7b1ee278
Instruction ID: ed97598554594890b41c1252699851c07a57767e897f0681918947627292b453
Opcode Fuzzy Hash: 64f31a93afa48671b0af8c7542f04d7161f0a975bdf82075f86e8b3b7b1ee278
Instruction Fuzzy Hash: D6F0C8725087056AD320EF288842EBBB3ECDBC5610F450A1DFA59C3191EB34ED14C3A3

Uniqueness

Uniqueness Score: -1.00%

Function 6DF47055, Relevance: 3.0, APIs: 2, Instructions: 43memorytimeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.9419(00000001,?,6E01FE98,?,00000000,00000000,7FFFFFFF,?,?,?,?,6DFD430E,?,6E0208D0,00000008,6DF79B80), ref: 6DF47086
RtlFreeHeap.9419(?,00000000,00000002,7FFFFFFF,?,?,?,?,6DFD430E,?,6E0208D0,00000008,6DF79B80,?,?), ref: 6DF470AB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugFreeHeapPrintTimes
String ID:
API String ID: 3752032992-0
Opcode ID: 12249242d2eff91e4a3171a604d7ec4a470a3811ee9bd8321c0bf900862372e0
Instruction ID: da4bf80a224421b7cd0c4c5162e35b6ed522542a2a82536d331d5374ff6d9e65
Opcode Fuzzy Hash: 12249242d2eff91e4a3171a604d7ec4a470a3811ee9bd8321c0bf900862372e0
Instruction Fuzzy Hash: 5B01DB31601A48ABC720CF6CCC05FABBBF9EF84700F15056CE90683191CBB1AE00CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4B1E1, Relevance: 3.0, APIs: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF4B1E1(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed char* _t13;
				void* _t22;
				void* _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E6DF67D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E6DF67D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return L6DFC7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x6df4b1e8
0x6df4b1ea
0x6df4b1f3
0x6dfa4a17
0x6df4b1f9
0x6df4b1f9
0x6df4b1f9
0x6df4b201
0x6dfa4a21
0x6dfa4a2e
0x00000000
0x00000000
0x6dfa4a3b
0x6dfa4a4d
0x6dfa4a3d
0x6dfa4a46
0x6dfa4a46
0x6dfa4a55
0x00000000
0x00000000
0x00000000
0x6df4b20a
0x6df4b20a
0x6df4b20a
0x6df4b20a

APIs

RtlGetCurrentServiceSessionId.9419(00000000,?,?,6DFB3BA6,00000000,?,6DF6DFDF,?,00000000,6E037B60,6E01FE18,00000028), ref: 6DF4B1EC
RtlGetCurrentServiceSessionId.9419 ref: 6DFA4A34

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID:
API String ID: 1007659313-0
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 634134e07036e7a55d96c1aba3e183756a27d8c279834b05dc17fe3ea7c4dfe3
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 26018632654581DBD3138B5DC844F597B99EF86754F098461FE248B6B2DB75C900C325

Uniqueness

Uniqueness Score: -1.00%

Function 6E019BBE, Relevance: 3.0, APIs: 2, Instructions: 42
nativeCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6E019BBE(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v66;
				char _v72;
				void* __edi;
				void* __esi;
				signed char* _t19;
				intOrPtr _t25;
				signed int _t33;

				_t30 = __edx;
				_v12 =  *0x6e03d360 ^ _t33;
				_v40 = _v40 & 0x00000000;
				_t32 = _a12;
				_v36 = __edx;
				_v66 = 0x1c21;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E6DF67D50() == 0) {
					_t19 = 0x7ffe0386;
				} else {
					_t19 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x403);
				_push( *_t19 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t25, _v12 ^ _t33, _t30, 0x1c21, _t32);
			}

0x6e019bbe
0x6e019bcd
0x6e019bd6
0x6e019bdb
0x6e019be4
0x6e019be7
0x6e019beb
0x6e019bee
0x6e019bf1
0x6e019bfb
0x6e019c0d
0x6e019bfd
0x6e019c06
0x6e019c06
0x6e019c18
0x6e019c19
0x6e019c1b
0x6e019c20
0x6e019c35

APIs

RtlGetCurrentServiceSessionId.9419(?,?), ref: 6E019BF4
ZwTraceEvent.9419(?,00000403,00000014,?,?,?), ref: 6E019C21

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: cdfcf1605feb8b9681287c15d406ce809cde51a698934058fd0719603666996e
Instruction ID: 13132a047e006f153f1d24634c2e40c4370a03cf805e13d9571ee51c15e537bc
Opcode Fuzzy Hash: cdfcf1605feb8b9681287c15d406ce809cde51a698934058fd0719603666996e
Instruction Fuzzy Hash: F3014F71A04659AFDB00DFA9D841AEEB7F8FF48314F15405AF905AB390DB34AA01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6DF42E9F, Relevance: 3.0, APIs: 2, Instructions: 41
nativeCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E6DF42E9F(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _t17;
				signed int _t22;

				_t17 = __edx | 0xffffffff;
				_v8 = _t17;
				if( *0x6e036901 != 0) {
					_push(0);
					_push(1);
					_push(0);
					_push(0x100003);
					_push( &_v8);
					if(E6DF89980() < 0) {
						_v8 = _t17 | 0xffffffff;
					}
				}
				asm("lock cmpxchg [ecx], edx");
				_t22 = 0;
				if(0 != 0) {
					if(_v8 != 0xffffffff) {
						_push(_v8);
						E6DF895D0();
					}
				} else {
					_t22 = _v8;
				}
				return _t22;
			}

0x6df42ea5
0x6df42eb2
0x6df42eb5
0x6df9fae9
0x6df9faeb
0x6df9faed
0x6df9faef
0x6df9faf7
0x6df9faff
0x6df9fb04
0x6df9fb04
0x6df9faff
0x6df42ec0
0x6df42ec4
0x6df42ec8
0x6df9fb18
0x6df9fb1e
0x6df9fb21
0x6df9fb21
0x6df42ece
0x6df42ece
0x6df42ece
0x6df42ed7

APIs

ZwCreateEvent.9419(00000000,00100003,00000000,00000001,00000000,?,?,?,6DF42E77,?,00000000,00000000,?,?,?,6DF5F016), ref: 6DF9FAF8
ZwClose.9419(000000FF,?,?,?,6DF42E77,?,00000000), ref: 6DF9FB21

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateEvent
String ID:
API String ID: 1253057341-0
Opcode ID: 370820752e9cabd5e7e1147756c4e5176dccb75df9f338ad060fb685b651ebe6
Instruction ID: b769a5a9e630fbf924826d033e5fb781a6d174f01e61eaaf7db718bcf728a420
Opcode Fuzzy Hash: 370820752e9cabd5e7e1147756c4e5176dccb75df9f338ad060fb685b651ebe6
Instruction Fuzzy Hash: BB018631D55615E7DB32CB6D8D0078E7AB5AF45334F2183A9F924AB1C0EB715F019781

Uniqueness

Uniqueness Score: -1.00%

Function 6DF810D7, Relevance: 3.0, APIs: 2, Instructions: 41
nativeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6DF810D7(intOrPtr* __ecx, void* __edx, intOrPtr _a4) {
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				void* _t16;
				intOrPtr* _t23;

				_v36 = 0x18;
				_t23 = __ecx;
				_v32 = 0;
				_v24 = 0x240;
				_v28 = 0x6df213d0;
				_v20 = 0;
				_v16 = 0;
				if(_a4 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push( &_v36);
					_push( &_v12);
					_t16 = E6DF896D0();
				} else {
					_push( &_v36);
					_push( &_v12);
					_t16 = E6DF89600();
				}
				if(_t16 >= 0) {
					 *_t23 = _v12;
					return 0;
				}
				return _t16;
			}

0x6df810e1
0x6df810e9
0x6df810eb
0x6df810ee
0x6df810f5
0x6df810fc
0x6df810ff
0x6df81105
0x6dfbcd7f
0x6dfbcd80
0x6dfbcd81
0x6dfbcd82
0x6dfbcd86
0x6dfbcd8b
0x6dfbcd8c
0x6df8110b
0x6df8110e
0x6df81113
0x6df81114
0x6df81114
0x6df8111b
0x6df81120
0x00000000
0x6df81122
0x6df81128

APIs

ZwOpenKey.9419(?,?,00000018,?), ref: 6DF81114

Part of subcall function 6DF89600: LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

ZwCreateKey.9419(?,?,00000018,00000000,00000000,00000000,00000000,?), ref: 6DFBCD8C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateInitializeOpenThunk
String ID:
API String ID: 3019815113-0
Opcode ID: 9ace78f6ae7f868af042692cd59a424b46166d3c03866c85f6a2ef48e81838be
Instruction ID: 2c88f8ca56fd0e7bb7a2f04c8edd21cef83867e585381544d2f8dba30d429ca3
Opcode Fuzzy Hash: 9ace78f6ae7f868af042692cd59a424b46166d3c03866c85f6a2ef48e81838be
Instruction Fuzzy Hash: F001C9B6C0421DBFEB10DFE9D845DEFBBFCAB08204F04456AE915E3101E7749A448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF75AA0, Relevance: 3.0, APIs: 2, Instructions: 41
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6DF75AA0(void* __ecx, intOrPtr _a4, char _a8) {
				void* __esi;
				void* __ebp;
				char* _t9;
				void* _t17;
				void* _t20;
				void* _t22;
				intOrPtr _t24;

				_t18 = __ecx;
				_push(__ecx);
				_t24 = _a4;
				if(_t24 == 0 || _a8 < 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					_t9 = E6E0188F5(_t17, _t18, _t20, _t22, _t24, __eflags);
				} else {
					_push(4);
					_push( &_a8);
					_push(5);
					_push( *((intOrPtr*)(_t24 + 0x24)));
					E6DF8AE70();
					if(E6DF67D50() != 0) {
						_t9 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t9 = 0x7ffe0386;
					}
					if( *_t9 != 0) {
						_t9 = E6E018C14(_t24, _a8);
					}
				}
				return _t9;
			}

0x6df75aa0
0x6df75aa8
0x6df75aaa
0x6df75aaf
0x6df75af8
0x6df75ac6
0x6df75ac6
0x6df75acb
0x6df75acc
0x6df75ace
0x6df75ad1
0x6df75add
0x6dfb71de
0x6df75ae3
0x6df75ae3
0x6df75ae3
0x6df75aeb
0x6dfb71ed
0x6dfb71ed
0x6df75aeb
0x6df75af5

APIs

ZwSetInformationWorkerFactory.9419(?,00000005,00000000,00000004,00000000,?,?,6E0180F8,00000000,00000000,6E0386C4,6E0386C4,00000008,?,00000000,00000008), ref: 6DF75AD1
RtlGetCurrentServiceSessionId.9419(?,00000005,00000000,00000004,00000000,?,?,6E0180F8,00000000,00000000,6E0386C4,6E0386C4,00000008,?,00000000,00000008), ref: 6DF75AD6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFactoryInformationServiceSessionWorker
String ID:
API String ID: 2490488586-0
Opcode ID: c9b001a91482740e9157406d5ad749f8f827d34b66fe1a1f9de7b8e59cb761b8
Instruction ID: 633fd20da82b9a1519995dce6dc9119f03311f472559a8ac6e50a4fc8a3e3b79
Opcode Fuzzy Hash: c9b001a91482740e9157406d5ad749f8f827d34b66fe1a1f9de7b8e59cb761b8
Instruction Fuzzy Hash: 7501D132A98645AFF721CB5CD884FAA33A8AB01724F018162FD149F3D0DBB4DD4087A1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFFDD3, Relevance: 3.0, APIs: 2, Instructions: 39
nativeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6DFFFDD3(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				void* __edi;
				signed char* _t15;
				intOrPtr _t21;
				signed int _t23;
				intOrPtr _t28;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_v8 =  *0x6e03d360 ^ _t32;
				_t28 = __ecx;
				_t29 =  &_v52;
				_t23 = 0xa;
				memset(_t29, 0, _t23 << 2);
				_t30 = _t29 + _t23;
				_v20 = _t28;
				_v46 = 0x268;
				if(E6DF67D50() == 0) {
					_t15 = 0x7ffe0388;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v52);
				_push(8);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t21, _v8 ^ _t32, _t28, _t30, _t31);
			}

0x6dfffde2
0x6dfffde6
0x6dfffde8
0x6dfffdef
0x6dfffdf0
0x6dfffdf0
0x6dfffdf7
0x6dfffdfa
0x6dfffe05
0x6dfffe17
0x6dfffe07
0x6dfffe10
0x6dfffe10
0x6dfffe22
0x6dfffe23
0x6dfffe25
0x6dfffe2a
0x6dfffe3e

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,?,?,?,6E00B6F0,?,?,?,?,00000000), ref: 6DFFFDFE
ZwTraceEvent.9419(?,00020402,00000008,?,?,?,?,?,?,?,?,6E00B6F0,?,?,?,?), ref: 6DFFFE2B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 97d24d3ba861105081553fd543d60a33c432c6d8bc42de956af26def246a8e9f
Instruction ID: d9bb35619615f80656574db99aed61d6994afd00295c5a5b8a0fc9df3a22cd33
Opcode Fuzzy Hash: 97d24d3ba861105081553fd543d60a33c432c6d8bc42de956af26def246a8e9f
Instruction Fuzzy Hash: D0F0A931B14648ABDB04DBADD805ABEB3B8EF45704F0140A9EA01EB6A1EA30ED15C751

Uniqueness

Uniqueness Score: -1.00%

Function 6E018F6A, Relevance: 3.0, APIs: 2, Instructions: 36
nativeCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E6E018F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x6e03d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E6DF67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x6e018f6a
0x6e018f79
0x6e018f81
0x6e018f84
0x6e018f8b
0x6e018f91
0x6e018f94
0x6e018f9e
0x6e018fb0
0x6e018fa0
0x6e018fa9
0x6e018fa9
0x6e018fbb
0x6e018fbc
0x6e018fbe
0x6e018fc3
0x6e018fd6

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,6DFB2CE2,?,?,00000000,?,00002710,00000000,?,?,?), ref: 6E018F97
ZwTraceEvent.9419(?,00000402,00000010,?,?,?,?,?,6DFB2CE2,?,?,00000000,?,00002710,00000000,?), ref: 6E018FC4

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 3d494da5b06baa120687976ad5fe1546d4e6bf2a8cb3cc912025642b5cdf34b8
Instruction ID: ac698346fc6f4b78ab9ade57540dc06d85eaab1ee2c21471418afc6d4c2636ec
Opcode Fuzzy Hash: 3d494da5b06baa120687976ad5fe1546d4e6bf2a8cb3cc912025642b5cdf34b8
Instruction Fuzzy Hash: 29013C74A04249AFDB00DFA8D545AAEB7F4EF08304F504459F905EB381EB34DE00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD2EA3, Relevance: 3.0, APIs: 2, Instructions: 36
nativeCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E6DFD2EA3(intOrPtr __ecx, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;
				signed int _t31;

				_t31 = (_t29 & 0xfffffff8) - 0x38;
				_v8 =  *0x6e03d360 ^ _t31;
				_t26 = _a8;
				_v54 = 0xd24;
				_v28 = _a4;
				_v24 = _a8;
				_v20 = __ecx;
				if(E6DF67D50() == 0) {
					_t15 = 0x7ffe038e;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
				}
				_push(_t31);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t21, _v24 ^ _t31, _t26, _t27, _t28);
			}

0x6dfd2eab
0x6dfd2eb5
0x6dfd2eb9
0x6dfd2ec1
0x6dfd2ec9
0x6dfd2ecd
0x6dfd2ed1
0x6dfd2edc
0x6dfd2eee
0x6dfd2ede
0x6dfd2ee7
0x6dfd2ee7
0x6dfd2ef9
0x6dfd2efa
0x6dfd2efc
0x6dfd2f01
0x6dfd2f15

APIs

RtlGetCurrentServiceSessionId.9419 ref: 6DFD2ED5
ZwTraceEvent.9419(?,00020402,0000000C), ref: 6DFD2F02

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: d4df667ff7d8d0d02adc4d5cefe5b8d46ae7eb0f5434957ffba20abba545c79d
Instruction ID: eb1b5ee91740ba42be6503a88916d8ef25010f6293193be6d844af45dea4b547
Opcode Fuzzy Hash: d4df667ff7d8d0d02adc4d5cefe5b8d46ae7eb0f5434957ffba20abba545c79d
Instruction Fuzzy Hash: A4F081706197449FC310DF2CC441A1AB7E4BF48714F444A5AB994DB391E635E900C796

Uniqueness

Uniqueness Score: -1.00%

Function 6E00131B, Relevance: 3.0, APIs: 2, Instructions: 36
nativeCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E6E00131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x6e03d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E6DF67D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x6e00131b
0x6e00132a
0x6e001330
0x6e001336
0x6e00133e
0x6e001341
0x6e001344
0x6e00134f
0x6e001361
0x6e001351
0x6e00135a
0x6e00135a
0x6e00136c
0x6e00136d
0x6e00136f
0x6e001374
0x6e001387

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6DFAE38A,00000000), ref: 6E001348
ZwTraceEvent.9419(?,00020402,00000010,?), ref: 6E001375

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 25c5e26a88a3e608abea08b9ddd11fb7fbcf71e8165ccf7bdd374a59fbffe02a
Instruction ID: 723a4cbb3a412f54c9adba19d1d5e426e6e085aaeaa2de3f405eff1044073cba
Opcode Fuzzy Hash: 25c5e26a88a3e608abea08b9ddd11fb7fbcf71e8165ccf7bdd374a59fbffe02a
Instruction Fuzzy Hash: AB011971A05248AFDB04DFA9D545AAEB7F4EF08704F408059F905EB391EA349A04CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6E6B0, Relevance: 3.0, APIs: 2, Instructions: 35
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DF6E6B0(intOrPtr* _a4) {
				void* _t8;
				intOrPtr _t11;
				intOrPtr* _t12;

				_t12 = _a4;
				if(_t12 == 0) {
					return 0xc000000d;
				}
				_t8 = E6DF8F380( *[fs:0x18] + 0x19c, _t12, 8);
				if(_t8 != 0) {
					_push(8);
					_push(_t12);
					_push(0x2c);
					_push(0xfffffffe);
					_t8 = E6DF895B0();
					if(_t8 >= 0) {
						_t11 =  *[fs:0x18];
						 *((intOrPtr*)(_t11 + 0x19c)) =  *_t12;
						 *((intOrPtr*)(_t11 + 0x1a0)) =  *((intOrPtr*)(_t12 + 4));
						return _t8;
					}
				}
				return _t8;
			}

0x6df6e6b6
0x6df6e6bb
0x00000000
0x6df6e6f2
0x6df6e6cc
0x6df6e6d6
0x6df6e6dd
0x6df6e6df
0x6df6e6e0
0x6df6e6e2
0x6df6e6e4
0x6df6e6eb
0x6df9e274
0x6df9e27d
0x6df9e286
0x00000000
0x6df9e286
0x6df6e6eb
0x6df6e6da

APIs

memcmp.9419(-00000184,?,00000008,?,?,6DF6E690,?,?,?), ref: 6DF6E6CC
ZwSetInformationThread.9419(000000FE,0000002C,?,00000008,?,?,7FFE0386), ref: 6DF6E6E4

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationThreadmemcmp
String ID:
API String ID: 3942342040-0
Opcode ID: 8dc100a416e1690f457f949e0d382daa7a5c8ff32ea78a065eac53d9b1dcc92e
Instruction ID: 4308ff42594f612e3525c051e92e6c950906ef955aef076dc272fdb7ce9969a5
Opcode Fuzzy Hash: 8dc100a416e1690f457f949e0d382daa7a5c8ff32ea78a065eac53d9b1dcc92e
Instruction Fuzzy Hash: 5DF0BB7366569497E320965D8C04F837754FB46B64F00C335AB48DBB81DA25E840CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF42B93, Relevance: 3.0, APIs: 2, Instructions: 35
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6DF42B93(signed int* __ecx, unsigned int __edx, intOrPtr _a4) {
				void* _t12;
				signed int* _t15;
				signed int _t16;

				_t15 = __ecx;
				_t16 = __edx;
				 *__ecx =  *__ecx & 0x00000000;
				__ecx[1] = __edx;
				if((__edx & 0xffff0000) != 0) {
					E6E018050(__ecx, __edx, __edx >> 0x10);
				}
				if(_a4 == 0) {
					L2:
					return 0;
				}
				if((_t16 & 0x00000100) == 0) {
					goto L2;
				}
				_push(_t15);
				_push(2);
				_push(0);
				_push(0);
				_push(4);
				_push(_a4);
				_t12 = E6DF89920();
				if(_t12 >= 0) {
					goto L2;
				}
				return _t12;
			}

0x6df42b9a
0x6df42b9c
0x6df42b9e
0x6df42ba1
0x6df42baa
0x6df9f8d1
0x6df9f8d1
0x6df42bb4
0x6df42bba
0x00000000
0x6df42bba
0x6df9f8e1
0x00000000
0x00000000
0x6df9f8e7
0x6df9f8e8
0x6df9f8ea
0x6df9f8ec
0x6df9f8ee
0x6df9f8f0
0x6df9f8f3
0x6df9f8fa
0x00000000
0x6df9f900
0x6df42bbf

APIs

TpSetDefaultPoolMaxThreads.9419(?,00000000,00000000,?,6DF422D2,00000000,?,00000000,00000034), ref: 6DF9F8D1
ZwDuplicateToken.9419(00000000,00000004,00000000,00000000,00000002,00000008,00000000,00000000,?,6DF422D2,00000000,?,00000000,00000034), ref: 6DF9F8F3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: DefaultDuplicatePoolThreadsToken
String ID:
API String ID: 3143362213-0
Opcode ID: 46a9fd4750765c9c90920286514a178b441ebf945bf0a5437e9a6174d3e17083
Instruction ID: 3cbae675a549f632620f0462369a543c3d71dd35432a541be5ca01b16effc328
Opcode Fuzzy Hash: 46a9fd4750765c9c90920286514a178b441ebf945bf0a5437e9a6174d3e17083
Instruction Fuzzy Hash: 71F0A072E846157AF721895D8C01F9B7E58AF80B65F01C436BF08EE2C2CBB6C851C1A4

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7939F, Relevance: 3.0, APIs: 2, Instructions: 35
nativeCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E6DF7939F(void* __ecx) {
				signed int _v8;
				void* _t4;
				intOrPtr _t5;
				signed int _t12;
				signed int _t13;

				_t13 = _t12 & 0xfffffff8;
				_v8 = _v8 | 0xffffffff;
				 *_t13 = 0xfff0bdc0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					_t5 =  *0x6e036dac;
					if(_t5 == 1) {
						_push(_t13);
						_push(0);
						E6DF89840();
						_t5 =  *0x6e036dac;
					}
					if(_t5 != 2) {
						continue;
					}
					return _t5;
				}
				_t4 = E6DF71520(0x6e036d80, 0, 0);
				 *0x6e036dac = 2;
				return _t4;
			}

0x6df793a4
0x6df793a9
0x6df793ae
0x6df793b5
0x6df793bf
0x6df793c5
0x00000000
0x00000000
0x6df793c7
0x6df793cf
0x6df9e484
0x6df9e485
0x6df9e487
0x6df9e48c
0x6df9e48c
0x6df793d8
0x00000000
0x00000000
0x6df793dd
0x6df793dd
0x6df793e7
0x6df793ec
0x00000000

APIs

RtlInitializeCriticalSectionEx.9419(6E036D80,00000000,00000000,?,?,?,6DF7932C,6E020158,00000018,6DF463DB), ref: 6DF793E7
ZwDelayExecution.9419(00000000,?,?,?,?,6DF7932C,6E020158,00000018,6DF463DB), ref: 6DF9E487

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalDelayExecutionInitializeSection
String ID:
API String ID: 688281180-0
Opcode ID: 51288574c2cd49c5840e95eade713900b4c6e7438a1f50fb85e8e5abf387c0b3
Instruction ID: 0a60ffdcd391123146463f053b95eaf6616b4570c6d33eab7b61a0eab26a865c
Opcode Fuzzy Hash: 51288574c2cd49c5840e95eade713900b4c6e7438a1f50fb85e8e5abf387c0b3
Instruction Fuzzy Hash: E1F0E97156D6035ADB78DADCEC06B677269E703331F20822FE5E9CA2C0DF60D8418682

Uniqueness

Uniqueness Score: -1.00%

Function 6DF45450, Relevance: 3.0, APIs: 2, Instructions: 34
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E6DF45450(void* __ecx) {
				signed int _v8;
				signed int _v12;
				void* _t14;
				intOrPtr _t19;

				_v12 = _v12 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_t14 = E6DF8F380( *[fs:0x18] + 0x19c,  &_v12, 8);
				if(_t14 != 0) {
					_push("true");
					_push( &_v12);
					_push(0x2c);
					_push(0xfffffffe);
					_t14 = E6DF895B0();
					if(_t14 >= 0) {
						_t19 =  *[fs:0x18];
						 *(_t19 + 0x19c) = _v12;
						 *(_t19 + 0x1a0) = _v8;
						return _t14;
					}
				}
				return _t14;
			}

0x6df45457
0x6df4545e
0x6df45471
0x6df4547b
0x6dfa0f83
0x6dfa0f88
0x6dfa0f89
0x6dfa0f8b
0x6dfa0f8d
0x6dfa0f94
0x6dfa0f9a
0x6dfa0fa4
0x6dfa0fad
0x00000000
0x6dfa0fad
0x6dfa0f94
0x6df45484

APIs

memcmp.9419(-00000184,00000000,00000008), ref: 6DF45471
ZwSetInformationThread.9419(000000FE,0000002C,00000000,00000008), ref: 6DFA0F8D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationThreadmemcmp
String ID:
API String ID: 3942342040-0
Opcode ID: d75fc3e6d5438fe09ff48bf2a6782bfb6ff12707352c949addb36b6430fc9db6
Instruction ID: da66ab84cc45ec783e1f14dac9d11e68ae66aa054d8e5b4c739b8116f56f8314
Opcode Fuzzy Hash: d75fc3e6d5438fe09ff48bf2a6782bfb6ff12707352c949addb36b6430fc9db6
Instruction Fuzzy Hash: 69F09671A54208BFE714CB58C841FDABB78EB44715F104264A9089A681EB74AA44C791

Uniqueness

Uniqueness Score: -1.00%

Function 6E018C14, Relevance: 3.0, APIs: 2, Instructions: 32
nativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E6E018C14(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x6e03d360 ^ _t26;
				_v20 = __ecx;
				_v46 = 0x1c28;
				_v16 = __edx;
				if(E6DF67D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x6e018c14
0x6e018c23
0x6e018c2b
0x6e018c2e
0x6e018c32
0x6e018c3c
0x6e018c4e
0x6e018c3e
0x6e018c47
0x6e018c47
0x6e018c59
0x6e018c5a
0x6e018c5c
0x6e018c61
0x6e018c74

APIs

RtlGetCurrentServiceSessionId.9419 ref: 6E018C35
ZwTraceEvent.9419(?,00020402,00000008,?), ref: 6E018C62

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 5deea3aaf0134e8d2e04999580fb7d6675ad60d9ab256f06e5040263403521fe
Instruction ID: 12a2d2257e6f036a170efa8f0f04a6ab0f59f0b27b51707c71e1c3ebca21c995
Opcode Fuzzy Hash: 5deea3aaf0134e8d2e04999580fb7d6675ad60d9ab256f06e5040263403521fe
Instruction Fuzzy Hash: 1FF0BE70A08608AFDB04DFB8D941AAEB3B4FF04304F414899E915EB281EB34EE00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E018C75, Relevance: 3.0, APIs: 2, Instructions: 32
nativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E6E018C75(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x6e03d360 ^ _t26;
				_v20 = __ecx;
				_v46 = 0x1c27;
				_v16 = __edx;
				if(E6DF67D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x6e018c75
0x6e018c84
0x6e018c8c
0x6e018c8f
0x6e018c93
0x6e018c9d
0x6e018caf
0x6e018c9f
0x6e018ca8
0x6e018ca8
0x6e018cba
0x6e018cbb
0x6e018cbd
0x6e018cc2
0x6e018cd5

APIs

RtlGetCurrentServiceSessionId.9419 ref: 6E018C96
ZwTraceEvent.9419(?,00020402,00000008,?), ref: 6E018CC3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 65237931b6a67c822f5df193c737b656df93920daa5bbf0da1757d3d4cd7b044
Instruction ID: 922de9ee52a599a7a88e063b704a34882d1b9d53d14e2da104503dc2ef220145
Opcode Fuzzy Hash: 65237931b6a67c822f5df193c737b656df93920daa5bbf0da1757d3d4cd7b044
Instruction Fuzzy Hash: 03F0BE70A18649AFDB04EFB8D942EAEB3B4EF04304F004499E905EB381EB34DE00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E018D34, Relevance: 3.0, APIs: 2, Instructions: 32
nativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E6E018D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x6e03d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E6DF67D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x6e018d34
0x6e018d43
0x6e018d4b
0x6e018d4e
0x6e018d52
0x6e018d5c
0x6e018d6e
0x6e018d5e
0x6e018d67
0x6e018d67
0x6e018d79
0x6e018d7a
0x6e018d7c
0x6e018d81
0x6e018d94

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,?,?,?,?,6DFB2D82,?,?,?,00000000,?,00000000,?), ref: 6E018D55
ZwTraceEvent.9419(?,00020402,00000008,?,?,?,?,?,?,?,?,?,6DFB2D82,?,?,?), ref: 6E018D82

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 6472b2b6e4f8335d1c5af5d3068774709b7f5704c30bf829542b6a0ae0803c00
Instruction ID: 6cd500f19b707c62c755378c14f3e1f265872423f22578cc6b4ed9e0dbe072d3
Opcode Fuzzy Hash: 6472b2b6e4f8335d1c5af5d3068774709b7f5704c30bf829542b6a0ae0803c00
Instruction Fuzzy Hash: 21F09070A08708AFDB04DBA8D441BAEB7B4AB04304F508499E905AB291EA34DD008B64

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8927A, Relevance: 3.0, APIs: 2, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6DF8927A(void* __ecx) {
				void* _t11;
				void* _t14;

				_t11 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x98);
				if(_t11 != 0) {
					memset(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E6DF892C6(_t11, _t14);
				}
				return _t11;
			}

0x6df89295
0x6df89299
0x6df8929f
0x6df892aa
0x6df892ad
0x6df892ae
0x6df892af
0x6df892b0
0x6df892b4
0x6df892bb
0x6df892bb
0x6df892c5

APIs

RtlAllocateHeap.9419(?,00000008,00000098,?,0000000A,00000000,6DF7504F,00000000,?,?,6DF74E1B,0000000F,?,000000A0), ref: 6DF89290
memset.9419(00000000,00000000,00000098,?,00000008,00000098,?,0000000A,00000000,6DF7504F,00000000,?,?,6DF74E1B,0000000F,?), ref: 6DF8929F

Part of subcall function 6DF892C6: RtlAcquireSRWLockExclusive.9419(6E0386AC,0000000C,00000000,00000000,00000000,?,6DF892C0,00000000,?,?,6DF74E1B,0000000F,?,000000A0), ref: 6DF892D6
Part of subcall function 6DF892C6: RtlRbInsertNodeEx.9419(6E0386D4,?,00000000,00000000,6E0386AC,0000000C,00000000,00000000,00000000), ref: 6DF89301
Part of subcall function 6DF892C6: RtlReleaseSRWLockExclusive.9419(6E0386AC,6E0386D4,?,00000000,00000000,6E0386AC,0000000C,00000000,00000000,00000000), ref: 6DF8930B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAllocateHeapInsertNodeReleasememset
String ID:
API String ID: 3899015646-0
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: b8efd2a176f5db6b5b85540f5246089ae90da2f757bf4292f567db210c465677
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: CAE06D322406406BE7119F5ADC94B57B6A9AF86B29F014079BA045E283CAE6DD0987A0

Uniqueness

Uniqueness Score: -1.00%

Function 6E018CD6, Relevance: 3.0, APIs: 2, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E6E018CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x6e03d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E6DF67D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x6e018ce5
0x6e018ced
0x6e018cf0
0x6e018cfb
0x6e018d0d
0x6e018cfd
0x6e018d06
0x6e018d06
0x6e018d18
0x6e018d19
0x6e018d1b
0x6e018d20
0x6e018d33

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,?,?,6DF6BB24,?,?,?), ref: 6E018CF4
ZwTraceEvent.9419(?,00000402,000000E4,?,?,?,?,?,?,?,6DF6BB24,?,?,?), ref: 6E018D21

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 6797e7df804b165e5c50117dd30bcb3ffe0cfde6187fb14d8be9a1c92f043eb0
Instruction ID: aba586659f7fd7e6e9ff7fae7f744abe59929c4021ed4b604905d4fae7f3e68a
Opcode Fuzzy Hash: 6797e7df804b165e5c50117dd30bcb3ffe0cfde6187fb14d8be9a1c92f043eb0
Instruction Fuzzy Hash: E9F0E270A08208AFDB00DBECD845EAE77B4EF09304F100199F912EB281EA34DD00C764

Uniqueness

Uniqueness Score: -1.00%

Function 6E018B58, Relevance: 3.0, APIs: 2, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E6E018B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x6e03d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E6DF67D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x6e018b67
0x6e018b6f
0x6e018b72
0x6e018b7d
0x6e018b8f
0x6e018b7f
0x6e018b88
0x6e018b88
0x6e018b9a
0x6e018b9b
0x6e018b9d
0x6e018ba2
0x6e018bb5

APIs

RtlGetCurrentServiceSessionId.9419 ref: 6E018B76
ZwTraceEvent.9419(?,00000402,00000004,?), ref: 6E018BA3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: d6fbdf8b01cb260cd0aca741b8e4aee107f9b5de7da406d4662fc2ae28f3afc8
Instruction ID: b532d994d7949885c960b4716f0d8af2ae58d0ea8d483bb6d394c06cfed16db2
Opcode Fuzzy Hash: d6fbdf8b01cb260cd0aca741b8e4aee107f9b5de7da406d4662fc2ae28f3afc8
Instruction Fuzzy Hash: FAF05EB0A18259ABDB00DBA8D946AAEB3B8AB04304F410499EA059B291EB34DD00C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 6E001BA8, Relevance: 3.0, APIs: 2, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E6E001BA8(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x6e03d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x102e;
				if(E6DF67D50() == 0) {
					_t11 = 0x7ffe0380;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v44);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x6e001bb7
0x6e001bbf
0x6e001bc2
0x6e001bcd
0x6e001bdf
0x6e001bcf
0x6e001bd8
0x6e001bd8
0x6e001bea
0x6e001beb
0x6e001bed
0x6e001bf2
0x6e001c05

APIs

RtlGetCurrentServiceSessionId.9419(?,?,?,?,?,?,?,?,?,?,6E002783,00000001), ref: 6E001BC6
ZwTraceEvent.9419(?,00000402,00000004,?,?,?,?,?,?,?,?,?,?,?,6E002783,00000001), ref: 6E001BF3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 0293ad9bb15589be5055a1f48802f895209eaa91b20c43037e7e118df65a00e6
Instruction ID: 2778774b1314fc42a5e611e3c9d5a95687f398b829fb204ba70a620bda93400b
Opcode Fuzzy Hash: 0293ad9bb15589be5055a1f48802f895209eaa91b20c43037e7e118df65a00e6
Instruction Fuzzy Hash: 23F08271A09248AFDB04DBE9D446AAE77B4EF09308F410099EA06EB281EA74DD04C755

Uniqueness

Uniqueness Score: -1.00%

Function 6E018BB6, Relevance: 3.0, APIs: 2, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E6E018BB6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x6e03d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c25;
				if(E6DF67D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x20402);
				_push( *_t11 & 0x000000ff);
				return E6DF8B640(E6DF89AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x6e018bc5
0x6e018bcd
0x6e018bd0
0x6e018bdb
0x6e018bed
0x6e018bdd
0x6e018be6
0x6e018be6
0x6e018bf8
0x6e018bf9
0x6e018bfb
0x6e018c00
0x6e018c13

APIs

RtlGetCurrentServiceSessionId.9419 ref: 6E018BD4
ZwTraceEvent.9419(?,00020402,00000004,?), ref: 6E018C01

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEventServiceSessionTrace
String ID:
API String ID: 171358211-0
Opcode ID: 01dcef5dd0dbee84329c5623683c6c3c1fb53167d3a63d81e8eebed78f72c3a7
Instruction ID: 3a7d755248fe89c225f7c8a8d9ace3e24254e94bb49ad37544d15830dc71deb3
Opcode Fuzzy Hash: 01dcef5dd0dbee84329c5623683c6c3c1fb53167d3a63d81e8eebed78f72c3a7
Instruction Fuzzy Hash: 67F05E70A18259AFDB04DBACD945AAEB3B4EB04304F410499AA159B291EB34DD00C759

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5106F, Relevance: 3.0, APIs: 2, Instructions: 27nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.9419(00000000,00000001,6DF210F8,?,?,6DF51022,?), ref: 6DF5108D

Part of subcall function 6DF89600: LdrInitializeThunk.NTDLL(6DF81119,?,?,00000018,?), ref: 6DF8960A

ZwClose.9419(00000000,00000000,00000001,6DF210F8,?,?,6DF51022,?), ref: 6DFA6923

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseInitializeOpenThunk
String ID:
API String ID: 1312286342-0
Opcode ID: eba41fe9c5784fdb2f566c46a18a7ccd930826900ab74747ee5a34d156e2c57c
Instruction ID: d80e9ccb19b4ee0f28afc4bc18457e67ddbfc472aa3dbaa8862cf9383e02e7c5
Opcode Fuzzy Hash: eba41fe9c5784fdb2f566c46a18a7ccd930826900ab74747ee5a34d156e2c57c
Instruction Fuzzy Hash: B2F09B3590460BEBDB10CEADDA01B9F77B8EB41329F2502A5D505D7240EF719D10D792

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD193B, Relevance: 3.0, APIs: 2, Instructions: 26
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DFD193B(intOrPtr* __ecx, void* __edx, signed char _a4) {
				void* _t3;

				_t7 = __ecx;
				if((_a4 & 0x00000004) == 0) {
					_t3 = E6DFD1C49(__ecx);
					if(_t3 != 0) {
						do {
							_push(0);
							_push(__ecx);
							E6DF8AAE0();
						} while (E6DFD1C49(_t7) != 0);
						_push( *__ecx);
						_push(0xffffffff);
						return E6DF897C0();
					}
				}
				return _t3;
			}

0x6dfd193b
0x6dfd194a
0x6dfd194c
0x6dfd1953
0x6dfd1955
0x6dfd1955
0x6dfd1958
0x6dfd1959
0x6dfd1963
0x6dfd1967
0x6dfd1969
0x00000000
0x6dfd196b
0x6dfd1953
0x6dfd1973

APIs

Part of subcall function 6DFD1C49: ZwQueryInformationProcess.9419(000000FF,00000007,?,00000004,00000000,?,?,?,6DFD1951,00000065,00000000,?,6DFD0C5E,?,00000000), ref: 6DFD1C60

ZwRaiseException.9419(?,?,00000000,00000065,00000000,?,6DFD0C5E,?,00000000,?,?,?,6DFFB56B,00000000,?,00000000), ref: 6DFD1959
ZwTerminateProcess.9419(000000FF,?,?,?,00000000,00000065,00000000,?,6DFD0C5E,?,00000000,?,?,?,6DFFB56B,00000000), ref: 6DFD196B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$ExceptionInformationQueryRaiseTerminate
String ID:
API String ID: 446936932-0
Opcode ID: 706043779a24c007369390e78f8dcb962ca06eed998f802b0d2942614e812319
Instruction ID: 910f66e81d67e5d2532240a69ecd877dbf253b9020bde4be80a0f9562a877cce
Opcode Fuzzy Hash: 706043779a24c007369390e78f8dcb962ca06eed998f802b0d2942614e812319
Instruction Fuzzy Hash: 9CE0863210C15621E76029AE1C04F9B7A9C4FC26BCF1D0125FF24920C19A50985080B6

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFFD22, Relevance: 3.0, APIs: 2, Instructions: 22
nativeCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E6DFFFD22(void* __ecx) {
				signed int _v8;

				_v8 = _v8 & 0x00000000;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E6DF89670() < 0) {
					return 0;
				}
				return E6DFFC790( &_v8);
			}

0x6dfffd28
0x6dfffd2f
0x6dfffd31
0x6dfffd33
0x6dfffd34
0x6dfffd36
0x6dfffd3f
0x00000000
0x6dfffd4c
0x00000000

APIs

ZwQueryInformationProcess.9419(000000FF,00000024,00000000,00000004,00000000,00000002,?,6E00207D,?,6DFFFFAF,00000001,00000020,6E0358C0), ref: 6DFFFD38
RtlUniform.9419(00000000,000000FF,00000024,00000000,00000004,00000000,00000002,?,6E00207D,?,6DFFFFAF,00000001,00000020,6E0358C0), ref: 6DFFFD45

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationProcessQueryUniform
String ID:
API String ID: 4116771627-0
Opcode ID: 424404aa62a92cdb48754ed4a4b684eb2297699b086fab9f25279e2f85699408
Instruction ID: d03516ef9dbdb4fcf9a803786e2a19837b74103187634717b542087516da1572
Opcode Fuzzy Hash: 424404aa62a92cdb48754ed4a4b684eb2297699b086fab9f25279e2f85699408
Instruction Fuzzy Hash: DAE01272664308B6E750C6999D46F9E72ACDB45728F2002516B24D60D0EB74DA0592A5

Uniqueness

Uniqueness Score: -1.00%

Function 6DF42B7E, Relevance: 3.0, APIs: 2, Instructions: 19
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E6DF42B7E(void* __eax, char __ecx) {
				char _v8;

				_push(__ecx);
				_v8 = __ecx;
				if(__ecx != 0) {
					_push(4);
					_push( &_v8);
					_push(5);
					_push(0xfffffffe);
					E6DF895B0();
					_push(_v8);
					return E6DF895D0();
				}
				return __eax;
			}

0x6df42b83
0x6df42b84
0x6df42b89
0x6df9f8af
0x6df9f8b4
0x6df9f8b5
0x6df9f8b7
0x6df9f8b9
0x6df9f8be
0x00000000
0x6df9f8c1
0x6df42b92

APIs

ZwSetInformationThread.9419(000000FE,00000005,FFFFFFFE,00000004,00000000,?,6DF42406,6DF423E2), ref: 6DF9F8B9
ZwClose.9419(FFFFFFFE,000000FE,00000005,FFFFFFFE,00000004,00000000,?,6DF42406,6DF423E2), ref: 6DF9F8C1

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseInformationThread
String ID:
API String ID: 3167811113-0
Opcode ID: b0bd1030edbdbd575e0d5ef49e298145fa6445bf6fe2b91ecf25de54bc86ef58
Instruction ID: 398b9c1d2f87a3b8e7b49abed674f8568303e79862f79ec95bd75cfed07b31af
Opcode Fuzzy Hash: b0bd1030edbdbd575e0d5ef49e298145fa6445bf6fe2b91ecf25de54bc86ef58
Instruction Fuzzy Hash: 1CD02E31849209B6DB00DA9C8C01E6E7678EB81320F2042A8BA18AA480EF318E009342

Uniqueness

Uniqueness Score: -1.00%

Function 6DF423F6, Relevance: 3.0, APIs: 2, Instructions: 18
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6DF423F6(void* __edi, long __esi) {
				char _t7;
				void* _t13;
				long _t14;
				void* _t15;

				_t14 = __esi;
				_t13 = __edi;
				if(__edi != 0) {
					if( *((char*)(_t15 - 0x19)) != 0 &&  *((intOrPtr*)(__edi + 8)) != 0) {
						_push( *((intOrPtr*)(__edi + 8)));
						E6DF895D0();
					}
					_t7 = RtlFreeHeap( *( *[fs:0x30] + 0x18), _t14, _t13);
				}
				return E6DF42B7E(_t7,  *((intOrPtr*)(_t15 - 0x28)));
			}

0x6df423f6
0x6df423f6
0x6df423f8
0x6df9f647
0x6df9f64f
0x6df9f652
0x6df9f652
0x6df9f662
0x6df9f667
0x6df42406

APIs

ZwClose.9419(00000000,6DF423E2,?,?,?,?,?,?,?,?,?,6E01F350,0000004C), ref: 6DF9F652
RtlFreeHeap.9419(?,00000000,?,6DF423E2,?,?,?,?,?,?,?,?,?,6E01F350,0000004C), ref: 6DF9F662

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFreeHeap
String ID:
API String ID: 1266433183-0
Opcode ID: 1368422e5703f006b4c2e4099048bc17ff867176186ad6ff7dc972a6037ed35d
Instruction ID: 22b00a93152bfe5290bd39cd4ee72051211b62c985d208d151eea20f606bb48e
Opcode Fuzzy Hash: 1368422e5703f006b4c2e4099048bc17ff867176186ad6ff7dc972a6037ed35d
Instruction Fuzzy Hash: 01E08C31818585AEDB12DB5CC840BA9BB72FF84308F014028E1203A9B2CB7A5D90DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DFC53CA, Relevance: 3.0, APIs: 2, Instructions: 16
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DFC53CA(long __ebx) {
				intOrPtr _t7;
				long _t13;
				void* _t14;
				void* _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E6DF5EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *(_t16 - 0x6c);
				}
				if(_t15 != 0) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x6dfc53ca
0x6dfc53ce
0x6dfc53d9
0x6dfc53de
0x6dfc53e1
0x6dfc53e1
0x6dfc53e6
0x6dfc53f3
0x00000000
0x6dfc53f8
0x6dfc53fb

APIs

RtlLeaveCriticalSection.9419(?,6DFC53BA,?,?,?,?,?,?,?,?,?,?,?,6E0205F0,00000080,6DFB5CA1), ref: 6DFC53D9
RtlFreeHeap.9419(?,00000000,?,6DFC53BA,?,?,?,?,?,?,?,?,?,?,?,6E0205F0), ref: 6DFC53F3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalFreeHeapLeaveSection
String ID:
API String ID: 681598451-0
Opcode ID: a714b8595cd1ddaba1e7788f3521a58498cce96b12395a284aa87494bdbdc67f
Instruction ID: 3d18f339bc678bd89886425832bf08efe796432460c48c01ea3bea398b01238c
Opcode Fuzzy Hash: a714b8595cd1ddaba1e7788f3521a58498cce96b12395a284aa87494bdbdc67f
Instruction Fuzzy Hash: 4CE08C319046C19BCF02CF4CC650F6EB7F6FB44B00F110444A0085BB20C764EC10CB00

Uniqueness

Uniqueness Score: -1.00%

Function 6DF73B48, Relevance: 3.0, APIs: 2, Instructions: 13
nativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6DF73B48(void* __eax, intOrPtr __ebx, void* __edi, void* __esi) {
				void* _t6;
				void* _t7;
				intOrPtr _t8;
				void* _t10;
				void* _t11;

				_t10 = __esi;
				_t8 = __ebx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x3c)) != __ebx || __edi < 0) {
					_push( *((intOrPtr*)(_t10 + 0x28)));
					_t6 = E6DF895D0();
					if( *((intOrPtr*)(_t10 + 0x24)) != 0) {
						_push( *((intOrPtr*)(_t10 + 0x24)));
						_t7 = E6DF895D0();
						 *((intOrPtr*)(_t10 + 0x24)) = _t8;
						return _t7;
					}
				}
				return _t6;
			}

0x6df73b48
0x6df73b48
0x6df73b48
0x6df73b4b
0x6dfb61b5
0x6dfb61b8
0x6dfb61c1
0x6dfb61c7
0x6dfb61ca
0x6dfb61cf
0x00000000
0x6dfb61cf
0x6dfb61c1
0x6df73b59

APIs

ZwClose.9419(?,6DF73AD9,00000024,000F00FF,00000000,?,000000FF,6DF6C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6DFB61B8
ZwClose.9419(?,?,6DF73AD9,00000024,000F00FF,00000000,?,000000FF,6DF6C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000), ref: 6DFB61CA

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 29a413cd54eebca8f368980a11ded4b24e320ec0c74e9d3bed94c3a6e0eea6a8
Instruction ID: be14cdbd57941843e305f2575d3d68012457c4850070c951d109e36671a36c1c
Opcode Fuzzy Hash: 29a413cd54eebca8f368980a11ded4b24e320ec0c74e9d3bed94c3a6e0eea6a8
Instruction Fuzzy Hash: 84D0C979404B01EACB225F2ED98079AB6F2AF48B09F41653EA26A09962EF759440DB41

Uniqueness

Uniqueness Score: -1.00%

Function 6DF49335, Relevance: 3.0, APIs: 2, Instructions: 12
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DF49335(void* __ecx) {
				void* _t10;

				_push( *(__ecx + 0x14));
				E6DF895D0();
				_push( *(__ecx + 0x10));
				 *(__ecx + 0x38) =  *(__ecx + 0x38) & 0x00000000;
				_t10 = E6DF895D0();
				 *(__ecx + 0x14) =  *(__ecx + 0x14) & 0x00000000;
				 *(__ecx + 0x10) =  *(__ecx + 0x10) & 0x00000000;
				return _t10;
			}

0x6df4933a
0x6df4933d
0x6df49342
0x6df49345
0x6df49349
0x6df4934e
0x6df49352
0x6df49357

APIs

ZwClose.9419(?,?,6DF4926B,6E01F708,0000000C,6DF49219), ref: 6DF4933D
ZwClose.9419(?,?,?,6DF4926B,6E01F708,0000000C,6DF49219), ref: 6DF49349

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: e523df6f13e95c3d743f3e15b051859ddb587bfbdd573486637120e274cce783
Instruction ID: 94aeb1e7e81fa67b50241da3189315ef2caac00bd4106ced0dea3bcf329d3683
Opcode Fuzzy Hash: e523df6f13e95c3d743f3e15b051859ddb587bfbdd573486637120e274cce783
Instruction Fuzzy Hash: B8D09232414B109BD7715E24E509752B6F1AB4033BF121E1D909205C519BB4A9589A96

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8B650, Relevance: 3.0, APIs: 2, Instructions: 10
nativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E6DF8B650(intOrPtr _a4) {

				E6DFFB590(_a4);
				_push(0xc0000409);
				_push(0xffffffff);
				return E6DF897C0();
			}

0x6df8b658
0x6df8b65d
0x6df8b662
0x6df8b66a

APIs

RtlUnhandledExceptionFilter.9419(?,?,6DF8B7CB,6DF21650,6E035DD8,?,6DF8B766,00000008,?,6DF9F510,?,?,?,?,?,?), ref: 6DF8B658

Part of subcall function 6DFFB590: RtlUnhandledExceptionFilter2.9419(?,6DF248A4,?,?,6DF8B74A,6DF21650,6DF8B627,6DF8B627,?,6DF9D13A,6DF4B1DE,6E01F7A8,00000090,6DF4B16E,00000003,6DF8B627), ref: 6DFFB59E

ZwTerminateProcess.9419(000000FF,C0000409,?,?,6DF8B7CB,6DF21650,6E035DD8,?,6DF8B766,00000008,?,6DF9F510,?,?,?,?), ref: 6DF8B664

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionUnhandled$FilterFilter2ProcessTerminate
String ID:
API String ID: 1586208841-0
Opcode ID: 1707e34f934d6586f08c26c7dabf82619f548b17d12cfc673a361a3489f133d6
Instruction ID: 88870be305b5eb8db7d71a9b2a250630356fbac6cdaef42b261b06d7fc2f4d07
Opcode Fuzzy Hash: 1707e34f934d6586f08c26c7dabf82619f548b17d12cfc673a361a3489f133d6
Instruction Fuzzy Hash: 16B0923240824C36DF002A9AAC00C093A198A8177CB2B8710B73C660E2AF22AD9280DA

Uniqueness

Uniqueness Score: -1.00%

Function 6DF66E30, Relevance: 1.7, APIs: 1, Instructions: 481
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E6DF66E30(signed short __ecx, signed short __edx, void* _a4, int* _a8, char* _a12, int* _a16) {
				signed int _v8;
				signed int _v12;
				char _v20;
				signed int _v32;
				signed short _v34;
				intOrPtr _v36;
				signed short _v38;
				signed short _v40;
				char _v41;
				void* _v48;
				short _v50;
				signed int _v52;
				signed short _v54;
				signed int _v56;
				char _v57;
				signed int _v64;
				signed int _v68;
				signed short _v70;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed short _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed short _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				char _v136;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t312;
				signed int _t313;
				char* _t315;
				unsigned int _t316;
				signed int _t317;
				short* _t319;
				void* _t320;
				signed int _t321;
				int _t322;
				signed short _t327;
				signed int _t328;
				signed int _t335;
				signed short* _t336;
				signed int _t337;
				signed int _t338;
				signed int _t349;
				signed short _t352;
				signed int _t357;
				signed int _t360;
				signed int _t363;
				void* _t365;
				signed int _t366;
				signed short* _t367;
				signed int _t369;
				signed int _t375;
				signed int _t379;
				signed int _t384;
				void* _t386;
				intOrPtr _t387;
				signed short _t389;
				int* _t392;
				signed int _t397;
				unsigned int _t399;
				signed int _t401;
				signed int _t402;
				signed int _t407;
				void* _t415;
				signed short _t417;
				unsigned int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t422;
				int* _t433;
				signed int _t435;
				intOrPtr _t436;
				signed int _t437;
				signed int _t438;
				signed int _t440;
				signed short _t443;
				intOrPtr _t444;
				signed int _t445;
				signed int _t446;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t453;

				_t425 = __edx;
				_push(0xfffffffe);
				_push(0x6e01fca8);
				_push(0x6df917f0);
				_push( *[fs:0x0]);
				_t312 =  *0x6e03d360;
				_v12 = _v12 ^ _t312;
				_t313 = _t312 ^ _t453;
				_v32 = _t313;
				_push(_t313);
				 *[fs:0x0] =  &_v20;
				_v116 = __edx;
				_t443 = __ecx;
				_v88 = __ecx;
				_t386 = _a4;
				_t433 = _a8;
				_v112 = _t433;
				_t315 = _a12;
				_v64 = _t315;
				_t392 = _a16;
				_v108 = _t392;
				if(_t433 != 0) {
					 *_t433 = 0;
				}
				if(_t315 != 0) {
					 *_t315 = 0;
				}
				if(_t425 > 0xffff) {
					_v116 = 0xffff;
				}
				 *_t392 = 0;
				_t392[1] = 0;
				_t316 =  *_t443 & 0x0000ffff;
				_v104 = _t316;
				_t435 = _t316 >> 1;
				_v120 = _t435;
				if(_t435 == 0) {
					L124:
					_t317 = 0;
					goto L60;
				} else {
					_t319 =  *((intOrPtr*)(_t443 + 4));
					if( *_t319 != 0) {
						_t397 = _t435;
						_t320 = _t319 + _t435 * 2;
						_t425 = _t320 - 2;
						while(_t397 != 0) {
							if( *_t425 == 0x20) {
								_t397 = _t397 - 1;
								_t425 = _t425 - 2;
								continue;
							}
							if(_t397 == 0) {
								goto L124;
							}
							_t321 =  *(_t320 - 2) & 0x0000ffff;
							if(_t321 == 0x5c || _t321 == 0x2f) {
								_v57 = 0;
							} else {
								_v57 = 1;
							}
							_t322 = _v116;
							_t399 = _t322 >> 1;
							_v92 = _t399;
							_v128 = _t399;
							memset(_t386, 0, _t322);
							_v56 = 0;
							_v52 = 0;
							_v50 = _v92 + _v92;
							_v48 = _t386;
							_t327 = E6DF674C0(_t443);
							if(_t327 != 0) {
								_t389 = _t327 >> 0x10;
								_t328 = _t327 & 0x0000ffff;
								_v112 = _t328;
								_t437 = _v64;
								if(_t437 == 0) {
									L122:
									_t438 = _t328 + 8;
									_t401 = _v92;
									if(_t438 >= (_t401 + _t401 & 0x0000ffff)) {
										_t402 = _t438 + 2;
										asm("sbb eax, eax");
										_t317 =  !0xffff & _t402;
									} else {
										E6DF79BC6( &_v52, 0x6df21080);
										_t425 =  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2;
										E6DF89377( &_v52,  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2, _v112);
										_t317 = _t438;
									}
									goto L60;
								}
								if(_t389 != 0) {
									_t425 = _t389;
									_t335 = E6DFC46A7(_t443, _t389, _t437);
									if(_t335 < 0) {
										goto L124;
									}
									if( *_t437 != 0) {
										goto L124;
									}
									_t328 = _v112;
								}
								goto L122;
							} else {
								_t425 = _t443;
								_t336 =  *(_t425 + 4);
								_t407 =  *_t425 & 0x0000ffff;
								if(_t407 < 2) {
									L17:
									if(_t407 < 4 ||  *_t336 == 0 || _t336[1] != 0x3a) {
										_t337 = 5;
									} else {
										if(_t407 < 6) {
											L98:
											_t337 = 3;
											L23:
											 *_v108 = _t337;
											_t409 = 0;
											_v72 = 0;
											_v68 = 0;
											_v64 = 0;
											_v84 = 0;
											_v41 = 0;
											_t445 = 0;
											_v76 = 0;
											_v8 = 0;
											if(_t337 != 2) {
												_t338 = _t337 - 1;
												if(_t338 > 6) {
													L164:
													_t446 = 0;
													_v64 = 0;
													_t439 = _v92;
													goto L59;
												}
												switch( *((intOrPtr*)(_t338 * 4 +  &M6DF6749C))) {
													case 0:
														__ecx = 0;
														__eflags = 0;
														_v124 = 0;
														__esi = 2;
														while(1) {
															_v100 = __esi;
															__eflags = __esi - __edi;
															if(__esi >= __edi) {
																break;
															}
															__eax =  *(__edx + 4);
															__eax =  *( *(__edx + 4) + __esi * 2) & 0x0000ffff;
															__eflags = __eax - 0x5c;
															if(__eax == 0x5c) {
																L140:
																__ecx = __ecx + 1;
																_v124 = __ecx;
																__eflags = __ecx - 2;
																if(__ecx == 2) {
																	break;
																}
																L141:
																__esi = __esi + 1;
																continue;
															}
															__eflags = __eax - 0x2f;
															if(__eax != 0x2f) {
																goto L141;
															}
															goto L140;
														}
														__eax = __esi;
														_v80 = __esi;
														__eax =  *(__edx + 4);
														_v68 =  *(__edx + 4);
														__eax = __esi + __esi;
														_v72 = __ax;
														__eax =  *(__edx + 2) & 0x0000ffff;
														_v70 = __ax;
														_v76 = __esi;
														goto L80;
													case 1:
														goto L164;
													case 2:
														__eax = L6DF452A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
														} else {
															__ebx = __eax + 0xc;
														}
														 *(__ebx + 4) =  *( *(__ebx + 4)) & 0x0000ffff;
														__eax = E6DF52600( *( *(__ebx + 4)) & 0x0000ffff);
														__si = __ax;
														_v88 =  *(_v88 + 4);
														__ecx =  *( *(_v88 + 4)) & 0x0000ffff;
														__eax = E6DF52600( *( *(_v88 + 4)) & 0x0000ffff);
														_v54 = __ax;
														__eflags = __ax - __ax;
														if(__eflags != 0) {
															__cx = __ax;
															L6DFC4735(__ecx, __edx, __eflags) = 0x3d;
															_v40 = __ax;
															__si = _v54;
															_v38 = __si;
															_v36 = 0x3a;
															 &_v40 =  &_v136;
															E6DF8BB40(__ecx,  &_v136,  &_v40) =  &_v52;
															__eax =  &_v136;
															__eax = L6DF72010(__ecx, 0,  &_v136,  &_v52);
															__eflags = __eax;
															if(__eax >= 0) {
																__ax = _v52;
																_v56 = __eax;
																__edx = __ax & 0x0000ffff;
																__ecx = __edx;
																__ecx = __edx >> 1;
																_v100 = __ecx;
																__eflags = __ecx - 3;
																if(__ecx <= 3) {
																	L155:
																	__ebx = _v48;
																	L156:
																	_v72 = __ax;
																	goto L119;
																}
																__eflags = __ecx - _v92;
																if(__ecx >= _v92) {
																	goto L155;
																}
																__esi = 0x5c;
																__ebx = _v48;
																 *(__ebx + __ecx * 2) = __si;
																__eax = __edx + 2;
																_v56 = __edx + 2;
																_v52 = __ax;
																goto L156;
															}
															__eflags = __eax - 0xc0000023;
															if(__eax != 0xc0000023) {
																__eax = 0;
																_v52 = __ax;
																_v40 = __si;
																_v38 = 0x5c003a;
																_v34 = __ax;
																__edx =  &_v40;
																__ecx =  &_v52;
																L6DFC4658(__ecx,  &_v40) = 8;
																_v72 = __ax;
																__ebx = _v48;
																__ax = _v52;
																_v56 = 8;
																goto L119;
															}
															__ax = _v52;
															_v56 = __eax;
															__eax = __ax & 0x0000ffff;
															__eax = (__ax & 0x0000ffff) + 2;
															_v64 = __eax;
															__eflags = __eax - 0xffff;
															if(__eax <= 0xffff) {
																_v72 = __ax;
																__ebx = _v48;
																goto L119;
															}
															__esi = 0;
															_v64 = 0;
															__ebx = _v48;
															__edi = _v92;
															goto L58;
														} else {
															__eax =  *__ebx;
															_v72 =  *__ebx;
															__eax =  *(__ebx + 4);
															_v68 =  *(__ebx + 4);
															__edx =  &_v72;
															__ecx =  &_v52;
															__eax = E6DF79BC6(__ecx,  &_v72);
															__ebx = _v48;
															__eax = _v52 & 0x0000ffff;
															_v56 = _v52 & 0x0000ffff;
															L119:
															__eax = 3;
															_v80 = 3;
															__esi = 2;
															_v76 = 2;
															__edx = _v88;
															goto L25;
														}
													case 3:
														__eax = L6DF452A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
															__eflags = __ebx;
															__esi = _v76;
														} else {
															__ebx = __eax + 0xc;
														}
														__ecx = __ebx;
														__eax = L6DF483AE(__ebx);
														_v80 = __eax;
														__ecx =  *__ebx;
														_v72 =  *__ebx;
														__ecx =  *(__ebx + 4);
														_v68 = __ecx;
														__eflags = __eax - 3;
														if(__eax == 3) {
															__eax = 4;
															_v72 = __ax;
														} else {
															__ecx = __eax + __eax;
															_v72 = __cx;
														}
														goto L80;
													case 4:
														_t340 = L6DF452A5(0);
														_v84 = _t340;
														_v41 = 1;
														__eflags = _t340;
														if(_t340 == 0) {
															_t428 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
															_t445 = _v76;
														} else {
															_t428 = _t340 + 0xc;
															 *((intOrPtr*)(_v108 + 4)) =  *((intOrPtr*)(_t340 + 0x14));
														}
														_v72 =  *_t428;
														_v68 = _t428[2];
														_v80 = L6DF483AE(_t428);
														L80:
														E6DF79BC6( &_v52,  &_v72);
														_t386 = _v48;
														_v56 = _v52 & 0x0000ffff;
														_t425 = _v88;
														goto L25;
													case 5:
														__eax = 4;
														_v80 = 4;
														__esi = 4;
														_v76 = 4;
														__eflags = __edi - 4;
														if(__edi < 4) {
															__esi = __edi;
															_v76 = __esi;
														}
														__eax =  *0x6df21080;
														_v72 =  *0x6df21080;
														__eax =  *0x6df21084;
														_v68 =  *0x6df21084;
														__edx =  &_v72;
														__ecx =  &_v52;
														__eax = E6DF79BC6(__ecx,  &_v72);
														__eax = _v52 & 0x0000ffff;
														_v56 = __eax;
														__edx = _v88;
														__ebx = _v48;
														__eflags = __eax - 6;
														if(__eax >= 6) {
															__eax =  *(__edx + 4);
															__ax =  *((intOrPtr*)(__eax + 4));
															 *(__ebx + 4) =  *((intOrPtr*)(__eax + 4));
														}
														__eax = _v108;
														__eflags =  *_v108 - 7;
														if( *_v108 == 7) {
															_v57 = 0;
														}
														goto L25;
												}
											} else {
												_v80 = 3;
												L25:
												_t349 = _v104 + (_v72 & 0x0000ffff) - _t445 + _t445;
												_v104 = _t349;
												_t415 = _t349 + 2;
												if(_t415 > _v116) {
													if(_t435 <= 1) {
														if( *( *(_t425 + 4)) != 0x2e) {
															goto L72;
														}
														if(_t435 != 1) {
															asm("sbb esi, esi");
															_t446 =  !_t445 & _v104;
															_v64 = _t446;
															_t439 = _v92;
															L58:
															_t409 = _v84;
															L59:
															_v8 = 0xfffffffe;
															E6DF6746D(_t386, _t409, _t439, _t446);
															_t317 = _t446;
															L60:
															 *[fs:0x0] = _v20;
															_pop(_t436);
															_pop(_t444);
															_pop(_t387);
															return E6DF8B640(_t317, _t387, _v32 ^ _t453, _t425, _t436, _t444);
														}
														_t417 = _v72;
														if(_t417 != 8) {
															if(_v116 >= (_t417 & 0x0000ffff)) {
																_t352 = _v56;
																_t418 = _t352 & 0x0000ffff;
																_v104 = _t418;
																_t419 = _t418 >> 1;
																_v100 = _t419;
																if(_t419 != 0) {
																	if( *((short*)(_t386 + _t419 * 2 - 2)) == 0x5c) {
																		_t352 = _v104 + 0xfffffffe;
																		_v56 = _t352;
																		_v52 = _t352;
																	}
																}
																L27:
																_t420 = 0;
																_v100 = 0;
																L28:
																L28:
																if(_t420 < (_t352 & 0x0000ffff) >> 1) {
																	goto L69;
																} else {
																	_t422 = (_v56 & 0x0000ffff) >> 1;
																	_v96 = _t422;
																}
																while(_t445 < _t435) {
																	_t363 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																	if(_t363 == 0x5c) {
																		L44:
																		if(_t422 == 0) {
																			L46:
																			 *(_t386 + _t422 * 2) = 0x5c;
																			_t422 = _t422 + 1;
																			_v96 = _t422;
																			L43:
																			_t445 = _t445 + 1;
																			_v76 = _t445;
																			continue;
																		}
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			goto L43;
																		}
																		goto L46;
																	}
																	_t365 = _t363 - 0x2e;
																	if(_t365 == 0) {
																		_t126 = _t445 + 1; // 0x2
																		_t366 = _t126;
																		_v104 = _t366;
																		if(_t366 == _t435) {
																			goto L43;
																		}
																		_t367 =  *(_t425 + 4);
																		_t440 =  *(_t367 + 2 + _t445 * 2) & 0x0000ffff;
																		_v108 = _t440;
																		_t435 = _v120;
																		if(_t440 != 0x5c) {
																			if(_v108 == 0x2f) {
																				goto L83;
																			}
																			if(_v108 != 0x2e) {
																				L35:
																				while(_t445 < _t435) {
																					_t369 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																					if(_t369 == 0x5c || _t369 == 0x2f) {
																						if(_t445 < _t435) {
																							if(_t422 >= 2) {
																								if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x2e) {
																									if( *((short*)(_t386 + _t422 * 2 - 4)) != 0x2e) {
																										_t422 = _t422 - 1;
																										_v96 = _t422;
																									}
																								}
																							}
																						}
																						break;
																					} else {
																						 *(_t386 + _t422 * 2) = _t369;
																						_t422 = _t422 + 1;
																						_v96 = _t422;
																						_t445 = _t445 + 1;
																						_v76 = _t445;
																						continue;
																					}
																				}
																				_t445 = _t445 - 1;
																				_v76 = _t445;
																				goto L43;
																			}
																			_t155 = _t445 + 2; // 0x3
																			_t425 = _v88;
																			if(_t155 == _t435) {
																				while(1) {
																					L103:
																					if(_t422 < _v80) {
																						break;
																					}
																					 *(_t386 + _t422 * 2) = 0;
																					_t425 = _v88;
																					if( *(_t386 + _t422 * 2) != 0x5c) {
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																						continue;
																					} else {
																						goto L105;
																					}
																					while(1) {
																						L105:
																						if(_t422 < _v80) {
																							goto L180;
																						}
																						 *(_t386 + _t422 * 2) = 0;
																						_t435 = _v120;
																						if( *(_t386 + _t422 * 2) == 0x5c) {
																							if(_t422 < _v80) {
																								goto L180;
																							}
																							L110:
																							_t445 = _t445 + 1;
																							_v76 = _t445;
																							goto L43;
																						}
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																					}
																					break;
																				}
																				L180:
																				_t422 = _t422 + 1;
																				_v96 = _t422;
																				goto L110;
																			}
																			_t375 =  *(_t367 + 4 + _t445 * 2) & 0x0000ffff;
																			if(_t375 != 0x5c) {
																				if(_t375 != 0x2f) {
																					goto L35;
																				}
																			}
																			goto L103;
																		}
																		L83:
																		_t445 = _v104;
																		_v76 = _t445;
																		goto L43;
																	}
																	if(_t365 == 1) {
																		goto L44;
																	} else {
																		goto L35;
																	}
																}
																_t449 = _v80;
																if(_v57 != 0) {
																	if(_t422 > _t449) {
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			_t422 = _t422 - 1;
																			_v96 = _t422;
																		}
																	}
																}
																_t439 = _v92;
																if(_t422 >= _v92) {
																	L52:
																	if(_t422 == 0) {
																		L56:
																		_t425 = _t422 + _t422;
																		_v52 = _t425;
																		if(_v112 != 0) {
																			_t357 = _t422;
																			while(1) {
																				_v100 = _t357;
																				if(_t357 == 0) {
																					break;
																				}
																				if( *((short*)(_t386 + _t357 * 2 - 2)) == 0x5c) {
																					break;
																				}
																				_t357 = _t357 - 1;
																			}
																			if(_t357 >= _t422) {
																				L113:
																				 *_v112 = 0;
																				goto L57;
																			}
																			if(_t357 < _t449) {
																				goto L113;
																			}
																			 *_v112 = _t386 + _t357 * 2;
																		}
																		L57:
																		_t446 = _t425 & 0x0000ffff;
																		_v64 = _t446;
																		goto L58;
																	}
																	_t422 = _t422 - 1;
																	_v96 = _t422;
																	_t360 =  *(_t386 + _t422 * 2) & 0x0000ffff;
																	if(_t360 == 0x20) {
																		goto L51;
																	}
																	if(_t360 == 0x2e) {
																		goto L51;
																	}
																	_t422 = _t422 + 1;
																	_v96 = _t422;
																	goto L56;
																} else {
																	L51:
																	 *(_t386 + _t422 * 2) = 0;
																	goto L52;
																}
																L69:
																if( *((short*)(_t386 + _t420 * 2)) == 0x2f) {
																	 *((short*)(_t386 + _t420 * 2)) = 0x5c;
																}
																_t420 = _t420 + 1;
																_v100 = _t420;
																_t352 = _v56;
																goto L28;
															}
															_t446 = _t417 & 0x0000ffff;
															_v64 = _t446;
															_t439 = _v92;
															goto L58;
														}
														if(_v116 > 8) {
															goto L26;
														}
														_t446 = 0xa;
														_v64 = 0xa;
														_t439 = _v92;
														goto L58;
													}
													L72:
													if(_t415 > 0xffff) {
														_t446 = 0;
													}
													_v64 = _t446;
													_t439 = _v92;
													goto L58;
												}
												L26:
												_t352 = _v56;
												goto L27;
											}
										}
										_t379 = _t336[2] & 0x0000ffff;
										if(_t379 != 0x5c) {
											if(_t379 == 0x2f) {
												goto L22;
											}
											goto L98;
										}
										L22:
										_t337 = 2;
									}
									goto L23;
								}
								_t450 =  *_t336 & 0x0000ffff;
								if(_t450 == 0x5c || _t450 == 0x2f) {
									if(_t407 < 4) {
										L132:
										_t337 = 4;
										goto L23;
									}
									_t451 = _t336[1] & 0x0000ffff;
									if(_t451 != 0x5c) {
										if(_t451 == 0x2f) {
											goto L87;
										}
										goto L132;
									}
									L87:
									if(_t407 < 6) {
										L135:
										_t337 = 1;
										goto L23;
									}
									_t452 = _t336[2] & 0x0000ffff;
									if(_t452 != 0x2e) {
										if(_t452 == 0x3f) {
											goto L89;
										}
										goto L135;
									}
									L89:
									if(_t407 < 8) {
										L134:
										_t337 = ((0 | _t407 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
										goto L23;
									}
									_t384 = _t336[3] & 0x0000ffff;
									if(_t384 != 0x5c) {
										if(_t384 == 0x2f) {
											goto L91;
										}
										goto L134;
									}
									L91:
									_t337 = 6;
									goto L23;
								} else {
									goto L17;
								}
							}
						}
					}
					goto L124;
				}
			}

0x6df66e30
0x6df66e35
0x6df66e37
0x6df66e3c
0x6df66e47
0x6df66e4b
0x6df66e50
0x6df66e53
0x6df66e55
0x6df66e5b
0x6df66e5f
0x6df66e65
0x6df66e68
0x6df66e6a
0x6df66e6d
0x6df66e70
0x6df66e73
0x6df66e76
0x6df66e79
0x6df66e7c
0x6df66e7f
0x6df66e84
0x6df6710f
0x6df6710f
0x6df66e8c
0x6df66e8e
0x6df66e8e
0x6df66e97
0x6dfaf5d3
0x6dfaf5d3
0x6df66e9d
0x6df66ea3
0x6df66eaa
0x6df66ead
0x6df66eb2
0x6df66eb4
0x6df66eb7
0x6df67466
0x6df67466
0x00000000
0x6df66ebd
0x6df66ebd
0x6df66ec4
0x6df66eca
0x6df66ecc
0x6df66ecf
0x6df66ed2
0x6df66ede
0x6dfaf5df
0x6dfaf5e0
0x00000000
0x6dfaf5e0
0x6df66ee6
0x00000000
0x00000000
0x6df66eec
0x6df66ef3
0x6df67181
0x6df66f02
0x6df66f02
0x6df66f02
0x6df66f06
0x6df66f0b
0x6df66f0d
0x6df66f10
0x6df66f17
0x6df66f21
0x6df66f24
0x6df66f2d
0x6df66f31
0x6df66f36
0x6df66f3d
0x6df67413
0x6df67416
0x6df67419
0x6df6741c
0x6df67421
0x6df6742b
0x6df6742b
0x6df6742e
0x6df67439
0x6dfaf60b
0x6dfaf615
0x6dfaf619
0x6df6743f
0x6df67447
0x6df67454
0x6df6745a
0x6df6745f
0x6df6745f
0x00000000
0x6df67439
0x6df67425
0x6dfaf5e9
0x6dfaf5ed
0x6dfaf5f4
0x00000000
0x00000000
0x6dfaf5fd
0x00000000
0x00000000
0x6dfaf603
0x6dfaf603
0x00000000
0x6df66f43
0x6df66f43
0x6df66f45
0x6df66f48
0x6df66f4e
0x6df66f65
0x6df66f68
0x6df6721f
0x6df66f83
0x6df66f86
0x6df672dc
0x6df672dc
0x6df66f9e
0x6df66fa1
0x6df66fa3
0x6df66fa5
0x6df66fa8
0x6df66fab
0x6df66fae
0x6df66fb1
0x6df66fb4
0x6df66fb6
0x6df66fb9
0x6df66fbf
0x6df6718a
0x6df6718e
0x6dfaf831
0x6dfaf831
0x6dfaf833
0x6dfaf836
0x00000000
0x6dfaf836
0x6df67194
0x00000000
0x6dfaf658
0x6dfaf658
0x6dfaf65a
0x6dfaf65d
0x6dfaf662
0x6dfaf662
0x6dfaf665
0x6dfaf667
0x00000000
0x00000000
0x6dfaf669
0x6dfaf66c
0x6dfaf670
0x6dfaf673
0x6dfaf67a
0x6dfaf67a
0x6dfaf67b
0x6dfaf67e
0x6dfaf681
0x00000000
0x00000000
0x6dfaf683
0x6dfaf683
0x00000000
0x6dfaf683
0x6dfaf675
0x6dfaf678
0x00000000
0x00000000
0x00000000
0x6dfaf678
0x6dfaf686
0x6dfaf688
0x6dfaf68b
0x6dfaf68e
0x6dfaf691
0x6dfaf694
0x6dfaf698
0x6dfaf69c
0x6dfaf6a0
0x00000000
0x00000000
0x00000000
0x00000000
0x6df67397
0x6df6739c
0x6df6739f
0x6df673a3
0x6df673a5
0x6dfaf6bb
0x6dfaf6c1
0x6dfaf6c4
0x6df673ab
0x6df673ab
0x6df673ab
0x6df673b1
0x6df673b5
0x6df673ba
0x6df673c0
0x6df673c3
0x6df673c7
0x6df673cc
0x6df673d0
0x6df673d3
0x6dfaf6cc
0x6dfaf6d4
0x6dfaf6d9
0x6dfaf6dd
0x6dfaf6e1
0x6dfaf6e5
0x6dfaf6f0
0x6dfaf6fc
0x6dfaf700
0x6dfaf709
0x6dfaf70e
0x6dfaf710
0x6dfaf784
0x6dfaf788
0x6dfaf78b
0x6dfaf78e
0x6dfaf790
0x6dfaf792
0x6dfaf795
0x6dfaf798
0x6dfaf7b7
0x6dfaf7b7
0x6dfaf7ba
0x6dfaf7ba
0x00000000
0x6dfaf7ba
0x6dfaf79a
0x6dfaf79d
0x00000000
0x00000000
0x6dfaf79f
0x6dfaf7a4
0x6dfaf7a7
0x6dfaf7ab
0x6dfaf7ae
0x6dfaf7b1
0x00000000
0x6dfaf7b1
0x6dfaf712
0x6dfaf717
0x6dfaf74c
0x6dfaf74e
0x6dfaf752
0x6dfaf756
0x6dfaf75d
0x6dfaf761
0x6dfaf764
0x6dfaf76c
0x6dfaf771
0x6dfaf775
0x6dfaf778
0x6dfaf77c
0x00000000
0x6dfaf77c
0x6dfaf719
0x6dfaf71d
0x6dfaf720
0x6dfaf723
0x6dfaf726
0x6dfaf729
0x6dfaf72e
0x6dfaf740
0x6dfaf744
0x00000000
0x6dfaf744
0x6dfaf730
0x6dfaf732
0x6dfaf735
0x6dfaf738
0x00000000
0x6df673d9
0x6df673d9
0x6df673db
0x6df673de
0x6df673e1
0x6df673e4
0x6df673e7
0x6df673ea
0x6df673ef
0x6df673f2
0x6df673f6
0x6df673f9
0x6df673f9
0x6df673fe
0x6df67401
0x6df67406
0x6df67409
0x00000000
0x6df67409
0x00000000
0x6dfaf7c5
0x6dfaf7ca
0x6dfaf7cd
0x6dfaf7d1
0x6dfaf7d3
0x6dfaf7da
0x6dfaf7e0
0x6dfaf7e3
0x6dfaf7e3
0x6dfaf7e6
0x6dfaf7d5
0x6dfaf7d5
0x6dfaf7d5
0x6dfaf7e9
0x6dfaf7eb
0x6dfaf7f0
0x6dfaf7f3
0x6dfaf7f5
0x6dfaf7f8
0x6dfaf7fb
0x6dfaf7fe
0x6dfaf801
0x6dfaf80f
0x6dfaf814
0x6dfaf803
0x6dfaf803
0x6dfaf806
0x6dfaf806
0x00000000
0x00000000
0x6df6719d
0x6df671a2
0x6df671a5
0x6df671a9
0x6df671ab
0x6dfaf826
0x6dfaf829
0x6df671b1
0x6df671b1
0x6df671ba
0x6df671ba
0x6df671bf
0x6df671c5
0x6df671cf
0x6df671d2
0x6df671d8
0x6df671dd
0x6df671e4
0x6df671e7
0x00000000
0x00000000
0x6df67275
0x6df6727a
0x6df6727d
0x6df6727f
0x6df67282
0x6df67284
0x6dfaf6a8
0x6dfaf6aa
0x6dfaf6aa
0x6df6728a
0x6df6728f
0x6df67292
0x6df67297
0x6df6729a
0x6df6729d
0x6df672a0
0x6df672a5
0x6df672a9
0x6df672ac
0x6df672af
0x6df672b2
0x6df672b5
0x6df672b7
0x6df672ba
0x6df672be
0x6df672be
0x6df672c2
0x6df672c5
0x6df672c8
0x6dfaf6b2
0x6dfaf6b2
0x00000000
0x00000000
0x6df66fc5
0x6df66fc5
0x6df66fcc
0x6df66fd8
0x6df66fda
0x6df66fdd
0x6df66fe3
0x6df67162
0x6dfaf845
0x00000000
0x00000000
0x6dfaf84e
0x6dfaf8c4
0x6dfaf8c8
0x6dfaf8cb
0x6dfaf8ce
0x6df670e0
0x6df670e0
0x6df670e3
0x6df670e3
0x6df670ea
0x6df670ef
0x6df670f1
0x6df670f4
0x6df670fc
0x6df670fd
0x6df670fe
0x6df6710c
0x6df6710c
0x6dfaf850
0x6dfaf858
0x6dfaf87a
0x6dfaf88a
0x6dfaf88d
0x6dfaf890
0x6dfaf893
0x6dfaf895
0x6dfaf898
0x6dfaf8a4
0x6dfaf8ad
0x6dfaf8b0
0x6dfaf8b3
0x6dfaf8b3
0x6dfaf8a4
0x6df66fec
0x6df66fec
0x6df66fee
0x00000000
0x6df66ff1
0x6df66ff8
0x00000000
0x6df66ffe
0x6df67004
0x6df67006
0x6df67006
0x6df67010
0x6df67017
0x6df6701e
0x6df67072
0x6df67074
0x6df6707e
0x6df67083
0x6df67087
0x6df67088
0x6df6706c
0x6df6706c
0x6df6706d
0x00000000
0x6df6706d
0x6df6707c
0x00000000
0x00000000
0x00000000
0x6df6707c
0x6df67020
0x6df67023
0x6df671ef
0x6df671ef
0x6df671f2
0x6df671f7
0x00000000
0x00000000
0x6df671fd
0x6df67200
0x6df67205
0x6df6720b
0x6df6720e
0x6df672eb
0x00000000
0x00000000
0x6df672f6
0x00000000
0x6df67030
0x6df67037
0x6df6703e
0x6df67055
0x6df6705a
0x6df67062
0x6dfaf908
0x6dfaf90e
0x6dfaf90f
0x6dfaf90f
0x6dfaf908
0x6df67062
0x6df6705a
0x00000000
0x6df67045
0x6df67045
0x6df67049
0x6df6704a
0x6df6704d
0x6df6704e
0x00000000
0x6df6704e
0x6df6703e
0x6df67068
0x6df67069
0x00000000
0x6df67069
0x6df672fc
0x6df67301
0x6df67304
0x6df67314
0x6df67314
0x6df67319
0x00000000
0x00000000
0x6df67325
0x6df6732d
0x6df67330
0x6df67356
0x6df67357
0x00000000
0x00000000
0x00000000
0x00000000
0x6df67332
0x6df67332
0x6df67337
0x00000000
0x00000000
0x6df67343
0x6df6734b
0x6df6734e
0x6df67361
0x00000000
0x00000000
0x6df67367
0x6df67367
0x6df67368
0x00000000
0x6df67368
0x6df67350
0x6df67351
0x6df67351
0x00000000
0x6df67332
0x6dfaf8f9
0x6dfaf8f9
0x6dfaf8fa
0x00000000
0x6dfaf8fa
0x6df67306
0x6df6730e
0x6dfaf8ee
0x00000000
0x00000000
0x6dfaf8f4
0x00000000
0x6df6730e
0x6df67214
0x6df67214
0x6df67217
0x00000000
0x6df67217
0x6df6702c
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6702c
0x6df6708d
0x6df67094
0x6df67098
0x6df670a0
0x6df6738c
0x6df6738d
0x6df6738d
0x6df670a0
0x6df67098
0x6df670a6
0x6df670ab
0x6df670b3
0x6df670b5
0x6df670cd
0x6df670cd
0x6df670d0
0x6df670d8
0x6df6711a
0x6df6711c
0x6df6711c
0x6df67121
0x00000000
0x00000000
0x6df67129
0x00000000
0x00000000
0x6df6712b
0x6df6712b
0x6df67130
0x6df6737e
0x6df67381
0x00000000
0x6df67381
0x6df67138
0x00000000
0x00000000
0x6df67144
0x6df67144
0x6df670da
0x6df670da
0x6df670dd
0x00000000
0x6df670dd
0x6df670b7
0x6df670b8
0x6df670bb
0x6df670c2
0x00000000
0x00000000
0x6df670c7
0x00000000
0x00000000
0x6df670c9
0x6df670ca
0x00000000
0x6df670ad
0x6df670ad
0x6df670af
0x00000000
0x6df670af
0x6df67148
0x6df6714d
0x6dfaf8e2
0x6dfaf8e2
0x6df67153
0x6df67154
0x6df67157
0x00000000
0x6df67157
0x6dfaf87c
0x6dfaf87f
0x6dfaf882
0x00000000
0x6dfaf882
0x6dfaf85e
0x00000000
0x00000000
0x6dfaf864
0x6dfaf869
0x6dfaf86c
0x00000000
0x6dfaf86c
0x6df67168
0x6df67170
0x6dfaf8d6
0x6dfaf8d6
0x6df67176
0x6df67179
0x00000000
0x6df67179
0x6df66fe9
0x6df66fe9
0x00000000
0x6df66fe9
0x6df66fbf
0x6df66f8c
0x6df66f93
0x6df672d6
0x00000000
0x00000000
0x00000000
0x6df672d6
0x6df66f99
0x6df66f99
0x6df66f99
0x00000000
0x6df66f68
0x6df66f50
0x6df66f56
0x6df6722c
0x6dfaf629
0x6dfaf629
0x00000000
0x6dfaf629
0x6df67232
0x6df67239
0x6dfaf623
0x00000000
0x00000000
0x00000000
0x6dfaf623
0x6df6723f
0x6df67242
0x6dfaf64e
0x6dfaf64e
0x00000000
0x6dfaf64e
0x6df67248
0x6df6724f
0x6df67373
0x00000000
0x00000000
0x00000000
0x6df67379
0x6df67255
0x6df67258
0x6dfaf63c
0x6dfaf648
0x00000000
0x6dfaf648
0x6df6725e
0x6df67265
0x6dfaf636
0x00000000
0x00000000
0x00000000
0x6dfaf636
0x6df6726b
0x6df6726b
0x00000000
0x00000000
0x00000000
0x00000000
0x6df66f56
0x6df66f3d
0x6df66ed2
0x00000000
0x6df66ec4

APIs

memset.9419(01000000,00000000,?,?,00000024,00000000,?), ref: 6DF66F17

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 27d18a4fa724a19bf79493d76c4f01d526e13a15bc6416648157f688d344110c
Instruction ID: b8d18c5611d1c8747e4675d16a6602eaa5f24e4f7e1a692fe4309cd31704e418
Opcode Fuzzy Hash: 27d18a4fa724a19bf79493d76c4f01d526e13a15bc6416648157f688d344110c
Instruction Fuzzy Hash: E4029F71D1429ADBCB24CF9CC4806ADB7B1FF45700F25812EE825EBE91E7709891CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7DFDF, Relevance: 1.7, APIs: 1, Instructions: 161
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6DF7DFDF(unsigned int __ecx, char __edx) {
				signed int _v8;
				unsigned int _v12;
				signed int* _v16;
				signed int _v20;
				signed int _v24;
				char _v25;
				signed int _v26;
				signed int _t57;
				signed int _t58;
				intOrPtr _t63;
				intOrPtr* _t64;
				signed int _t70;
				signed int* _t77;
				signed int _t80;
				signed int _t82;
				signed int _t88;
				signed int _t89;
				signed int _t90;
				intOrPtr _t91;
				intOrPtr _t92;
				signed int _t93;
				signed int _t95;
				signed int _t100;
				signed int _t102;
				signed int _t105;
				signed int _t106;
				signed int _t110;
				signed int _t112;

				_v24 = _v24 & 0x00000000;
				_v25 = __edx;
				_v12 = __ecx;
				_t77 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + ((__ecx >> 0x00000005 & 0x0000007f) + 0x97) * 4;
				_t57 = 0;
				_t95 =  *_t77;
				_v16 = _t77;
				_v26 = 0;
				if(_t95 == 0) {
					L20:
					return _t57;
				}
				while((_t95 & 0x00000001) == 0) {
					_t57 = _t95;
					if((_t95 & 0x00000002) != 0) {
						asm("lock cmpxchg [ebx], ecx");
						if(_t57 == _t95) {
							goto L20;
						}
						L30:
						_t95 = _t57;
						if(_t57 != 0) {
							continue;
						}
						goto L20;
					}
					_t110 = _t95 | 0x00000002;
					asm("lock cmpxchg [ebx], ecx");
					if(_t57 != _t95) {
						goto L30;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t80 = _t110 & 0xfffffffc;
						_v8 = _t80;
						_t105 = _t80;
						if( *((intOrPtr*)(_t80 + 0x10)) == 0) {
							goto L32;
						}
						L5:
						_t106 =  *((intOrPtr*)(_t105 + 0x10));
						 *((intOrPtr*)(_t80 + 0x10)) = _t106;
						while(_t106 != 0) {
							_t100 =  *((intOrPtr*)(_t106 + 0xc));
							_v20 = _t100;
							if( *_t106 != _v12) {
								L36:
								_t106 = _t100;
								continue;
							}
							_t89 =  *(_t106 + 8);
							if(_t106 != _t80) {
								 *(_t100 + 8) = _t89;
								_t90 =  *(_t106 + 8);
								_t63 =  *((intOrPtr*)(_t106 + 0xc));
								if(_t90 != 0) {
									 *((intOrPtr*)(_t90 + 0xc)) = _t63;
								} else {
									 *((intOrPtr*)(_t80 + 0x10)) = _t63;
									 *((intOrPtr*)( *((intOrPtr*)(_t106 + 0xc)) + 0x10)) =  *((intOrPtr*)(_t106 + 0xc));
								}
								L13:
								_t91 = 2;
								_t29 = _t106 + 0x14; // 0x14
								_t64 = _t29;
								_t92 =  *_t64;
								 *_t64 = _t91;
								if(_t92 == 2) {
									goto L36;
								}
								if(_t92 == 0) {
									 *(_t106 + 8) = _v24;
									_v24 = _t106;
								}
								if(_v25 != 0) {
									goto L36;
								}
								break;
							}
							if(_t89 != 0) {
								_t89 = _t89 ^ (_t89 ^ _t110) & 0x00000003;
							}
							_t70 = _t110;
							asm("lock cmpxchg [ebx], edx");
							_t80 = _v8;
							if(_t70 != _t110) {
								_t110 = _t70;
								goto L4;
							} else {
								_t102 =  *(_t106 + 8);
								_t93 = _t89 & 0xffffff00 | _t89 == 0x00000000;
								_v26 = _t93;
								if(_t102 != 0) {
									 *(_t102 + 0xc) =  *(_t102 + 0xc) & 0x00000000;
									 *((intOrPtr*)(_t102 + 0x10)) =  *((intOrPtr*)(_t106 + 0x10));
									_v26 = _t93;
								}
								_t100 = _v20;
								goto L13;
							}
						}
						_t57 = _v24;
						if(_t57 == 0) {
							L19:
							if(_v26 == 0) {
								_t88 =  *_v16;
								while(1) {
									_t82 = _t88 & 0x00000001;
									asm("sbb edx, edx");
									_t57 = _t88;
									asm("lock cmpxchg [esi], edx");
									if(_t57 == _t88) {
										break;
									}
									_t88 = _t57;
								}
								if(_t82 != 0) {
									_t57 = E6DFFCF30(_t57);
								}
							}
							goto L20;
						} else {
							goto L18;
						}
						do {
							L18:
							_push( *((intOrPtr*)(_t57 + 4)));
							_t112 =  *(_t57 + 8);
							E6DF89BF0();
							_t57 = _t112;
						} while (_t112 != 0);
						goto L19;
						do {
							L32:
							_t58 = _t105;
							_t105 =  *(_t105 + 8);
							 *(_t105 + 0xc) = _t58;
						} while ( *((intOrPtr*)(_t105 + 0x10)) == 0);
						goto L5;
					}
				}
				goto L20;
			}

0x6df7dff0
0x6df7dff8
0x6df7e005
0x6df7e011
0x6df7e014
0x6df7e016
0x6df7e018
0x6df7e01c
0x6df7e022
0x6df7e113
0x6df7e119
0x6df7e119
0x6df7e028
0x6df7e031
0x6df7e036
0x6dfbb47d
0x6dfbb483
0x00000000
0x00000000
0x6dfbb489
0x6dfbb489
0x6dfbb48d
0x00000000
0x00000000
0x00000000
0x6dfbb493
0x6df7e03e
0x6df7e043
0x6df7e049
0x00000000
0x00000000
0x00000000
0x00000000
0x6df7e04f
0x6df7e04f
0x6df7e051
0x6df7e054
0x6df7e058
0x6df7e05e
0x00000000
0x00000000
0x6df7e064
0x6df7e064
0x6df7e067
0x6df7e06a
0x6df7e076
0x6df7e079
0x6df7e07f
0x6dfbb4cc
0x6dfbb4cc
0x00000000
0x6dfbb4cc
0x6df7e085
0x6df7e08a
0x6df7e11c
0x6df7e11f
0x6df7e122
0x6df7e127
0x6df7e164
0x6df7e129
0x6df7e129
0x6df7e12f
0x6df7e12f
0x6df7e0c8
0x6df7e0ca
0x6df7e0cb
0x6df7e0cb
0x6df7e0ce
0x6df7e0ce
0x6df7e0d3
0x00000000
0x00000000
0x6df7e0db
0x6df7e0e1
0x6df7e0e4
0x6df7e0e4
0x6df7e0ed
0x00000000
0x00000000
0x00000000
0x6df7e0ed
0x6df7e092
0x6dfbb4b2
0x6dfbb4b2
0x6df7e09e
0x6df7e0a0
0x6df7e0a4
0x6df7e0aa
0x6dfbb4d3
0x00000000
0x6df7e0b0
0x6df7e0b0
0x6df7e0b5
0x6df7e0b8
0x6df7e0be
0x6dfbb4b9
0x6dfbb4c0
0x6dfbb4c3
0x6dfbb4c3
0x6df7e0c4
0x00000000
0x6df7e0c4
0x6df7e0aa
0x6df7e0f3
0x6df7e0f9
0x6df7e10c
0x6df7e111
0x6df7e138
0x6df7e13a
0x6df7e13e
0x6df7e148
0x6df7e14e
0x6df7e150
0x6df7e156
0x00000000
0x00000000
0x6df7e16c
0x6df7e16c
0x6df7e15a
0x6df7e15d
0x6df7e15d
0x6df7e15a
0x00000000
0x00000000
0x00000000
0x00000000
0x6df7e0fb
0x6df7e0fb
0x6df7e0fb
0x6df7e0fe
0x6df7e101
0x6df7e106
0x6df7e108
0x00000000
0x6dfbb498
0x6dfbb498
0x6dfbb498
0x6dfbb49a
0x6dfbb49d
0x6dfbb4a0
0x00000000
0x6dfbb4a6
0x6df7e04f
0x00000000

APIs

ZwAlertThreadByThreadId.9419(FFFFFFFE,FFFFFFFE,000000FF,FFFFFFFE), ref: 6DF7E101

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Alert
String ID:
API String ID: 2775339012-0
Opcode ID: 4b1a9e356c83194ebd2bf6469b9ca3cccc67450cc34184ee86009279a9a366fb
Instruction ID: 20f60db18a706f122e3defcb8d9627803ab2a765dacf76840923381127b48029
Opcode Fuzzy Hash: 4b1a9e356c83194ebd2bf6469b9ca3cccc67450cc34184ee86009279a9a366fb
Instruction Fuzzy Hash: 57517B72608313DFC729CE2DE8817A6B7A1BB85350F188A6EE894CB245D770E945CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7E2BB, Relevance: 1.7, APIs: 1, Instructions: 159
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6DF7E2BB(signed int __ecx, unsigned int* __edx) {
				char _v5;
				signed int _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int* _v24;
				signed int* _t47;
				signed int _t48;
				signed int _t50;
				signed int _t51;
				intOrPtr* _t52;
				signed int _t63;
				signed int _t68;
				signed int _t75;
				signed int _t81;
				intOrPtr* _t83;
				signed int _t86;
				intOrPtr* _t89;
				signed int _t91;
				signed int _t92;
				signed int _t94;
				signed int _t97;

				_t89 = __edx;
				_t94 = __ecx;
				_v20 = __edx;
				_v16 = __ecx;
				_t47 = __ecx + ( *__edx >> 0x00000005 & 0x0000007f) * 4;
				_t81 =  *_t47;
				_v24 = _t47;
				if(_t81 == 0) {
					L10:
					_t48 = _t89 + 0x14;
					 *_t48 = 1;
					if( *_t48 == 2) {
						L9:
						return _t48;
					}
					_t63 = _t94;
					L37:
					return E6DF42ED8(_t63, _t89, 0,  *0x6e035880);
				} else {
					goto L1;
				}
				do {
					L1:
					_t50 = _t81;
					if((_t81 & 0x00000002) != 0) {
						asm("lock cmpxchg [esi], ecx");
						if(_t50 == _t81) {
							_t48 = _t89 + 0x14;
							 *_t48 = 1;
							if( *_t48 == 2) {
								goto L9;
							}
							_t63 = _v16;
							goto L37;
						}
						goto L23;
					}
					_t97 = _t81 | 0x00000002;
					asm("lock cmpxchg [edi], ecx");
					_t89 = _v20;
					if(_t50 != _t81) {
						goto L23;
					}
					_v5 = 0;
					_t68 = _t97 & 0xfffffffc;
					_t83 = _t89;
					_v12 = _t68;
					_t51 =  *(_t68 + 0xc);
					_v16 = _t51;
					do {
						_t91 =  *(_t68 + 8);
						if(_t68 != _t83) {
							 *(_t68 + 0xc) = _t51;
							_t51 = _t68;
							_v16 = _t51;
							L13:
							_t68 = _t91;
							_t92 = _v12;
							goto L14;
						}
						_v5 = 1;
						if(_t68 != _v12) {
							 *(_t51 + 8) = _t91;
							if(_t91 != 0) {
								 *(_t91 + 0xc) = _t51;
							} else {
								 *(_t51 + 0x10) = _t51;
							}
							goto L13;
						}
						_t75 = _t91;
						if(_t91 != 0) {
							_t75 = (_t91 ^ _t97) & 0x00000003 ^ _t91;
						}
						_t48 = _t97;
						asm("lock cmpxchg [ebx], edx");
						_push(1);
						_pop(1);
						if(_t48 != _t97) {
							_t97 = _t48;
							_t68 = _t48 & 0xfffffffc;
							_t92 = _t68;
							_v16 =  *(_t68 + 0xc);
							goto L30;
						} else {
							if(_t75 != 0) {
								 *(_t91 + 0xc) =  *(_t91 + 0xc) & 0x00000000;
								_t68 = _t91;
								L30:
								_t51 = _v16;
								_t83 = _v20;
								_v12 = _t92;
								goto L14;
							}
							goto L9;
						}
						L14:
					} while (_t68 != 0);
					if(_v5 == _t68) {
						_t52 = _t83 + 0x14;
						 *_t52 = 0;
						if( *_t52 != 2) {
							_push(0);
							_push( *_t83);
							E6DF8B180();
						}
					}
					 *((intOrPtr*)(_t92 + 0x10)) = _v16;
					while(1) {
						_t86 = _t97 & 1;
						asm("sbb ecx, ecx");
						_t48 = _t97;
						asm("lock cmpxchg [edi], ecx");
						if(_t48 == _t97) {
							break;
						}
						_t97 = _t48;
					}
					if(_t86 == 0) {
						goto L9;
					}
					return E6DFFCF30(_t48);
					L23:
					_t81 = _t50;
				} while (_t50 != 0);
				_t94 = _v16;
				goto L10;
			}

0x6df7e2c6
0x6df7e2c8
0x6df7e2cc
0x6df7e2d0
0x6df7e2db
0x6df7e2de
0x6df7e2e0
0x6df7e2e5
0x6df7e361
0x6df7e361
0x6df7e364
0x6df7e369
0x6df7e360
0x6df7e360
0x6df7e360
0x6dfbb58b
0x6dfbb58d
0x00000000
0x00000000
0x00000000
0x00000000
0x6df7e2e7
0x6df7e2e7
0x6df7e2e7
0x6df7e2ec
0x6df7e3cc
0x6df7e3d2
0x6dfbb578
0x6dfbb57b
0x6dfbb580
0x00000000
0x00000000
0x6dfbb586
0x00000000
0x6dfbb586
0x00000000
0x6df7e3d2
0x6df7e2f7
0x6df7e2fc
0x6df7e300
0x6df7e305
0x00000000
0x00000000
0x6df7e30d
0x6df7e311
0x6df7e314
0x6df7e316
0x6df7e319
0x6df7e31c
0x6df7e31f
0x6df7e31f
0x6df7e324
0x6df7e370
0x6df7e373
0x6df7e375
0x6df7e378
0x6df7e378
0x6df7e37a
0x00000000
0x6df7e37a
0x6df7e326
0x6df7e32c
0x6df7e3b9
0x6df7e3be
0x6df7e3ea
0x6df7e3c0
0x6df7e3c0
0x6df7e3c0
0x00000000
0x6df7e3be
0x6df7e332
0x6df7e336
0x6dfbb523
0x6dfbb523
0x6df7e341
0x6df7e343
0x6df7e347
0x6df7e349
0x6df7e34c
0x6dfbb534
0x6dfbb536
0x6dfbb539
0x6dfbb53e
0x00000000
0x6df7e352
0x6df7e354
0x6dfbb52a
0x6dfbb52e
0x6dfbb541
0x6dfbb541
0x6dfbb544
0x6dfbb547
0x00000000
0x6dfbb547
0x00000000
0x6df7e354
0x6df7e37d
0x6df7e37d
0x6df7e384
0x6dfbb551
0x6dfbb554
0x6dfbb559
0x6dfbb55f
0x6dfbb561
0x6dfbb563
0x6dfbb563
0x6dfbb559
0x6df7e38d
0x6df7e393
0x6df7e397
0x6df7e3a0
0x6df7e3a6
0x6df7e3a8
0x6df7e3ae
0x00000000
0x00000000
0x6df7e3ef
0x6df7e3ef
0x6df7e3b2
0x00000000
0x00000000
0x00000000
0x6df7e3d8
0x6df7e3d8
0x6df7e3da
0x6df7e3e2
0x00000000

APIs

ZwWaitForAlertByThreadId.9419(?,00000000,0000000A,-00000001,00000000,?,?,00000000,?,?,?,?,6DF42E39,00000004,?,00000000), ref: 6DFBB563

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlertThreadWait
String ID:
API String ID: 2760959157-0
Opcode ID: 7390f6ac705449d26e989dae7ba9261cf99ddc461447a10066a4001f36e6a77d
Instruction ID: 37be718b726daaab110af9c8ffb15a410d5aa1caed698db9f3acc9fecae968c7
Opcode Fuzzy Hash: 7390f6ac705449d26e989dae7ba9261cf99ddc461447a10066a4001f36e6a77d
Instruction Fuzzy Hash: 8851E272A042179FCB5ACE1DD4906EEBBB2FF85310B28816FD426DB350DB319981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6FC39, Relevance: 1.6, APIs: 1, Instructions: 103
nativeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E6DF6FC39(intOrPtr __ecx, signed int __edx, signed int* _a4) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				void* __ebx;
				void* _t39;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t45;
				signed int _t47;
				signed int _t48;
				signed int _t49;
				signed int _t53;
				signed int _t56;
				signed int* _t57;

				_t59 = __ecx;
				_push( &_v5);
				_push(0);
				_push(0);
				_t41 =  *((intOrPtr*)(__ecx + 0x5c));
				_push(__ecx);
				_push(__ecx + 0xf8);
				_t56 = __edx;
				_v24 = __ecx;
				_push(__edx);
				 *(__ecx + 0xe0) = __edx;
				_push( *((intOrPtr*)(_t41 + 0x28)));
				_v16 = _t41;
				_push( *((intOrPtr*)(__ecx + 0xe4)));
				if(E6DF89DE0() < 0) {
					 *(__ecx + 0xe0) =  *(__ecx + 0xe0) & 0x00000000;
					_push(__ecx);
					E6E01886F(_t41, _t30, _t56, __ecx);
					return 0;
				}
				_t57 = _a4;
				if(_t57 != 0) {
					__eflags = _v5;
					if(_v5 != 0) {
						goto L2;
					}
					_t53 = _t57[1];
					_t45 =  *_t57;
					_v20 = _t45;
					__eflags = _t53;
					if(__eflags > 0) {
						L8:
						while(1) {
							_t42 =  *0x7ffe0018;
							_v12 =  *0x7FFE0014;
							__eflags = _t42 -  *0x7FFE001C;
							if(_t42 ==  *0x7FFE001C) {
								break;
							}
							asm("pause");
						}
						_t47 = _v20;
						_t59 = _v24;
						_t57 = _a4;
						__eflags = _t53 - _t42;
						if(__eflags < 0) {
							L22:
							_t48 = 0;
							_t53 = 0;
							L14:
							_t41 = _v16;
							L15:
							_t49 = (_t53 << 0x00000020 | _t48) >> 0x10;
							__eflags = _t53 >> 0x10;
							if(__eflags > 0) {
								L18:
								_t49 = 0x12c;
								L19:
								_t25 = _t41 + 0x40; // 0x40
								E6DF6DBE9(_t59, _t25, _t57, 0, _t49);
								_t39 = 2;
								return _t39;
							}
							if(__eflags < 0) {
								goto L19;
							}
							__eflags = _t49 - 0x12c;
							if(_t49 <= 0x12c) {
								goto L19;
							}
							goto L18;
						}
						_t40 = _v12;
						if(__eflags > 0) {
							L13:
							_t48 = _t47 - _t40;
							asm("sbb edx, ebx");
							goto L14;
						}
						__eflags = _t47 - _t40;
						if(_t47 <= _t40) {
							goto L22;
						}
						goto L13;
					}
					if(__eflags < 0) {
						L20:
						_t48 =  ~_t45;
						asm("adc edx, 0x0");
						_t53 =  ~_t53;
						goto L15;
					}
					__eflags = _t45;
					if(_t45 < 0) {
						goto L20;
					}
					goto L8;
				}
				L2:
				return 1;
			}

0x6df6fc44
0x6df6fc49
0x6df6fc4a
0x6df6fc4c
0x6df6fc4e
0x6df6fc57
0x6df6fc58
0x6df6fc59
0x6df6fc5b
0x6df6fc5e
0x6df6fc5f
0x6df6fc65
0x6df6fc68
0x6df6fc6b
0x6df6fc78
0x6dfb47f0
0x6dfb47f9
0x6dfb47fd
0x00000000
0x6dfb4802
0x6df6fc7e
0x6df6fc83
0x6df6fc91
0x6df6fc95
0x00000000
0x00000000
0x6df6fc97
0x6df6fc9a
0x6df6fc9c
0x6df6fc9f
0x6df6fca1
0x6df6fca9
0x6df6fcb4
0x6df6fcb4
0x6df6fcb8
0x6df6fcbd
0x6df6fcbf
0x00000000
0x00000000
0x6df6fd15
0x6df6fd15
0x6df6fcc1
0x6df6fcc4
0x6df6fcc7
0x6df6fcca
0x6df6fccc
0x6df6fd19
0x6df6fd19
0x6df6fd1b
0x6df6fcdb
0x6df6fcdb
0x6df6fcde
0x6df6fcde
0x6df6fcea
0x6df6fcec
0x6df6fcf4
0x6df6fcf4
0x6df6fcf6
0x6df6fcfa
0x6df6fcff
0x6df6fd06
0x00000000
0x6df6fd06
0x6df6fcee
0x00000000
0x00000000
0x6df6fcf0
0x6df6fcf2
0x00000000
0x00000000
0x00000000
0x6df6fcf2
0x6df6fcce
0x6df6fcd1
0x6df6fcd7
0x6df6fcd7
0x6df6fcd9
0x00000000
0x6df6fcd9
0x6df6fcd3
0x6df6fcd5
0x00000000
0x00000000
0x00000000
0x6df6fcd5
0x6df6fca3
0x6df6fd0c
0x6df6fd0c
0x6df6fd0e
0x6df6fd11
0x00000000
0x6df6fd11
0x6df6fca5
0x6df6fca7
0x00000000
0x00000000
0x00000000
0x6df6fca7
0x6df6fc85
0x00000000

APIs

ZwAssociateWaitCompletionPacket.9419(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6DF6FC71

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AssociateCompletionPacketWait
String ID:
API String ID: 2606105681-0
Opcode ID: 118dbb9bcf730e17bcc398f1b4d63c487a8ab381f53496c3040db7b9b8ba6c73
Instruction ID: 16e6618f80dcd1c213f495b896134392f36894d302fc8433b07bc54041fd2bcd
Opcode Fuzzy Hash: 118dbb9bcf730e17bcc398f1b4d63c487a8ab381f53496c3040db7b9b8ba6c73
Instruction Fuzzy Hash: 6031B576B04286ABDB54CE6DC850BAEB7B6FF85350F208529DD1697A44E7706E00C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF800C2, Relevance: 1.6, APIs: 1, Instructions: 88
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6DF800C2(void* __ecx, char __edx, signed char _a4) {
				char _v5;
				char _t24;
				signed int _t25;
				intOrPtr _t27;
				signed char _t28;
				signed int _t34;
				signed char _t41;
				signed int _t43;
				signed int _t45;
				signed int _t46;
				signed int _t48;
				void* _t56;

				_t24 = __edx;
				_t41 = _a4;
				_v5 = __edx;
				L1:
				while(1) {
					if(_t24 != 0 || (_t41 & 0x00000001) == 0) {
						L3:
						_t34 = _t41 & 0xfffffff0;
						_t43 = _t34;
						_t48 =  *(_t34 + 4);
						if(_t48 == 0) {
							do {
								_t25 = _t43;
								_t43 =  *_t43;
								 *(_t43 + 8) = _t25;
								_t48 =  *(_t43 + 4);
							} while (_t48 == 0);
							if(_t43 != _t34) {
								 *(_t34 + 4) = _t48;
							}
						}
						_t27 = _v5;
						if(( *(_t48 + 0x14) & 0x00000001) == 0) {
							L7:
							_t28 = _t41;
							asm("sbb ecx, ecx");
							asm("lock cmpxchg [ebx], ecx");
							_t56 = _t28 - _t41;
							if(_t56 != 0) {
								_t41 = _t28;
								_t24 = _v5;
								continue;
							} else {
								goto L8;
							}
							do {
								L8:
								_t45 =  *(_t48 + 8);
								asm("lock bts dword [ecx], 0x2");
								asm("lock btr dword [ecx], 0x1");
								if(_t56 >= 0) {
									_push( *((intOrPtr*)(_t48 + 0xc)));
									_t28 = E6DF89BF0();
								}
								_t48 = _t45;
							} while (_t45 != 0);
							goto L10;
						}
						if(_t27 != 0) {
							_t28 = 0xfffffffb;
							asm("lock and [ebx], eax");
							goto L10;
						}
						_t46 =  *(_t48 + 8);
						if(_t46 != 0) {
							 *(_t34 + 4) = _t46;
							 *(_t48 + 8) =  *(_t48 + 8) & 0x00000000;
							_t28 = 0xfffffffb;
							asm("lock and [ebx], eax");
							goto L8;
						}
						goto L7;
					} else {
						while(1) {
							_t28 = _t41;
							asm("lock cmpxchg [ebx], ecx");
							if(_t28 == _t41) {
								break;
							}
							_t41 = _t28;
							if((_t28 & 0x00000001) != 0) {
								continue;
							}
							goto L3;
						}
						L10:
						return _t28;
					}
				}
			}

0x6df800c9
0x6df800cd
0x6df800d2
0x00000000
0x6df800d5
0x6df800d7
0x6df800de
0x6df800e0
0x6df800e3
0x6df800e5
0x6df800ea
0x6dfbc205
0x6dfbc205
0x6dfbc207
0x6dfbc209
0x6dfbc20c
0x6dfbc20f
0x6dfbc215
0x6dfbc21b
0x6dfbc21b
0x6dfbc215
0x6df800f5
0x6df800f8
0x6df80105
0x6df80108
0x6df8010c
0x6df80111
0x6df80115
0x6df80117
0x6df80165
0x6df80167
0x00000000
0x00000000
0x00000000
0x00000000
0x6df80119
0x6df80119
0x6df80119
0x6df8011f
0x6df80124
0x6df80129
0x6df80149
0x6df8014c
0x6df8014c
0x6df8012b
0x6df8012d
0x00000000
0x6df80119
0x6df800fc
0x6df80171
0x6df80172
0x00000000
0x6df80172
0x6df800fe
0x6df80103
0x6df8013c
0x6df8013f
0x6df80143
0x6df80144
0x00000000
0x6df80144
0x00000000
0x6df80153
0x6df80153
0x6df80156
0x6df80158
0x6df8015e
0x00000000
0x00000000
0x6dfbc1f6
0x6dfbc1fa
0x00000000
0x00000000
0x00000000
0x6dfbc200
0x6df80131
0x6df80137
0x6df80137
0x6df800d7

APIs

ZwAlertThreadByThreadId.9419(?,?,?,?,?,?,6DF800C0,?,?,?,?,6DF623F6), ref: 6DF8014C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Alert
String ID:
API String ID: 2775339012-0
Opcode ID: b64bf42f8aa902b9f32a2059238b5a5e0f124bce4b2cc1989a70c8e1a86660fb
Instruction ID: f50c88d17d059e237b079428fd2b2ba176f67777cdac89ddb25cbc1f4a93c195
Opcode Fuzzy Hash: b64bf42f8aa902b9f32a2059238b5a5e0f124bce4b2cc1989a70c8e1a86660fb
Instruction Fuzzy Hash: D5212B3260B9126FC726CD1ECC40366B3B1AF42736B69C25DD8699B246DBB1E403C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7BE62, Relevance: 1.6, APIs: 1, Instructions: 85
nativeCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6DF7BE62(char __ecx) {
				char _v8;
				signed int _v12;
				char _v16;
				intOrPtr _t20;
				char _t22;
				signed int _t23;
				void* _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;

				_t20 =  *0x6e03b22c; // 0x0
				_v8 = __ecx;
				if(_t20 == 0) {
					E6DFCB21E(__ecx);
				}
				_t22 =  *0x6e03b22c; // 0x0
				_v16 = _t22;
				_t23 =  *0x6e03b220; // 0x0
				_v12 = _t23;
				_push( &_v8);
				_push(_v8);
				_push( &_v12);
				_push( &_v16);
				_push(0xffffffff);
				_t27 = E6DF89A00();
				if(_t27 < 0) {
					_t35 = 5;
					asm("int 0x29");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t35);
					_push(_t35);
					_t28 =  *[fs:0x18];
					_t36 =  *((intOrPtr*)(_t28 + 0xfdc));
					if(_t36 < 0) {
						_t28 = _t28 + _t36;
					}
					_t37 =  *[fs:0x18];
					_t40 =  *((intOrPtr*)(_t37 + 0xfdc));
					if(_t40 < 0) {
						_t37 = _t37 + _t40;
					}
					_t29 =  *[fs:0x18];
					_t38 =  *((intOrPtr*)(_t29 + 0xfdc));
					if(_t28 ==  *((intOrPtr*)(_t37 + 0x18))) {
						if(_t38 < 0) {
							_t29 = _t29 + _t38;
						}
						_t39 =  *((intOrPtr*)(_t29 + 0xfac));
						_v12 = _v12 & 0x00000000;
					} else {
						if(_t38 < 0) {
							_t29 = _t29 + _t38;
						}
						_t39 =  *((intOrPtr*)(_t29 + 0x17b8));
						_v12 =  *(_t29 + 0x17bc);
					}
					 *((intOrPtr*)( *[fs:0x18] + 0xfac)) = _t39;
					return  *((intOrPtr*)( *[fs:0x18] + 0xfac));
				} else {
					return _t27;
				}
			}

0x6df7be6a
0x6df7be6f
0x6df7be74
0x6df7bea4
0x6df7bea4
0x6df7be76
0x6df7be7b
0x6df7be7e
0x6df7be83
0x6df7be89
0x6df7be8a
0x6df7be90
0x6df7be94
0x6df7be95
0x6df7be97
0x6df7be9e
0x6df7bead
0x6df7beae
0x6df7beb0
0x6df7beb1
0x6df7beb2
0x6df7beb3
0x6df7beb4
0x6df7beb5
0x6df7beb6
0x6df7beb7
0x6df7beb8
0x6df7beb9
0x6df7beba
0x6df7bebb
0x6df7bebc
0x6df7bebd
0x6df7bebe
0x6df7bebf
0x6df7bec5
0x6df7bec6
0x6df7bec7
0x6df7becd
0x6df7bed5
0x6df7bed7
0x6df7bed7
0x6df7bed9
0x6df7bee0
0x6df7bee8
0x6df7beea
0x6df7beea
0x6df7beef
0x6df7bef5
0x6df7befb
0x6dfba550
0x6dfba552
0x6dfba552
0x6dfba554
0x6dfba55a
0x6df7bf01
0x6df7bf03
0x6df7bf05
0x6df7bf05
0x6df7bf07
0x6df7bf13
0x6df7bf13
0x6df7bf1c
0x6df7bf31
0x6df7bea3
0x6df7bea3
0x6df7bea3

APIs

ZwProtectVirtualMemory.9419(000000FF,?,00000000,-00000F38,-00000F38,?), ref: 6DF7BE97

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 062ccfd66587e0975616df200b7d44fe2f39ccaa72626df3d6d3880378e2ab34
Instruction ID: 942819815cf2193eb435cdd2ae5f4bdb7f39e096e629ad7826ffe360ead8a571
Opcode Fuzzy Hash: 062ccfd66587e0975616df200b7d44fe2f39ccaa72626df3d6d3880378e2ab34
Instruction Fuzzy Hash: 69218EB6A0464ADFCB25CB59D880FF973F8EB49714F1485BAE909C7740E730A900DA91

Uniqueness

Uniqueness Score: -1.00%

Function 6E006D61, Relevance: 1.6, APIs: 1, Instructions: 75
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6E006D61(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v32;
				intOrPtr _v44;
				char _v52;
				signed int* _v60;
				void* _v68;
				void* _t35;
				void* _t37;
				intOrPtr _t40;
				signed int _t48;
				void* _t54;

				_t35 = _t54;
				_push(__ecx);
				_push(__ecx);
				_v8 =  *((intOrPtr*)(_t35 + 4));
				_v20 = __ecx;
				_t48 =  *(_t35 + 0xc) & 0xbfffffff;
				_t37 = 0;
				_v16 = __edx;
				if((_t48 & 0x00002000) != 0) {
					asm("stosd");
					_t37 = 1;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v68 = 1;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v60 =  &_v32;
					_v24 =  *((intOrPtr*)(_t35 + 8));
					if((_t48 & 0x00040000) != 0) {
						_v32 = _v32 & 0x00000000;
						_t48 = _t48 & 0xfffbffff;
					}
					_t40 =  *((intOrPtr*)(_t35 + 0x1c));
					if(_t40 != 0) {
						asm("stosd");
						_t37 = 2;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_v52 = 3;
						_v44 = _t40;
					}
				}
				_push(_t37);
				asm("sbb eax, eax");
				_push(0 &  &_v68);
				_push( *((intOrPtr*)(_t35 + 0x10)));
				_push(_t48);
				_push(_v16);
				_push(_v20);
				_push(0xffffffff);
				return E6DF89C40();
			}

0x6e006d64
0x6e006d66
0x6e006d67
0x6e006d72
0x6e006d7f
0x6e006d82
0x6e006d88
0x6e006d8a
0x6e006d94
0x6e006d9b
0x6e006d9c
0x6e006d9d
0x6e006d9e
0x6e006d9f
0x6e006da2
0x6e006da8
0x6e006da9
0x6e006daa
0x6e006dae
0x6e006db4
0x6e006dbd
0x6e006dbf
0x6e006dc3
0x6e006dc3
0x6e006dc9
0x6e006dce
0x6e006dd5
0x6e006dd8
0x6e006dd9
0x6e006dda
0x6e006ddb
0x6e006ddc
0x6e006de0
0x6e006de0
0x6e006dce
0x6e006de3
0x6e006deb
0x6e006def
0x6e006df0
0x6e006df3
0x6e006df4
0x6e006df7
0x6e006dfa
0x6e006e09

APIs

ZwAllocateVirtualMemoryEx.9419(000000FF,?,?,?,?,00000000,00000000,?,-00000FFF), ref: 6E006DFC

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f7d85fffaa249aa4f891edf33d2f16b564cbc6cac25063e81b31447d21fdcdcf
Instruction ID: 67ded8a0a111a63678ba8ef90a080dbb5257f27f470966977f206da28b44c289
Opcode Fuzzy Hash: f7d85fffaa249aa4f891edf33d2f16b564cbc6cac25063e81b31447d21fdcdcf
Instruction Fuzzy Hash: F321A172D11609BFEB45CEACC841AEEFBB5EB48320F14426ADD20F7291D7359D44C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6EDC4, Relevance: 1.6, APIs: 1, Instructions: 71
nativeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DF6EDC4(signed int __edx, signed int _a4, signed int* _a8) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t24;
				signed int _t27;
				signed char _t28;
				signed int _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				signed int* _t42;
				signed int _t47;
				signed int _t49;
				void* _t50;

				_t44 = __edx;
				_t50 = _t39;
				_t24 = _a4 & 0x00000002;
				_t49 = __edx;
				if( *(_t50 + 0xe0) != 0) {
					__eflags = _t24;
					_push((_t24 & 0xffffff00 | _t24 != 0x00000000) & 0x000000ff);
					_push( *((intOrPtr*)(_t50 + 0xe4)));
					_t27 = E6DF89E30();
					__eflags = _t27;
					if(_t27 != 0) {
						__eflags = _t27 - 0x103;
						if(_t27 != 0x103) {
							__eflags = _t27 - 0xc0000120;
							if(__eflags != 0) {
								E6E0188F5(_t36, _t39, _t44, _t49, _t50, __eflags);
							}
						}
						_t28 =  *(_t50 + 0x124);
						_t37 = 0;
						__eflags = _t28 & 0x00000004;
						if((_t28 & 0x00000004) == 0) {
							 *(_t50 + 0x124) = _t28 | 0x00000004;
							E6DF79ED0(_t50 + 0x20, 1, 0);
						}
						goto L2;
					}
					 *(_t50 + 0xe0) =  *(_t50 + 0xe0) & _t27;
					_t37 = 1;
					_t47 = _t49;
					_t34 = E6DF6C182(_t50, _t47, 1);
					_t42 = _a8;
					_t48 = _t47 | 0xffffffff;
					 *_t42 = _t47 | 0xffffffff;
					__eflags = _t34;
					if(_t34 != 0) {
						 *_t42 = 0xfffffffe;
					}
					__eflags =  *(_t50 + 0x124) & 0x00000004;
					if(( *(_t50 + 0x124) & 0x00000004) != 0) {
						E6DF79ED0(_t50 + 0x20, _t48, 0);
						 *(_t50 + 0x124) =  *(_t50 + 0x124) & 0x000000fb;
					}
					goto L3;
				} else {
					_t37 = 1;
					L2:
					 *_a8 =  *_a8 & 0x00000000;
					L3:
					 *(_t50 + 0x124) =  *(_t50 + 0x124) & 0x000000fc;
					return _t37;
				}
			}

0x6df6edc4
0x6df6edcf
0x6df6edd1
0x6df6edd5
0x6df6edde
0x6df6edf9
0x6df6ee01
0x6df6ee02
0x6df6ee08
0x6df6ee0d
0x6df6ee0f
0x6dfb433c
0x6dfb4341
0x6dfb4343
0x6dfb4348
0x6dfb434a
0x6dfb434a
0x6dfb4348
0x6dfb434f
0x6dfb4355
0x6dfb4357
0x6dfb4359
0x6dfb4369
0x6dfb436f
0x6dfb436f
0x00000000
0x6dfb4359
0x6df6ee15
0x6df6ee1d
0x6df6ee1e
0x6df6ee23
0x6df6ee28
0x6df6ee2b
0x6df6ee2e
0x6df6ee30
0x6df6ee32
0x6df6ee42
0x6df6ee42
0x6df6ee34
0x6df6ee3b
0x6dfb437e
0x6dfb4383
0x6dfb4383
0x00000000
0x6df6ede0
0x6df6ede0
0x6df6ede2
0x6df6ede5
0x6df6ede8
0x6df6ede8
0x6df6edf6
0x6df6edf6

APIs

ZwCancelWaitCompletionPacket.9419(?,?), ref: 6DF6EE08

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CancelCompletionPacketWait
String ID:
API String ID: 600095985-0
Opcode ID: f0aaa5436dd2803b246309e6a8629a8538e951912896a0e28ca55e787dec02f6
Instruction ID: 76c3a67b0a38e37a8e1bd0614ed36347384e9371caff51faae11d52bc70c8239
Opcode Fuzzy Hash: f0aaa5436dd2803b246309e6a8629a8538e951912896a0e28ca55e787dec02f6
Instruction Fuzzy Hash: 7E21D2321597819BE3118A7D9C01BE677E9AB96328F18861AE5F6C70D0CB315941D224

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1D6A, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6DFD1D6A(char __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t28;
				void* _t29;
				signed int _t31;
				signed int _t36;
				intOrPtr _t37;
				signed int _t39;

				_t35 = __edx;
				_v8 =  *0x6e03d360 ^ _t39;
				_t37 = _a8;
				_t31 = 0;
				_v32 = __edx;
				_v28 = __ecx;
				_v24 = _t37;
				_t36 = 0;
				if(__ecx != 0) {
					_t29 = E6DFD1CE4(__ecx);
					_t37 = _v24;
					if(_t29 !=  *((intOrPtr*)( *[fs:0x18] + 0x20))) {
						_t36 = 1;
						_v20 = _v28;
					}
				}
				_t23 = _v32;
				if(_t23 != 0) {
					 *((intOrPtr*)(_t39 + _t36 * 4 - 0x10)) = _t23;
					_t36 = _t36 + 1;
				}
				_t24 = _a4;
				if(_t24 != 0) {
					 *((intOrPtr*)(_t39 + _t36 * 4 - 0x10)) = _t24;
					_t36 = _t36 + 1;
				}
				if(_t36 == 0) {
					L14:
					return E6DF8B640(_t31, _t31, _v8 ^ _t39, _t35, _t36, _t37);
				} else {
					if(_t36 <= 3) {
						while(1) {
							_push(_t37);
							_push(1);
							_push(1);
							_push( &_v20);
							_push(_t36);
							_t28 = E6DF89AB0();
							if(_t28 < 0) {
								break;
							}
							if(_t28 < _t36) {
								goto L14;
							}
							if(_t28 == 0x102) {
								_t31 = 0xc0000001;
								goto L14;
							}
						}
						_t31 = _t28;
						goto L14;
					}
					_t31 = 0xc000008c;
					goto L14;
				}
			}

0x6dfd1d6a
0x6dfd1d79
0x6dfd1d7e
0x6dfd1d83
0x6dfd1d85
0x6dfd1d88
0x6dfd1d8b
0x6dfd1d8f
0x6dfd1d93
0x6dfd1d9c
0x6dfd1da4
0x6dfd1da7
0x6dfd1dac
0x6dfd1dad
0x6dfd1dad
0x6dfd1da7
0x6dfd1db0
0x6dfd1db5
0x6dfd1db7
0x6dfd1dbb
0x6dfd1dbb
0x6dfd1dbc
0x6dfd1dc1
0x6dfd1dc3
0x6dfd1dc7
0x6dfd1dc7
0x6dfd1dca
0x6dfd1df8
0x6dfd1e0a
0x6dfd1dcc
0x6dfd1dcf
0x6dfd1de3
0x6dfd1de3
0x6dfd1de4
0x6dfd1de6
0x6dfd1deb
0x6dfd1dec
0x6dfd1ded
0x6dfd1df4
0x00000000
0x00000000
0x6dfd1dda
0x00000000
0x00000000
0x6dfd1de1
0x6dfd1e0d
0x00000000
0x6dfd1e0d
0x6dfd1de1
0x6dfd1df6
0x00000000
0x6dfd1df6
0x6dfd1dd1
0x00000000
0x6dfd1dd1

APIs

Part of subcall function 6DFD1CE4: ZwQueryInformationProcess.9419(?,00000000,?,00000018,00000000), ref: 6DFD1CF7

ZwWaitForMultipleObjects.9419(00000000,?,00000001,00000001,?,00000000,?,00000000), ref: 6DFD1DED

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationMultipleObjectsProcessQueryWait
String ID:
API String ID: 630360550-0
Opcode ID: 840c9e75650bf0809728fc969fff10779d87a2ee1506eb985a091bcaa55a3410
Instruction ID: cef9827f675d5a2a41d186237554913f7cb79522dc09c7e56f1ab320252bd5bf
Opcode Fuzzy Hash: 840c9e75650bf0809728fc969fff10779d87a2ee1506eb985a091bcaa55a3410
Instruction Fuzzy Hash: BB114271F0021A9BDB50CE9D9880ABFB7B8FF45700F19452AE925E7240D771DE41C791

Uniqueness

Uniqueness Score: -1.00%

Function 6E014CAB, Relevance: 1.6, APIs: 1, Instructions: 62
nativeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6E014CAB(intOrPtr __ecx, signed int* __edx) {
				void* _v8;
				intOrPtr _v12;
				signed int* _v16;
				char _v20;
				void* _t19;
				signed int _t20;
				void* _t25;
				signed short _t26;
				signed char _t27;
				intOrPtr* _t29;
				intOrPtr _t32;
				signed short _t36;

				_v16 = __edx;
				_t36 = 0;
				_t32 = __ecx;
				_v12 = __ecx;
				do {
					asm("lock inc dword [eax+edi*8+0x4]");
					_t27 =  *( *0x6e0360e8 + (_t36 & 0x0000ffff) * 8);
					if((_t27 & 0x00000001) != 0) {
						goto L8;
					} else {
						_t7 = _t27 + 0x174; // 0x174
						_t29 = _t7;
						if( *_t29 == 0) {
							goto L8;
						} else {
							_t20 =  *(_t27 + 0x178) & 0x0000ffff;
							if(_t20 != 0) {
								L7:
								if(_t20 == _t32) {
									 *_v16 = _t36 & 0x0000ffff;
									asm("lock dec dword [eax+edi*8+0x4]");
									_t19 = 0;
								} else {
									goto L8;
								}
							} else {
								_push( &_v20);
								_push(2);
								_push( &_v8);
								_push(4);
								_push(_t29);
								_push(0x28);
								_t25 = E6DF8B0B0();
								_t32 = _v12;
								if(_t25 != 0 || _v20 != 2) {
									goto L8;
								} else {
									_t26 = _v8;
									 *(_t27 + 0x178) = _t26;
									_t20 = _t26 & 0x0000ffff;
									goto L7;
								}
							}
						}
					}
					L10:
					return _t19;
					L8:
					asm("lock dec dword [eax+edi*8+0x4]");
					_t36 = _t36 + 1;
				} while (_t36 < 8);
				_t19 = 0x1069;
				goto L10;
			}

0x6e014cb5
0x6e014cb8
0x6e014cba
0x6e014cbd
0x6e014cc0
0x6e014cc8
0x6e014cd2
0x6e014cd8
0x00000000
0x6e014cda
0x6e014cda
0x6e014cda
0x6e014ce3
0x00000000
0x6e014ce5
0x6e014ce5
0x6e014cef
0x6e014d20
0x6e014d22
0x6e014d47
0x6e014d4e
0x6e014d53
0x00000000
0x00000000
0x00000000
0x6e014cf1
0x6e014cf4
0x6e014cf5
0x6e014cfa
0x6e014cfb
0x6e014cfd
0x6e014cfe
0x6e014d00
0x6e014d05
0x6e014d0a
0x00000000
0x6e014d12
0x6e014d12
0x6e014d16
0x6e014d1d
0x00000000
0x6e014d1d
0x6e014d0a
0x6e014cef
0x6e014ce3
0x6e014d3a
0x6e014d40
0x6e014d24
0x6e014d29
0x6e014d2e
0x6e014d2f
0x6e014d35
0x00000000

APIs

ZwTraceControl.9419(00000028,00000174,00000004,?,00000002,0000001C,00000000,00000066,00000000,0000001C,00000000,00000000,?), ref: 6E014D00

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ControlTrace
String ID:
API String ID: 1197477875-0
Opcode ID: c3915aee1106b8539f25f40dd5520fd04be2db4e8f4941227f45c652a3628549
Instruction ID: ebf8b65d2e58311b0a0dff43867e8a81656edfa9d7433da86736115fc0106b78
Opcode Fuzzy Hash: c3915aee1106b8539f25f40dd5520fd04be2db4e8f4941227f45c652a3628549
Instruction Fuzzy Hash: 4011E134A18115AFDB50CED5C480FFAB3F8EB04349F4040BAEC488B261D7719846C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF43138, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E6DF43138(void* __ecx) {
				signed int _v8;
				char _v12;
				void* _t18;
				intOrPtr _t19;
				intOrPtr* _t27;
				char* _t31;
				intOrPtr* _t33;
				intOrPtr _t40;
				void* _t42;
				void* _t44;

				_push(__ecx);
				_push(__ecx);
				_t42 = __ecx;
				if(( *(__ecx + 0xc) & 0x00000001) != 0) {
					_t18 = 0;
				} else {
					_t33 = __ecx + 0x10;
					_t19 =  *_t33;
					_t27 =  *((intOrPtr*)(_t33 + 4));
					_t39 =  *((intOrPtr*)(_t19 + 4));
					if( *_t27 !=  *((intOrPtr*)(_t19 + 4)) ||  *_t27 != _t33) {
						_push(_t27);
						_push( *_t27);
						E6E00A80D(0, 0xd, _t33, _t39);
					} else {
						 *_t27 = _t19;
						 *((intOrPtr*)(_t19 + 4)) = _t27;
					}
					_t40 =  *((intOrPtr*)(_t42 + 0x18));
					_v8 = _v8 & 0x00000000;
					_v12 =  *((intOrPtr*)(_t42 + 0x1c));
					_t44 = E6DF7174B( &_v12,  &_v8, 0x8000);
					if(E6DF67D50() != 0) {
						_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					} else {
						_t31 = 0x7ffe0388;
					}
					if( *_t31 != 0) {
						E6DFFFE3F(_t40, _v12, _v8);
					}
					_t18 = _t44;
				}
				return _t18;
			}

0x6df4313d
0x6df4313e
0x6df43140
0x6df43147
0x6df431ac
0x6df43149
0x6df43149
0x6df4314c
0x6df4314e
0x6df43151
0x6df43156
0x6df9fdb3
0x6df9fdb4
0x6df9fdbd
0x6df43164
0x6df43164
0x6df43166
0x6df43166
0x6df4316f
0x6df43172
0x6df43176
0x6df43187
0x6df43190
0x6df9fdd1
0x6df43196
0x6df43196
0x6df43196
0x6df4319e
0x6df9fde4
0x6df9fde4
0x6df431a4
0x6df431a4
0x6df431ab

APIs

Part of subcall function 6DF7174B: ZwFreeVirtualMemory.9419(000000FF,00000000,?,?,00000000,?,00000000,00000001,?,6E004827,00000000,00008000,?), ref: 6DF71760

RtlGetCurrentServiceSessionId.9419(00000000,00008000,?,?,?,?,?,6DF4308B,00000000,00008000), ref: 6DF43189

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFreeMemoryServiceSessionVirtual
String ID:
API String ID: 215549893-0
Opcode ID: d4aeeff4ef93e10868052b9739ddbb58bbde280f33870a99f1aaca30df05f52d
Instruction ID: 963d97d95aa21fecbd10362b63848aed7fc65db2d555c81eb9ab3d8fbbb376a6
Opcode Fuzzy Hash: d4aeeff4ef93e10868052b9739ddbb58bbde280f33870a99f1aaca30df05f52d
Instruction Fuzzy Hash: 60118E31A44305AFE715CBA8C804F66BBF9EFC6318F24C59AE4019B641EB71AD06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E00E962, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E6E00E962(void* __ecx, intOrPtr _a4, intOrPtr* _a8) {
				char _v8;
				signed int _v12;
				char* _t26;
				unsigned int _t32;
				intOrPtr _t48;
				intOrPtr* _t56;

				_push(__ecx);
				_push(__ecx);
				_t48 = _a4;
				_v12 =  *(_t48 + 0xc) & 0xffff0000;
				_t32 =  *(_t48 + 0x10);
				_t43 = 1 << (_t32 >> 0x00000002 & 0x0000003f);
				_t5 = _t43 - 1; // 0x0
				_t6 = _t43 - 1; // 0x0
				_t56 = _a8;
				_v8 = ((_t32 >> 0x00000001 & 1) + (_t32 >> 0xc) << 0xc) - 1 + (1 << (_t32 >> 0x00000002 & 0x0000003f)) - (_t5 + ((_t32 >> 0x00000001 & 1) + (_t32 >> 0x0000000c) << 0x0000000c) & _t6);
				_push( *((intOrPtr*)(_t56 + 4)));
				_push( *_t56);
				_push(0x8000);
				L6E00AFDE( &_v12,  &_v8);
				if(E6DF67D50() == 0) {
					_t26 = 0x7ffe0388;
				} else {
					_t26 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t26 != 0) {
					E6DFFFE3F(_t56, _v12, _v8);
				}
				return E6E00BCD2(_t48,  *_t56,  *((intOrPtr*)(_t56 + 4)));
			}

0x6e00e967
0x6e00e968
0x6e00e96b
0x6e00e976
0x6e00e979
0x6e00e990
0x6e00e997
0x6e00e99a
0x6e00e9a4
0x6e00e9b1
0x6e00e9b4
0x6e00e9b7
0x6e00e9b9
0x6e00e9be
0x6e00e9ca
0x6e00e9dc
0x6e00e9cc
0x6e00e9d5
0x6e00e9d5
0x6e00e9e4
0x6e00e9ee
0x6e00e9ee
0x6e00ea04

APIs

RtlGetCurrentServiceSessionId.9419(00008000,?,?,?,DDEEDDEE,?,?,?,6E00B5F7,?,?,?,00000000), ref: 6E00E9C3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID:
API String ID: 1007659313-0
Opcode ID: 4cd26bc2830512c8efe61bd487b81e34690bbdf952f6f3e231af462827596455
Instruction ID: 6d352457b84b00022db31ae0eac85614bf184b78d29b1fe8904c2d9ad66a9d01
Opcode Fuzzy Hash: 4cd26bc2830512c8efe61bd487b81e34690bbdf952f6f3e231af462827596455
Instruction Fuzzy Hash: FE11C432A00519AFEB19CB98CC01BADF7F5EF84314F058269EC55A7750DB31AD52CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD4257, Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6DFD4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x6e0208d0);
				E6DF9D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E6DFD41E8(__ebx, __edi, __ecx, _t39);
				L6DF5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x6e0387e4;
					_t18 =  *0x6e0387e0;
					while(_t18 != 0) {
						_t43 = _t18 -  *0x6e035cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x6e0387e4;
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x6e0387e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								E6DF47055(_t31 + 0xfffffff8);
								_t18 =  *0x6e0387e0 - 1;
								 *0x6e0387e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x6e035cd0;
				if( *0x6e035cd0 <= 0) {
					E6DF47055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x6e0387e8;
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x6e0387e8 = _t30;
						 *0x6e0387e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E6DF9D0D1(E6DFD4320());
			}

0x6dfd4257
0x6dfd4257
0x6dfd4257
0x6dfd4259
0x6dfd425e
0x6dfd4263
0x6dfd4265
0x6dfd4273
0x6dfd4278
0x6dfd427c
0x6dfd427f
0x6dfd4281
0x6dfd4287
0x6dfd42d7
0x6dfd42d7
0x6dfd42da
0x6dfd428d
0x6dfd428d
0x6dfd428f
0x6dfd4292
0x6dfd4297
0x6dfd429c
0x6dfd42a0
0x6dfd42a6
0x6dfd42a8
0x6dfd42ae
0x6dfd42b3
0x00000000
0x6dfd42ba
0x6dfd42ba
0x6dfd42bf
0x6dfd42c5
0x6dfd42cf
0x6dfd42d0
0x00000000
0x6dfd42d0
0x6dfd42b3
0x00000000
0x6dfd42a6
0x6dfd429c
0x6dfd42dc
0x6dfd42dc
0x6dfd42e3
0x6dfd4309
0x6dfd42e5
0x6dfd42e5
0x6dfd42e8
0x6dfd42ee
0x6dfd42f0
0x00000000
0x6dfd42f2
0x6dfd42f2
0x6dfd42f4
0x6dfd42f7
0x6dfd42f9
0x6dfd4300
0x6dfd4300
0x6dfd42f0
0x6dfd430e
0x6dfd431f

APIs

Part of subcall function 6DFD41E8: RtlEnterCriticalSection.9419(?,6E0208F0,00000008,6DFD426A,6E0208D0,00000008,6DF79B80,?,?,?,?,6DF5ED2D,-00000F38,6E0384D8,6E0384D8,6DF917F0), ref: 6DFD4206

RtlEnterCriticalSection.9419(?,6E0208D0,00000008,6DF79B80,?,?,?,?,6DF5ED2D,-00000F38,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715), ref: 6DFD4273

Part of subcall function 6DF47055: RtlDebugPrintTimes.9419(00000001,?,6E01FE98,?,00000000,00000000,7FFFFFFF,?,?,?,?,6DFD430E,?,6E0208D0,00000008,6DF79B80), ref: 6DF47086
Part of subcall function 6DF47055: RtlFreeHeap.9419(?,00000000,00000002,7FFFFFFF,?,?,?,?,6DFD430E,?,6E0208D0,00000008,6DF79B80,?,?), ref: 6DF470AB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterSection$DebugFreeHeapPrintTimes
String ID:
API String ID: 4177879599-0
Opcode ID: ed1fadca2571ce0dc457dcb75ca52a88a9f4ee261429d2c1a9f06bb444eab00a
Instruction ID: e6dd7307890da7619b7461cbcd39cd56a7e0902b4b44e15f0e1263bc818713c3
Opcode Fuzzy Hash: ed1fadca2571ce0dc457dcb75ca52a88a9f4ee261429d2c1a9f06bb444eab00a
Instruction Fuzzy Hash: EF215170505A02CFDB55CFACC04065477F2FB8A319B2981EEC615CB294D731E982CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF445D0, Relevance: 1.6, APIs: 1, Instructions: 55
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6DF445D0(signed int* _a4, signed int _a8) {
				signed int _v8;
				signed char _v16;
				signed int _v20;
				signed int _v24;
				void* __esi;
				intOrPtr _t33;
				intOrPtr _t38;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				signed int* _t45;
				signed int _t46;

				_v8 =  *0x6e03d360 ^ _t46;
				_t45 = _a4;
				if((_a8 & 0xfffffff8) != 0 || (_a8 & 0x00000003) == 3) {
					_t39 = 0xc00000f0;
				} else {
					if((_a8 & 0x00000002) != 0) {
						_push("true");
						_push(0x10);
						_push( &_v24);
						_push(0x2c);
						_push(0xfffffffe);
						_t33 = E6DF89750();
						_t39 = _t33;
						if(_t33 >= 0) {
							if((_a8 & 0x00000004) != 0 || (_v16 & 0x00000001) == 0) {
								 *_t45 = _v24;
								_t45[1] = _v20;
							} else {
								 *_t45 =  *_t45 & 0x00000000;
								_t45[1] = _t45[1] & 0x00000000;
							}
						}
					} else {
						_t42 =  *[fs:0x18];
						 *_t45 =  *(_t42 + 0x19c);
						_t39 = 0;
						_t45[1] =  *(_t42 + 0x1a0);
					}
				}
				return E6DF8B640(_t39, _t38, _v8 ^ _t46, _t43, _t44, _t45);
			}

0x6df445df
0x6df445ea
0x6df445ed
0x6df44630
0x6df445f9
0x6df445fd
0x6dfa0936
0x6dfa0938
0x6dfa093d
0x6dfa093e
0x6dfa0940
0x6dfa0942
0x6dfa0947
0x6dfa094b
0x6dfa0955
0x6dfa096c
0x6dfa0971
0x6dfa095d
0x6dfa095d
0x6dfa0960
0x6dfa0960
0x6dfa0955
0x6df44603
0x6df44603
0x6df44610
0x6df44618
0x6df4461a
0x6df4461a
0x6df445fd
0x6df4462d

APIs

ZwQueryInformationThread.9419(000000FE,0000002C,?,00000010,00000000), ref: 6DFA0942

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQueryThread
String ID:
API String ID: 741662350-0
Opcode ID: 63405f67618257f04e1c54e9090eb7a8e3735dd276bd876585b96baf94b9e2b7
Instruction ID: dc0a689ed51c524db2b8d59852694e66531b5de8ddead81c741bc70ccd411358
Opcode Fuzzy Hash: 63405f67618257f04e1c54e9090eb7a8e3735dd276bd876585b96baf94b9e2b7
Instruction Fuzzy Hash: B011947161474A9BDB11CF1CC505BAABBF0AF0D328F50C45DE8A9AB2C2D7B4A941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6E001411, Relevance: 1.6, APIs: 1, Instructions: 51
nativeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E6E001411(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v12;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				short _v74;
				char _v80;
				void* __edi;
				void* __esi;
				intOrPtr _t28;
				void* _t30;
				intOrPtr _t35;
				intOrPtr _t45;
				intOrPtr _t46;
				signed int _t47;

				_t35 = __ebx;
				_v12 =  *0x6e03d360 ^ _t47;
				_v36 = _a8;
				_t46 = __ecx;
				_v48 = __ecx;
				_t45 = _a20;
				_v40 = __edx;
				_v28 = 0;
				_v32 = 0;
				_v24 = 0;
				_v20 = E6DFF25A4(__ecx);
				_t28 = _a4;
				if(_a12 != 0) {
					_t28 = _t28 - _a16;
				}
				_v44 = _t28;
				_t30 = E6DFFF9B9(_t46,  &_v28,  &_v24);
				_v74 = 0x102a;
				_push( &_v80);
				_push(0x20);
				_push(0x403);
				_push(_t45);
				_v32 = _v28 -  *((intOrPtr*)(_t46 + 0x234)) - _t30;
				return E6DF8B640(E6DF89AE0(), _t35, _v12 ^ _t47,  &_v28, _t45, _t46);
			}

0x6e001411
0x6e001420
0x6e001427
0x6e00142a
0x6e00142e
0x6e001432
0x6e001435
0x6e001438
0x6e00143b
0x6e00143e
0x6e00144a
0x6e00144d
0x6e001450
0x6e001452
0x6e001452
0x6e001455
0x6e001461
0x6e001476
0x6e00147d
0x6e00147e
0x6e001480
0x6e001485
0x6e001486
0x6e00149d

APIs

ZwTraceEvent.9419(?,00000403,00000020,?,?,7FFE038A), ref: 6E001489

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: EventTrace
String ID:
API String ID: 4247373253-0
Opcode ID: 4ad4b5bb55553f19c5c6b86eb5497ba6f21932deba7c36f4c11e388e55288ba2
Instruction ID: 3a44a5640c05e1dc3b0c1f0bcb7509642876e0e207c62ba4c2e4b4aaf6624464
Opcode Fuzzy Hash: 4ad4b5bb55553f19c5c6b86eb5497ba6f21932deba7c36f4c11e388e55288ba2
Instruction Fuzzy Hash: 211106B1E0020E9FCB14DFB9C455AEEBBF4EF48210F00416AE615E7250EB74AA01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6DF431E0, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF431E0(intOrPtr _a4, intOrPtr _a8) {
				char* _t12;
				signed int* _t13;
				signed int _t26;
				intOrPtr _t28;

				_t28 = _a4;
				_t26 = 0;
				_t12 = E6DF4354C(_t28, 0);
				if(_t12 == 0) {
					L3:
					return _t12;
				}
				if(_a8 != 0) {
					_t13 = _t28 + 0xa8;
					_t26 =  *_t13;
					 *_t13 = 0;
				}
				_t12 = E6DF79ED0(_t28 + 0x20,  ~_t26, 1);
				if(_t26 != 0) {
					if(E6DF67D50() == 0) {
						_t12 = 0x7ffe0386;
					} else {
						_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					}
					if( *_t12 == 0) {
						goto L3;
					}
					return E6E018966( *((intOrPtr*)(_t28 + 0x5c)), _t28 + 0x78, _t28 + 0x30,  *((intOrPtr*)(_t28 + 0x34)),  *((intOrPtr*)(_t28 + 0x3c)), _t26);
				} else {
					goto L3;
				}
			}

0x6df431e6
0x6df431ec
0x6df431f1
0x6df431f8
0x6df4321c
0x6df4321c
0x6df4321c
0x6df431fd
0x6df9fe1e
0x6df9fe24
0x6df9fe24
0x6df9fe24
0x6df4320c
0x6df43213
0x6df9fe32
0x6df9fe44
0x6df9fe34
0x6df9fe3d
0x6df9fe3d
0x6df9fe4c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlGetCurrentServiceSessionId.9419(00000001,00000000), ref: 6DF9FE2B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID:
API String ID: 1007659313-0
Opcode ID: cd41840913fde36b44aca51169ed52aaca1c3c379bf37e85e3a76e03a02823ec
Instruction ID: 9cbb2fdbfd3ef247b42281aca15a9e2048f9ed0bd18d8679349809901f933315
Opcode Fuzzy Hash: cd41840913fde36b44aca51169ed52aaca1c3c379bf37e85e3a76e03a02823ec
Instruction Fuzzy Hash: C301F5326807029FEB22D7AED900AA777E9FFC1714F018419EA51CB501DA30E901C760

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5FC77, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF5FC77(void* __ebx, void* __esi) {
				intOrPtr* _t16;
				signed int _t17;
				void* _t24;
				void* _t29;
				void* _t30;

				_t29 = __esi;
				_t24 = __ebx;
				_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t16 != 0) {
					if( *_t16 == 0) {
						goto L1;
					}
					_t17 =  *( *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a) & 0x000000ff;
					L2:
					if(_t17 != 0) {
						_t17 =  *[fs:0x30];
						if(( *(_t17 + 0x240) & 0x00000004) != 0) {
							if(E6DF67D50() == 0) {
								_t17 =  *0x7ffe0385 & 0x000000ff;
							} else {
								_t17 =  *( *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b) & 0x000000ff;
							}
							if((_t17 & 0x00000020) != 0) {
								_t17 = L6DFC7016(0x1496, _t29, 0xffffffff, 0xffffffff, _t24, _t24);
							}
						}
					}
					if( *((intOrPtr*)(_t30 - 0x24)) != _t24) {
						L16:
						return E6DF4B1E1(0xc0000142, 0x1496,  *((intOrPtr*)(_t30 + 8)), _t24);
					} else {
						if( *((char*)(_t30 - 0x19)) == 0) {
							if( *((intOrPtr*)(_t30 + 8)) != 1) {
								goto L5;
							} else {
								goto L16;
							}
						}
						L5:
						return _t17;
					}
				}
				L1:
				_t17 =  *0x7ffe0384 & 0x000000ff;
				goto L2;
			}

0x6df5fc77
0x6df5fc77
0x6df5fc7d
0x6df5fc82
0x6dfabec6
0x00000000
0x00000000
0x6dfabed5
0x6df5fc8f
0x6df5fc91
0x6dfabee1
0x6dfabeee
0x6dfabefb
0x6dfabf0f
0x6dfabefd
0x6dfabf06
0x6dfabf06
0x6dfabf18
0x6dfabf2b
0x6dfabf2b
0x6dfabf18
0x6dfabeee
0x6df5fc9a
0x6dfabf35
0x00000000
0x6df5fca0
0x6df5fca4
0x6df5fcab
0x00000000
0x6df5fcad
0x00000000
0x6df5fcad
0x6df5fcab
0x6df5fca6
0x6df5fca6
0x6df5fca6
0x6df5fc9a
0x6df5fc88
0x6df5fc88
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6061b1a105af8bd113dd05c63bffe6e8b683994392df491d5f2b64cd8341ed23
Instruction ID: a68da7c0179b4c54886915baac64a723bdce8292f3fe47f51f48ced069a8a409
Opcode Fuzzy Hash: 6061b1a105af8bd113dd05c63bffe6e8b683994392df491d5f2b64cd8341ed23
Instruction Fuzzy Hash: D211E131219285DFD712CB5CC558BB53BB4BF06758F0949F5E9A08B5E1C338DE90CA21

Uniqueness

Uniqueness Score: -1.00%

Function 6E018450, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E6E018450(intOrPtr _a4) {
				void* __ecx;
				unsigned int _t10;
				unsigned int* _t20;

				_t28 = _a4;
				_t20 = _a4 + 0x8c;
				_t10 =  *_t20;
				if(_t10 >= 2) {
					_t10 =  *_t20;
					do {
						asm("lock cmpxchg [edx], ecx");
					} while ((_t10 & 1) != 0);
					_t27 = _t10 >> 1;
					if(_t10 >> 1 != 0) {
						E6DF79ED0(_t28 + 0x20,  ~_t27, 0);
						if(E6DF67D50() == 0) {
							_t10 = 0x7ffe0386;
						} else {
							_t10 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						}
						if( *_t10 != 0) {
							return E6E018966( *((intOrPtr*)(_t28 + 0x5c)), _t28 + 0x78,  *((intOrPtr*)(_t28 + 0x30)),  *((intOrPtr*)(_t28 + 0x34)),  *((intOrPtr*)(_t28 + 0x3c)), _t27);
						}
					}
				}
				return _t10;
			}

0x6e018457
0x6e01845b
0x6e018461
0x6e018466
0x6e01846b
0x6e01846d
0x6e018471
0x6e018471
0x6e018479
0x6e01847b
0x6e018486
0x6e018492
0x6e0184a4
0x6e018494
0x6e01849d
0x6e01849d
0x6e0184ac
0x00000000
0x6e0184be
0x6e0184ac
0x6e01847b
0x6e0184c7

APIs

RtlGetCurrentServiceSessionId.9419(00000000,?,?,?,?,6DFB96F2,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6E01848B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID:
API String ID: 1007659313-0
Opcode ID: fab0c485f60ad926169880dc8cf1c2acbb4a6bb70ced4fcaa2074de596fe31cb
Instruction ID: d536fcd4b642a5f0e18d47cd24f518449ba013202eb573835e42ef82255e3686
Opcode Fuzzy Hash: fab0c485f60ad926169880dc8cf1c2acbb4a6bb70ced4fcaa2074de596fe31cb
Instruction Fuzzy Hash: D001D4362186019FE7218AE9D840FD6B7EAFFC5350F044819E6568F650EF70FA40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E001582, Relevance: 1.5, APIs: 1, Instructions: 48
nativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E6E001582(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				short _v74;
				char _v80;
				void* __edi;
				void* __esi;
				void* _t28;
				signed int _t45;

				_v12 =  *0x6e03d360 ^ _t45;
				_v44 = _a4;
				_v36 = _a8;
				_v48 = __ecx;
				_v40 = __edx;
				_v28 = 0;
				_v32 = 0;
				_v24 = 0;
				_v20 = E6DFF25A4(__ecx);
				_t28 = E6DFFF9B9(__ecx,  &_v28,  &_v24);
				_v74 = 0x1025;
				_push( &_v80);
				_push(0x20);
				_push(0x403);
				_push(_a12);
				_v32 = _v28 -  *((intOrPtr*)(__ecx + 0x234)) - _t28;
				return E6DF8B640(E6DF89AE0(), __ebx, _v12 ^ _t45,  &_v28, _a12, __ecx);
			}

0x6e001591
0x6e001597
0x6e00159e
0x6e0015a5
0x6e0015ac
0x6e0015af
0x6e0015b2
0x6e0015b5
0x6e0015bd
0x6e0015c9
0x6e0015de
0x6e0015e5
0x6e0015e6
0x6e0015e8
0x6e0015ed
0x6e0015ee
0x6e001605

APIs

ZwTraceEvent.9419(?,00000403,00000020,?,?,7FFE038A,?,?,?,000000FF,00000014,00000000,?,00001000,0000003C,000000FF), ref: 6E0015F1

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: EventTrace
String ID:
API String ID: 4247373253-0
Opcode ID: 5d9bb9f12ba184e0d60ab70cabcc978ae8d8c9ae721355992cb4d90392111e4d
Instruction ID: 5748ec5f5b3fe74e02d1fd5ba2ca85b5121e7c658c2e1d1e72411b08490ffd28
Opcode Fuzzy Hash: 5d9bb9f12ba184e0d60ab70cabcc978ae8d8c9ae721355992cb4d90392111e4d
Instruction Fuzzy Hash: F811F3B1E0020D9FCB14DFA9C8459EEBBF8EF48210F01456AE615E7240EB74AA01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6E6F9, Relevance: 1.5, APIs: 1, Instructions: 47
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DF6E6F9(void* __ecx) {
				char _v8;
				signed int _t11;
				intOrPtr* _t12;
				void* _t15;
				intOrPtr* _t20;
				intOrPtr _t23;
				char _t25;
				intOrPtr _t27;
				void* _t30;

				_push(__ecx);
				_t30 = __ecx;
				_t11 =  *(__ecx + 0xb4) & 0x00000003;
				if(_t11 == 3) {
					_t20 = __ecx + 0xb0;
					while(1) {
						_t12 = 0x7ffe03c0;
						do {
							_t23 =  *_t12;
							_t27 =  *_t20;
							_t15 =  *((intOrPtr*)( *((intOrPtr*)(_t30 + 0x8c)) + 0xfc)) + _t23;
							_t25 = _t15 + _t23;
							if(_t27 < _t15) {
								goto L7;
							}
							_t11 = _t25 + _t23;
							if(_t27 > _t11) {
								goto L7;
							}
							goto L3;
							L7:
							asm("lock cmpxchg [ebx], ecx");
							_t12 = 0x7ffe03c0;
						} while (_t27 != _t27);
						_push(4);
						_v8 = _t25;
						_push( &_v8);
						_push(8);
						_push( *((intOrPtr*)(_t30 + 0xa8)));
						E6DF89DB0();
					}
				}
				L3:
				return _t11;
			}

0x6df6e6fe
0x6df6e700
0x6df6e708
0x6df6e70d
0x6df6e710
0x6df6e717
0x6df6e717
0x6dfb3faa
0x6dfb3faa
0x6dfb3fb2
0x6dfb3fba
0x6dfb3fbc
0x6dfb3fc1
0x00000000
0x00000000
0x6dfb3fc3
0x6dfb3fc8
0x00000000
0x00000000
0x00000000
0x6dfb3fd1
0x6dfb3fd5
0x6dfb3fdb
0x6dfb3fdb
0x6dfb3fe2
0x6dfb3fe7
0x6dfb3fea
0x6dfb3feb
0x6dfb3fed
0x6dfb3ff3
0x6dfb3ff3
0x6df6e717
0x6df6e721
0x6df6e725

APIs

ZwAlpcSetInformation.9419(?,00000008,?,00000004,?,?,?,?,?,6DF6EB6F), ref: 6DFB3FF3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcInformation
String ID:
API String ID: 597776818-0
Opcode ID: 83604ebe39fb08432c75af25fb450c7beeb9d76a23e2929c3ac89b0b4607caea
Instruction ID: a705673b1373f57ead084b2dde19a7d9fa47d3f6dbed35b4f8efd91d8bd1f968
Opcode Fuzzy Hash: 83604ebe39fb08432c75af25fb450c7beeb9d76a23e2929c3ac89b0b4607caea
Instruction Fuzzy Hash: 0D01A733348645DFD715CA5DDC80F95B3FAFB86310F14406AE655D7210DA70AC4986A2

Uniqueness

Uniqueness Score: -1.00%

Function 6E011074, Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E6E011074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				intOrPtr _v11;
				unsigned int _v12;
				intOrPtr _v15;
				void* __esi;
				void* __ebp;
				unsigned int _t13;
				char* _t16;
				signed int* _t35;

				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 = _t13;
				if(_a4 != 0) {
					_push((_t13 >> 0x14) + (_t13 >> 0x14));
					E6E01165E(__ebx, 0x6e038ae4, (__edx -  *0x6e038b04 >> 0x14) + (__edx -  *0x6e038b04 >> 0x14), __edi, __ecx, (__edx -  *0x6e038b04 >> 0x14) + (__edx -  *0x6e038b04 >> 0x14));
				}
				_push( *((intOrPtr*)(_t35 + 0x38)));
				_push( *((intOrPtr*)(_t35 + 0x34)));
				_push(0x8000);
				L6E00AFDE( &_v8,  &_v12);
				if(E6DF67D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E6DFFFE3F(_t35, _v11, _v15);
				}
				return _t16;
			}

0x6e011080
0x6e011082
0x6e01108a
0x6e01108f
0x6e011093
0x6e0110a8
0x6e0110ab
0x6e0110ab
0x6e0110b0
0x6e0110b7
0x6e0110be
0x6e0110c3
0x6e0110cf
0x6e0110e1
0x6e0110d1
0x6e0110da
0x6e0110da
0x6e0110e9
0x6e0110f5
0x6e0110f5
0x6e0110fe

APIs

RtlGetCurrentServiceSessionId.9419(00008000,00000000,00000000,?,?), ref: 6E0110C8

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID:
API String ID: 1007659313-0
Opcode ID: cb64a22e8ce36abea19d44aaf4b089eced9d527b513d39e29ea8bfa95818daf0
Instruction ID: a13b1385eb96d2dbc5360c124089e87956feb31858960adcddeeaace6b4b3a5c
Opcode Fuzzy Hash: cb64a22e8ce36abea19d44aaf4b089eced9d527b513d39e29ea8bfa95818daf0
Instruction Fuzzy Hash: A9019C729087439FC745CFE8C800B9A77E9AB80344F00CA29F88187690DF70D948CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF41480, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF41480(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				char _v16;
				char _t12;
				void* _t16;
				void* _t18;
				intOrPtr _t23;
				void* _t25;

				_t16 = __ecx;
				_v8 = __ecx;
				_t23 = __edx;
				_t5 = _t16 + 0xe; // 0xe
				_t12 = E6DF4187D(__edx, _t5, __ecx,  &_v12, 0,  &_v16,  &_v8);
				if(_t12 >= 0) {
					_t25 = _v8;
					if(_t25 != 0) {
						_t18 = _v12;
						if(_t18 != 0) {
							 *_t18 =  *_t25;
						}
						E6DF414DE(_t23, _t25);
						_t12 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t25);
					}
					return _t12;
				}
				return _t12;
			}

0x6df41480
0x6df4148c
0x6df41493
0x6df4149d
0x6df414a2
0x6df414a9
0x6df414ac
0x6df414b1
0x6df414b3
0x6df414b8
0x6df414bc
0x6df414bc
0x6df414c2
0x6df414d3
0x6df414d3
0x00000000
0x6df414d8
0x6df414dd

APIs

Part of subcall function 6DF4187D: _wcsicmp.9419(0000001C,?,?,?,00000000,?,?,?,?), ref: 6DF41921

RtlFreeHeap.9419(?,00000000,?,00000000,00000000,?,00000000,?,?,?), ref: 6DF414D3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap_wcsicmp
String ID:
API String ID: 3832816018-0
Opcode ID: cf7d4663d62046aefbf398c2601a6ef7ccf85a2c444bb44e9c472d1d2916286d
Instruction ID: 1d8bf6539e45a1180046de595619650fc1f3514672c8b93ed2b5d798875083f0
Opcode Fuzzy Hash: cf7d4663d62046aefbf398c2601a6ef7ccf85a2c444bb44e9c472d1d2916286d
Instruction Fuzzy Hash: 8BF08C36B01108ABDB15DA49C840FBEBBADDB85610F1081AAA905EB655DA70AE118790

Uniqueness

Uniqueness Score: -1.00%

Function 6DF43591, Relevance: 1.5, APIs: 1, Instructions: 41
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6DF43591(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v12;
				char _v20;
				void* __esi;
				void* __ebp;
				void* _t16;
				void* _t19;
				void* _t25;
				intOrPtr _t26;

				_t22 = __edx;
				_t20 = __ecx;
				if(__ecx == 0 || __edx == 0) {
					L7:
					E6E0188F5(_t19, _t20, _t22, _t25, _t26, __eflags);
					return 0xc000000d;
				}
				_t26 = _a4;
				if(_t26 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L7;
				}
				_push(0x1e);
				_v12 =  *((intOrPtr*)(_t26 + 0x28));
				_push(8);
				_push( &_v12);
				_v8 = __edx;
				_push( &_v20);
				_push(__ecx);
				_t16 = E6DF89770();
				if(_t16 >= 0) {
					E6DF6F0AE(_t26, 1);
					return 0;
				}
				return _t16;
			}

0x6df43591
0x6df43591
0x6df4359c
0x6df435ea
0x6df435ea
0x00000000
0x6df435ef
0x6df435a2
0x6df435a7
0x00000000
0x00000000
0x6df435bb
0x6df435bd
0x6df435c3
0x6df435c5
0x6df435c9
0x6df435cc
0x6df435cd
0x6df435ce
0x6df435d5
0x6df435dc
0x00000000
0x6df435e1
0x6df435e7

APIs

ZwSetInformationFile.9419(?,?,?,00000008,0000001E), ref: 6DF435CE

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: f6e0febadd5fde40c3eeffad060a4314c3d5d20580ee8ab27703d0150818c60e
Instruction ID: 7c4487d35d0b93c1e27edb11516f501005d376b11e1586d2ca3c2cc2afe7ce05
Opcode Fuzzy Hash: f6e0febadd5fde40c3eeffad060a4314c3d5d20580ee8ab27703d0150818c60e
Instruction Fuzzy Hash: 07F0FC71A45246ABE704CB6D8651FBE7BE8DF44720F04C155ED05D7142DB31FD4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44B00, Relevance: 1.5, APIs: 1, Instructions: 39
nativeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6DF44B00(intOrPtr _a4) {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				signed int _t24;

				_v8 = _v8 & 0x00000000;
				_t24 = E6DF6EABD(_a4, 1,  &_v8,  &_v12,  &_v20);
				if(_t24 < 0) {
					asm("sbb eax, eax");
					return  ~(_t24 + 0x3fffff45) & _t24;
				}
				if(_v12 == 0) {
					_push(4);
					_push( &_v16);
					_push(9);
					_v16 = 1;
					_push( *((intOrPtr*)(_v8 + 0x24)));
					_t24 = E6DF8AE70();
				}
				return _t24;
			}

0x6df44b0e
0x6df44b23
0x6df44b27
0x6dfa0b1b
0x00000000
0x6dfa0b1d
0x6df44b31
0x6dfa0b2a
0x6dfa0b2c
0x6dfa0b2d
0x6dfa0b2f
0x6dfa0b36
0x6dfa0b3e
0x6dfa0b3e
0x00000000

APIs

ZwSetInformationWorkerFactory.9419(?,00000009,?,00000004,00000000,?,?), ref: 6DFA0B39

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FactoryInformationWorker
String ID:
API String ID: 270927234-0
Opcode ID: 8002d366c0bdd5bfcf317ca2558470650a0f150a78c7477d2a783c70a29503f7
Instruction ID: 816e2f1bcee18d8e778f6c902433821cae37f3f52c2af44796f0f37944d723ba
Opcode Fuzzy Hash: 8002d366c0bdd5bfcf317ca2558470650a0f150a78c7477d2a783c70a29503f7
Instruction Fuzzy Hash: 7AF0AF72B1010EEBDF05CAA9D941FEE77B9EB80308F0081AAA515DB1C0EB749E05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8108B, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

ZwClose.9419(?,00000000,?,?,?,?,?,6DF80FD0,?,?,?), ref: 6DFBCD6F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 72ce5405b87c332519562a1b51179f812361052ad1d75d8ac99ec2f5c21ed0d9
Instruction ID: 8d8a3ce5a4f483d5ce6bde012799c1498884f2cb2778f21a0877e605771f7284
Opcode Fuzzy Hash: 72ce5405b87c332519562a1b51179f812361052ad1d75d8ac99ec2f5c21ed0d9
Instruction Fuzzy Hash: 68F0BB37B141879BE714CA1DDC01E6733BADBC5210F34C3B99910CB281DA71DC0187A2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF41BE9, Relevance: 1.5, APIs: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E6DF41BE9(void* __ecx, signed int** __edx, void* __eflags) {
				long _v8;
				signed int* _t9;
				signed int* _t12;
				void* _t14;
				signed int* _t15;
				signed int** _t22;

				_push(__ecx);
				_v8 = 0x10;
				_push( &_v8);
				_t22 = __edx;
				_t14 = 0x10;
				if(E6DF41C45(_t14, __ecx) < 0) {
					L4:
					_t9 = 0;
				} else {
					_t15 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _v8);
					if(_t15 == 0) {
						goto L4;
					} else {
						 *_t15 =  *_t15 & 0x00000000;
						_t5 =  &(_t15[2]); // 0x8
						_t12 = _t5;
						 *_t12 = 1;
						_t15[2] = 0;
						 *_t22 = _t12;
						_t9 = _t15;
					}
				}
				return _t9;
			}

0x6df41bee
0x6df41bf3
0x6df41bfa
0x6df41bfb
0x6df41c01
0x6df41c09
0x6df41c41
0x6df41c41
0x6df41c0b
0x6df41c1e
0x6df41c22
0x00000000
0x6df41c24
0x6df41c24
0x6df41c27
0x6df41c27
0x6df41c2d
0x6df41c32
0x6df41c36
0x6df41c38
0x6df41c38
0x6df41c22
0x6df41c3e

APIs

RtlAllocateHeap.9419(?,00000000,00000010,?,C0000017,?,?,6DF416AA,?,?,?,?,?,?,?,?), ref: 6DF41C19

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 41b619a71a48c2b8fc4bd3b9482bbcb6548e364b6e99d490dbd24e33bd0f4c0c
Instruction ID: 4b4ef5c018a5fe35b24f3541ee0b661eb71dae306900e44f99a80f21aaebaa60
Opcode Fuzzy Hash: 41b619a71a48c2b8fc4bd3b9482bbcb6548e364b6e99d490dbd24e33bd0f4c0c
Instruction Fuzzy Hash: 82F0F631614208ABE718CB2DCD00B96B7EDEF88304F10C0789648C7251EB72DD61D354

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6F0AE, Relevance: 1.5, APIs: 1, Instructions: 36
nativeCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6DF6F0AE(void* __ecx, void* __edx) {
				signed int _v8;
				void* _t6;
				signed int _t8;
				signed int _t9;
				void* _t12;

				_t12 = __ecx;
				_push(__ecx);
				if(__edx != 0) {
					asm("lock xadd [eax], esi");
					_t8 = __edx + __edx;
					if(__edx <= 0) {
						if(_t8 <= 0) {
							if(__edx <= 0) {
								L3:
								return _t8;
							}
							goto L2;
						}
						_t9 = 1;
						L7:
						_push(4);
						_v8 = _t9;
						_push( &_v8);
						_push(3);
						_push( *((intOrPtr*)(_t12 + 0x24)));
						_t8 = E6DF8AE70();
						goto L3;
					}
					L2:
					if(_t8 <= 0) {
						_t9 = _t8 | 0xffffffff;
						goto L7;
					}
					goto L3;
				}
				return _t6;
			}

0x6df6f0ae
0x6df6f0b3
0x6df6f0b6
0x6df6f0c1
0x6df6f0c5
0x6df6f0ca
0x6df6f0d7
0x6df6f0f8
0x6df6f0d0
0x00000000
0x6df6f0d0
0x00000000
0x6df6f0fa
0x6df6f0db
0x6df6f0dc
0x6df6f0dc
0x6df6f0de
0x6df6f0e4
0x6df6f0e5
0x6df6f0e7
0x6df6f0ea
0x00000000
0x6df6f0ea
0x6df6f0cc
0x6df6f0ce
0x6df6f0f1
0x00000000
0x6df6f0f1
0x00000000
0x6df6f0ce
0x6df6f0d4

APIs

ZwSetInformationWorkerFactory.9419(?,00000003,?,00000004,?,?,?,6DF435E1,?,?,?,00000008,0000001E), ref: 6DF6F0EA

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FactoryInformationWorker
String ID:
API String ID: 270927234-0
Opcode ID: a0ee01f4a1db947d0b3968aef5eb2639bb308b81b8fee587a1dfcfc799c48957
Instruction ID: 7d00788a6de433a7f1e492760ddb3e9da17462e878db33c4a44d646dbc6eef44
Opcode Fuzzy Hash: a0ee01f4a1db947d0b3968aef5eb2639bb308b81b8fee587a1dfcfc799c48957
Instruction Fuzzy Hash: 70F0E27285D29AF6E7A2861DC900BA332ACEF42730F2843666C15C7980DB61C9028AE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4B630, Relevance: 1.5, APIs: 1, Instructions: 35
nativeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E6DF4B630(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed int _t6;
				signed int _t9;
				signed int* _t15;

				_t9 = __ecx;
				_push(__ecx);
				_t15 = __edx;
				do {
					_v8 = _t9 & 0xfffffffc;
					_t6 = _t9;
					asm("lock cmpxchg [edi], edx");
					if(_t6 == _t9) {
						_push(0);
						_push(0);
						_push( &_v8);
						_push(0);
						E6DF8B1A0();
						_t6 =  *_t15;
					}
					_t9 = _t6;
				} while ((_t6 & 0x00000003) == 1);
				return _t6;
			}

0x6df4b630
0x6df4b635
0x6df4b63e
0x6df4b643
0x6df4b64a
0x6df4b64d
0x6df4b64f
0x6df4b655
0x6df4b657
0x6df4b659
0x6df4b65e
0x6df4b65f
0x6df4b661
0x6df4b666
0x6df4b666
0x6df4b66a
0x6df4b66f
0x6df4b679

APIs

ZwWaitForKeyedEvent.9419(00000000,00000000,00000000,00000000,?,?,?,?,6DF74F39,00000000,?,00000000,?,?,00000003), ref: 6DF4B661

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: EventKeyedWait
String ID:
API String ID: 913234584-0
Opcode ID: 8fa072e66f6bef235414a7c871d0aca8543e0cbea40c35218de0dbcc55a79947
Instruction ID: fbc5c34f181ea135bbca023ea3fe1df883d9fcdf62af14032cf9554b91d2a955
Opcode Fuzzy Hash: 8fa072e66f6bef235414a7c871d0aca8543e0cbea40c35218de0dbcc55a79947
Instruction Fuzzy Hash: 7EF0A732B551196BD704C55C9C02B9A73ADD7C4731F20427AFA28D72D1EA61AE4182D5

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1976, Relevance: 1.5, APIs: 1, Instructions: 33
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DFD1976(void** __ecx) {
				void* _v8;
				void* _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				void _v28;
				void* _t11;
				signed int _t16;
				void** _t18;

				_t18 = __ecx;
				_t16 = 6;
				_t11 = memset( &_v28, 0, _t16 << 2);
				if(_t18 == 0) {
					return 0xc00000ef;
				}
				_push(_t11);
				_push(_t11);
				 *_t18 = _t11;
				_v24 = _t11;
				_v20 = _t11;
				_v12 = _t11;
				_v8 = _t11;
				_push( &_v28);
				_push(0x1f0003);
				_push(_t18);
				_v28 = 0x18;
				_v16 = 2;
				return E6DF89980();
			}

0x6dfd197e
0x6dfd1988
0x6dfd1989
0x6dfd198d
0x00000000
0x6dfd19be
0x6dfd198f
0x6dfd1990
0x6dfd1991
0x6dfd1993
0x6dfd1996
0x6dfd1999
0x6dfd199c
0x6dfd19a2
0x6dfd19a3
0x6dfd19a8
0x6dfd19a9
0x6dfd19b0
0x00000000

APIs

ZwCreateEvent.9419(?,001F0003,?,00000000,00000000,00000065), ref: 6DFD19B7

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateEvent
String ID:
API String ID: 2692171526-0
Opcode ID: f263fd383cc126812151a45e98762aea820625880bbb9479b1c8fed10d809f06
Instruction ID: 0c675c13b3e1a8376a9ac75143da31d910913630e1f1fcea4f6af272243cdb0c
Opcode Fuzzy Hash: f263fd383cc126812151a45e98762aea820625880bbb9479b1c8fed10d809f06
Instruction Fuzzy Hash: C9F030B1D0020DAFD750CE9CC4016BEBBF9AB84204F108169A508E7241E67146418B92

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF5F87, Relevance: 1.5, APIs: 1, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6DFF5F87(char* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char _v12;
				void* _t11;
				void* _t19;
				void* _t22;

				_push(__ecx);
				_push(__ecx);
				_t19 = __edx;
				_t22 = E6DFF6369(__ecx,  &_v8, __eflags,  &_v12);
				if(_t22 >= 0) {
					_t11 = E6DFF5FCC(_v8, _v12, _t19, _a4, _a8);
					_push(_v8);
					_t22 = _t11;
					_push(0xffffffff);
					E6DF897A0();
				}
				return _t22;
			}

0x6dff5f8c
0x6dff5f8d
0x6dff5f93
0x6dff5f9e
0x6dff5fa2
0x6dff5fb1
0x6dff5fb6
0x6dff5fb9
0x6dff5fbb
0x6dff5fbd
0x6dff5fbd
0x6dff5fc9

APIs

Part of subcall function 6DFF6369: RtlInitUnicodeString.9419(?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6DFF63E8
Part of subcall function 6DFF6369: ZwOpenFile.9419(?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6DFF643E
Part of subcall function 6DFF6369: ZwCreateSection.9419(?,000F0005,00000000,00000000,00000002,08000000,?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp), ref: 6DFF6490
Part of subcall function 6DFF6369: ZwMapViewOfSection.9419(?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002,08000000), ref: 6DFF64BB
Part of subcall function 6DFF6369: ZwClose.9419(?,?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002), ref: 6DFF64C8
Part of subcall function 6DFF6369: ZwClose.9419(?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6DFF64DA

ZwUnmapViewOfSection.9419(000000FF,00000000,?,?,?,?,?,00000000,?,?,?,6DFA7CCD,?,?), ref: 6DFF5FBD

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$CloseView$CreateFileInitOpenStringUnicodeUnmap
String ID:
API String ID: 1740110874-0
Opcode ID: 75df6c63a07d1514917617be698d3d68f2e0ed11b3905f3497e6c32db5ac75dc
Instruction ID: badc448f1bd1c6187182b552f83e34e0c729795693521badfe7749dade8ec763
Opcode Fuzzy Hash: 75df6c63a07d1514917617be698d3d68f2e0ed11b3905f3497e6c32db5ac75dc
Instruction Fuzzy Hash: D0E0A036904118BB4B119A88DC40CEEBBB9DB85630B1283A6BD10A3390DA319E0196E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF60A2, Relevance: 1.5, APIs: 1, Instructions: 31
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E6DFF60A2(void* __ecx, intOrPtr* __edx) {
				signed int _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v36;
				char _v44;
				void* __esi;
				intOrPtr _t16;
				intOrPtr _t21;
				intOrPtr* _t22;
				signed int _t23;

				_t20 = __edx;
				_v8 =  *0x6e03d360 ^ _t23;
				_push(5);
				_push(0x18);
				_t22 = __edx;
				_push( &_v36);
				_push( &_v44);
				_push(__ecx);
				if(E6DF895F0() >= 0) {
					 *_t22 = _v28;
					 *((intOrPtr*)(_t22 + 4)) = _v24;
				}
				return E6DF8B640(0, _t16, _v8 ^ _t23, _t20, _t21, _t22);
			}

0x6dff60a2
0x6dff60b1
0x6dff60b5
0x6dff60b7
0x6dff60bc
0x6dff60be
0x6dff60c2
0x6dff60c3
0x6dff60cb
0x6dff60d0
0x6dff60d5
0x6dff60d8
0x6dff60e8

APIs

ZwQueryInformationFile.9419(?,00000001,?,00000018,00000005,00000000,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000), ref: 6DFF60C4

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: f7fb9104f1db2f4c9f08adbd81a84771825791decd76d7b916b92be5a9fa4140
Instruction ID: 214ef7dcc4074ee7aca9f7682b2444bf08a15dc939de58f4eaa9b440be01549b
Opcode Fuzzy Hash: f7fb9104f1db2f4c9f08adbd81a84771825791decd76d7b916b92be5a9fa4140
Instruction Fuzzy Hash: 62F01C71A0021CABDB10DF69C9859EFBBF8EB48314F114569E905E7240EA30ED058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF3C60, Relevance: 1.5, APIs: 1, Instructions: 29
nativeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6DFF3C60(intOrPtr _a4, void** _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v24;
				void** _t12;

				if( *0x6e035768 != 0x6e035768) {
					_t12 = _a8;
					if(_t12 != 0) {
						L6:
						return E6DFF3D40(_a4, _t12);
					}
					_push(_t12);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_a4);
					_push(0xffffffff);
					if(E6DF89730() < 0 || _v16 == 0x10000) {
						goto L1;
					} else {
						_t12 = _v12;
						goto L6;
					}
				}
				L1:
				return 0;
			}

0x6dff3c72
0x6dff3c78
0x6dff3c7d
0x6dff3ca2
0x00000000
0x6dff3ca5
0x6dff3c7f
0x6dff3c80
0x6dff3c85
0x6dff3c86
0x6dff3c88
0x6dff3c8b
0x6dff3c94
0x00000000
0x6dff3c9f
0x6dff3c9f
0x00000000
0x6dff3c9f
0x6dff3c94
0x6dff3c74
0x00000000

APIs

ZwQueryVirtualMemory.9419(000000FF,?,00000003,00000000,00000014,?,00000000,00008000,?), ref: 6DFF3C8D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 3189e397d89f9f0f84f5d6278b3402c9b298dd9e15d1dce8c21f2b869bab7ef8
Instruction ID: c99a06952b723e6cc67cec0f5acf51e8d0909e092f88c94293ff2427f64eaf03
Opcode Fuzzy Hash: 3189e397d89f9f0f84f5d6278b3402c9b298dd9e15d1dce8c21f2b869bab7ef8
Instruction Fuzzy Hash: 4FF0A035A04209BBDF00DE99D841FAA77FAEB81710F20C254EE20061B4D6319A82C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 6DF415C1, Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF415C1(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t17;

				_t14 = __ecx;
				_t17 = __ecx;
				if(( *(__edx + 2) & 0x00000001) != 0) {
					L5:
					return 0;
				}
				 *__edx =  *__edx + 0xffff;
				if( *__edx != 0) {
					goto L5;
				}
				_t4 = _t17 + 8; // 0x8
				if(__edx != _t4) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, __edx);
					_t14 = _t17;
				}
				E6DF41480(_t14, _a4);
				return 1;
			}

0x6df415c1
0x6df415cb
0x6df415cd
0x6df415f3
0x00000000
0x6df415f3
0x6df415d4
0x6df415d7
0x00000000
0x00000000
0x6df415d9
0x6df415de
0x6df9ef10
0x6df9ef15
0x6df9ef15
0x6df415e7
0x00000000

APIs

RtlFreeHeap.9419(?,00000000,00000008,00000000,?,6DF41598,?), ref: 6DF9EF10

Part of subcall function 6DF41480: RtlFreeHeap.9419(?,00000000,?,00000000,00000000,?,00000000,?,?,?), ref: 6DF414D3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: abd4c1e868dd77add1da121991445beedef88028e086df1525fa9b969b472fc7
Instruction ID: d929ba06750575d1c1e76d4a41e5f5666734cbf05a3e0d8358db427f61e8ae44
Opcode Fuzzy Hash: abd4c1e868dd77add1da121991445beedef88028e086df1525fa9b969b472fc7
Instruction Fuzzy Hash: 54E02B3265828693DB21DB4CC600BE7BBA9BF42704F00C031E5058F552EB60DC51C3D0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF74710, Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF74710(intOrPtr* _a4) {
				void* _t5;
				intOrPtr _t12;
				intOrPtr* _t14;

				_t5 = E6DF67D50();
				if(_t5 != 0) {
					_t12 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x10));
					L3:
					 *_a4 = _t12;
					L4:
					return 1;
				}
				if( *0x7ffe0268 == _t5) {
					_t14 = _a4;
					if(E6DFF64FB(_t14) >= 0) {
						goto L4;
					}
					 *_t14 = 1;
					return 0;
				}
				_t12 =  *0x7ffe0264;
				goto L3;
			}

0x6df74716
0x6df7471d
0x6dfb6655
0x6df74735
0x6df74738
0x6df7473a
0x00000000
0x6df7473a
0x6df74729
0x6dfb662d
0x6dfb6639
0x00000000
0x00000000
0x6dfb6641
0x00000000
0x6dfb6641
0x6df7472f
0x00000000

APIs

RtlGetCurrentServiceSessionId.9419(?,?,6DF740DB,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6DF74716

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID:
API String ID: 1007659313-0
Opcode ID: 0df256ba2b9307f516b5a4f7d47ef3065f2fd7a7a153fc2d55d4bb558cf3f2de
Instruction ID: 0a04d992dcdb19322931ab74420e492c63e0ca18418f063e58805732c2e1db2d
Opcode Fuzzy Hash: 0df256ba2b9307f516b5a4f7d47ef3065f2fd7a7a153fc2d55d4bb558cf3f2de
Instruction Fuzzy Hash: 4CF0397A2083819FD716DF1EE040A957BA5AB4A364B01009AFD418B751EB31ED82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1C49, Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E6DFD1C49(void* __ecx) {
				char _v8;
				intOrPtr _t9;

				_t9 = 0;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(7);
				_push(0xffffffff);
				_v8 = 0;
				if(E6DF89670() >= 0 && _v8 != 0) {
					_t9 = 1;
				}
				return _t9;
			}

0x6dfd1c50
0x6dfd1c55
0x6dfd1c56
0x6dfd1c58
0x6dfd1c59
0x6dfd1c5b
0x6dfd1c5d
0x6dfd1c67
0x6dfd1c6e
0x6dfd1c6e
0x6dfd1c75

APIs

ZwQueryInformationProcess.9419(000000FF,00000007,?,00000004,00000000,?,?,?,6DFD1951,00000065,00000000,?,6DFD0C5E,?,00000000), ref: 6DFD1C60

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 558396aea7a7e0d24d8fbc718da7bfe81c5edd8d43f824d4519c1e457d2bb8cb
Instruction ID: b1ba9945f441937757c08d2b5563c546993ff85ba45eb8c7d5516d5ee65a9271
Opcode Fuzzy Hash: 558396aea7a7e0d24d8fbc718da7bfe81c5edd8d43f824d4519c1e457d2bb8cb
Instruction Fuzzy Hash: 1FE01271A05238B7D7219A9D9D41EEBBA6DDB41B74F200356FF25D31C0D5709E0093E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1D0B, Relevance: 1.5, APIs: 1, Instructions: 23
nativeCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E6DFD1D0B(void* __ecx) {
				char _v8;
				char _v12;

				_push(__ecx);
				_push(__ecx);
				_v12 = 0;
				_v8 = 0;
				if(__ecx != 0) {
					_push(8);
					_v8 = 0;
					_push( &_v12);
					_push(0x3f);
					_push(__ecx);
					_v12 = 1;
					return E6DF896C0();
				}
				return 0xc00000ef;
			}

0x6dfd1d10
0x6dfd1d11
0x6dfd1d14
0x6dfd1d17
0x6dfd1d1c
0x6dfd1d25
0x6dfd1d27
0x6dfd1d2d
0x6dfd1d2e
0x6dfd1d30
0x6dfd1d31
0x00000000
0x6dfd1d38
0x00000000

APIs

ZwSetInformationProcess.9419(?,0000003F,?,00000008,?,?,?,6DFD1033,?,6E0207D0,00000058,6DFD0C91,?,00000000,?,00000000), ref: 6DFD1D38

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: fbc6df2e85249d16142872a99c83c74f29f93019b8cd2d3bab0ce4f97cb2a18f
Instruction ID: 41d2ca3a6182f994b8dbd18305d2c9c1fbc22cb49e5325ff8aac8217bba3b078
Opcode Fuzzy Hash: fbc6df2e85249d16142872a99c83c74f29f93019b8cd2d3bab0ce4f97cb2a18f
Instruction Fuzzy Hash: 62E086B1D5420DBFDB44CF98C801FAFBABCD715304F10816EB504E7141EA718A408751

Uniqueness

Uniqueness Score: -1.00%

Function 6DF85C70, Relevance: 1.5, APIs: 1, Instructions: 22
nativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E6DF85C70(intOrPtr _a4, char _a8) {
				void* __ebp;
				void* _t12;
				intOrPtr _t13;
				void* _t14;
				void* _t15;
				void* _t16;

				_t13 = _a4;
				if(_t13 == 0 || _a8 < 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E6E0188F5(_t12, _t13, _t14, _t15, _t16, __eflags);
				} else {
					_push(4);
					_push( &_a8);
					_push(0xe);
					_push( *((intOrPtr*)(_t13 + 0x24)));
					return E6DF8AE70();
				}
			}

0x6df85c75
0x6df85c7a
0x00000000
0x6df85c91
0x6df85c91
0x6df85c96
0x6df85c97
0x6df85c99
0x00000000
0x6df85c9c

APIs

ZwSetInformationWorkerFactory.9419(?,0000000E,00000000,00000004,?,6E018100,00000000,00000000,00000000,00000000,6E0386C4,6E0386C4,00000008,?,00000000,00000008), ref: 6DF85C9C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FactoryInformationWorker
String ID:
API String ID: 270927234-0
Opcode ID: 34ebfc428057f1d066085d30c230a90e4380f848c7c6ec9c19e36091452cd574
Instruction ID: 7e95e9959eddcb8835310ce4002ba7a1f8bded0685e8a468cccb8b62b8dd8cd1
Opcode Fuzzy Hash: 34ebfc428057f1d066085d30c230a90e4380f848c7c6ec9c19e36091452cd574
Instruction Fuzzy Hash: DBE0DFB1104248AFFB02CBA9D442F753BBAAB45724F00C014B61A8B2A2C774DD80CF16

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD5780, Relevance: 1.5, APIs: 1, Instructions: 22
nativeCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6DFD5780(intOrPtr* _a4, intOrPtr _a8, signed short _a12) {
				intOrPtr _t6;
				intOrPtr* _t9;
				signed int _t11;
				void* _t12;

				_t9 = _a4;
				_t11 = _a12 & 0x0000ffff;
				_t12 = _t9 + 1;
				do {
					_t6 =  *_t9;
					_t9 = _t9 + 1;
				} while (_t6 != 0);
				_push(_t11);
				_push(_a8);
				_push(_t9 - _t12 & 0x0000ffff);
				_push(_a4);
				_push(2);
				return E6DF8B280();
			}

0x6dfd5785
0x6dfd5788
0x6dfd578d
0x6dfd5790
0x6dfd5790
0x6dfd5792
0x6dfd5793
0x6dfd5797
0x6dfd5798
0x6dfd57a0
0x6dfd57a1
0x6dfd57a4
0x6dfd57ad

APIs

ZwWow64DebuggerCall.9419(00000002,?,?,?,6DFE516F,6DFAD3E5,?,6DFE516F,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000), ref: 6DFD57A6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebuggerWow64
String ID:
API String ID: 1238156548-0
Opcode ID: 0b290a7770768feb458388c9549dfcdeef34a314d5ca4ccc61ddf3f44e325cf2
Instruction ID: 1264a63e11944088be9decd497c1dfb34d7b9dfa5d02a66880c4140d4e0d9c07
Opcode Fuzzy Hash: 0b290a7770768feb458388c9549dfcdeef34a314d5ca4ccc61ddf3f44e325cf2
Instruction Fuzzy Hash: DDE0C236108269BACF015E98EC04DFA7B6DDBC6721B048009FE984B142C632A912D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFCF30, Relevance: 1.5, APIs: 1, Instructions: 22
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6DFFCF30(signed int _a4) {
				void* _t6;
				intOrPtr* _t7;
				intOrPtr _t8;
				signed int _t11;
				signed int _t13;

				_t11 = _a4 & 0xfffffffc;
				if(_t11 != 0) {
					do {
						_t13 =  *(_t11 + 8);
						_t7 = _t11 + 0x14;
						_t8 = 2;
						 *_t7 = _t8;
						if( *_t7 == 0) {
							_push( *((intOrPtr*)(_t11 + 4)));
							_t7 = E6DF89BF0();
						}
						_t11 = _t13;
					} while (_t13 != 0);
					return _t7;
				}
				return _t6;
			}

0x6dffcf38
0x6dffcf3b
0x6dffcf3e
0x6dffcf3e
0x6dffcf41
0x6dffcf46
0x6dffcf47
0x6dffcf4b
0x6dffcf4d
0x6dffcf50
0x6dffcf50
0x6dffcf55
0x6dffcf57
0x00000000
0x6dffcf5b
0x6dffcf5d

APIs

ZwAlertThreadByThreadId.9419(00000000,00000000,?,6DF44FCF,00000000,6DF7E2B2,0000000A,00000000,00000000,?,?,6DF7E1FF), ref: 6DFFCF50

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Alert
String ID:
API String ID: 2775339012-0
Opcode ID: 4567a16bee730235f2e342b3371c0b7be56eb810b323addd593be7e66860425e
Instruction ID: f43f80760d848998e1b0e207342f1aa34d12e0ff011852bc72dbb03e3eefcadd
Opcode Fuzzy Hash: 4567a16bee730235f2e342b3371c0b7be56eb810b323addd593be7e66860425e
Instruction Fuzzy Hash: 6EE0863250527757C706450CD451F53FB296F40B247158251EB185F1A6C730EC82C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1C76, Relevance: 1.5, APIs: 1, Instructions: 21
nativeCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E6DFD1C76() {
				intOrPtr _v36;
				char _v52;

				_push(0);
				_push(0x30);
				_push( &_v52);
				_push(0x25);
				_push(0xffffffff);
				if(E6DF89670() >= 0) {
					return 0 | _v36 == 0x00000001;
				}
				return 0;
			}

0x6dfd1c81
0x6dfd1c83
0x6dfd1c85
0x6dfd1c86
0x6dfd1c88
0x6dfd1c91
0x00000000
0x6dfd1c9d
0x00000000

APIs

ZwQueryInformationProcess.9419(000000FF,00000025,?,00000030,00000000), ref: 6DFD1C8A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: ef0f1ae6375c217a4c60b3caf2b71a09ff0b8e3218ae4fd5b1cfe4ec20eac232
Instruction ID: 2b2c281f0468ff0c411685add3aa83c4b36d7271d1d8ff3935b990a3d2f5cda2
Opcode Fuzzy Hash: ef0f1ae6375c217a4c60b3caf2b71a09ff0b8e3218ae4fd5b1cfe4ec20eac232
Instruction Fuzzy Hash: 19D097337783583AEB54A4F84D0AFAA73ACA3443A1F080720FE21E10C0F6109400C0A5

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD41E8, Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6DFD41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x6e0208f0);
				_t5 = E6DF9D08C(__ebx, __edi, __esi);
				if( *0x6e0387ec == 0) {
					L6DF5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x6e0387ec == 0) {
						 *0x6e0387f0 = 0x6e0387ec;
						 *0x6e0387ec = 0x6e0387ec;
						 *0x6e0387e8 = 0x6e0387e4;
						 *0x6e0387e4 = 0x6e0387e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = E6DFD4248();
				}
				return E6DF9D0D1(_t5);
			}

0x6dfd41e8
0x6dfd41ea
0x6dfd41ef
0x6dfd41fb
0x6dfd4206
0x6dfd420b
0x6dfd4216
0x6dfd421d
0x6dfd4222
0x6dfd422c
0x6dfd4231
0x6dfd4231
0x6dfd4236
0x6dfd423d
0x6dfd423d
0x6dfd4247

APIs

RtlEnterCriticalSection.9419(?,6E0208F0,00000008,6DFD426A,6E0208D0,00000008,6DF79B80,?,?,?,?,6DF5ED2D,-00000F38,6E0384D8,6E0384D8,6DF917F0), ref: 6DFD4206

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 6aad78c428f01d99190c9334a19a8ed4f688fc3638bcd389c1099ea292fbeec4
Instruction ID: 24399fb618b1c955490463b9cdb2e41078a489ce4af7740723477e88e7330647
Opcode Fuzzy Hash: 6aad78c428f01d99190c9334a19a8ed4f688fc3638bcd389c1099ea292fbeec4
Instruction Fuzzy Hash: 57F01574824B02CFDBA0DFE8C50670436B6F799315F2541EAC608CB2D8D734A984CF21

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1AD6, Relevance: 1.5, APIs: 1, Instructions: 21
nativeCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E6DFD1AD6(char __ecx) {
				char _v8;
				char _v12;

				_push(__ecx);
				_push(__ecx);
				_v12 = __ecx;
				_v8 = 0xc;
				if(__ecx == 0) {
					return 0xc000000d;
				}
				_push(0x8000);
				_push( &_v8);
				_push( &_v12);
				_push(0xffffffff);
				return E6DF896E0();
			}

0x6dfd1adb
0x6dfd1adc
0x6dfd1add
0x6dfd1ae0
0x6dfd1ae9
0x00000000
0x6dfd1b01
0x6dfd1aeb
0x6dfd1af3
0x6dfd1af7
0x6dfd1af8
0x00000000

APIs

ZwFreeVirtualMemory.9419(000000FF,0000001C,0000000C,00008000,00000000,00000000,?,6DFD1931,000000FF,00000000,00000000,0000000C,00001000,00000004,6E020810,0000001C), ref: 6DFD1AFA

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: ec2c038bbe41965173b431de6640f48e66589650bd81b20a85290f99bc6fb07b
Instruction ID: 6afc508dc36fa6a286a30b7b44b8d09cb2a71eaea3c33a2cb4fa723642654192
Opcode Fuzzy Hash: ec2c038bbe41965173b431de6640f48e66589650bd81b20a85290f99bc6fb07b
Instruction Fuzzy Hash: 8EE0C2B241810CBBEB04CBC88801FAE776CEB06320F20039AB92893180EA319A00C771

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7A185, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF7A185() {
				void* __ecx;
				void* _t5;

				if( *0x6e0367e4 >= 0xa) {
					if(_t5 < 0x6e036800 || _t5 >= 0x6e036900) {
						return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E6DF60010(0x6e0367e0, _t5);
				}
			}

0x6df7a190
0x6df7a1a6
0x6df7a1c2
0x00000000
0x00000000
0x00000000
0x6df7a192
0x6df7a192
0x6df7a19f
0x6df7a19f

APIs

RtlFreeHeap.9419(?,00000000,00000000,00000000,6DF7A12F,?,?,6E0385EC,6E0201E0,0000001C,6DF43075,?,00000000,00008000), ref: 6DF7A1BC

Part of subcall function 6DF60010: RtlAcquireSRWLockExclusive.9419(?,?,?,?,?,?,6E00CA01,000000FE,00000001,?,?,?,?,?,00000000), ref: 6DF6002E
Part of subcall function 6DF60010: RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,?,?,6E00CA01,000000FE,00000001,?,?,?,?,?,00000000), ref: 6DF60041

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease
String ID:
API String ID: 3645524765-0
Opcode ID: f76384adb0578e3454fe37cc1602b4714ee1a8c2947f88535e6c59c7923f308a
Instruction ID: 758ac3336d3bb30ab352312b1c6172cb5ad8b0ae33b25f2f330cc7dc559a8a67
Opcode Fuzzy Hash: f76384adb0578e3454fe37cc1602b4714ee1a8c2947f88535e6c59c7923f308a
Instruction Fuzzy Hash: CCD0C7311380803AE73C8398F810F2132AAA785704F3208AEE00B0EDA0EAE0CCE48523

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1D43, Relevance: 1.5, APIs: 1, Instructions: 19
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E6DFD1D43(void* __ecx) {
				intOrPtr _v20;
				char _v32;

				_push(0);
				_push(0x1c);
				_push( &_v32);
				_push(0);
				if(E6DF89750() >= 0) {
					return _v20;
				}
				return 0;
			}

0x6dfd1d4e
0x6dfd1d50
0x6dfd1d52
0x6dfd1d53
0x6dfd1d5d
0x00000000
0x6dfd1d63
0x00000000

APIs

ZwQueryInformationThread.9419(000000FE,00000000,?,0000001C,00000000), ref: 6DFD1D56

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQueryThread
String ID:
API String ID: 741662350-0
Opcode ID: 4afb5962e3676d4cd2517e403a911c3216247b2c9bd0e7047af5b31b3e06895a
Instruction ID: 763e129e2395fe1dc01f31678c0c656093faac975aacae7d4e3406a24e4c01cc
Opcode Fuzzy Hash: 4afb5962e3676d4cd2517e403a911c3216247b2c9bd0e7047af5b31b3e06895a
Instruction Fuzzy Hash: 97D0A971E8830DBBE270AAAC9D42F6B72ACD744B00F000550FE08E61C2FAA0E80041A1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD1CE4, Relevance: 1.5, APIs: 1, Instructions: 19
nativeCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E6DFD1CE4(void* __ecx) {
				intOrPtr _v12;
				char _v28;

				_push(0);
				_push(0x18);
				_push( &_v28);
				_push(0);
				if(E6DF89670() >= 0) {
					return _v12;
				}
				return 0;
			}

0x6dfd1cef
0x6dfd1cf1
0x6dfd1cf3
0x6dfd1cf4
0x6dfd1cfe
0x00000000
0x6dfd1d04
0x00000000

APIs

ZwQueryInformationProcess.9419(?,00000000,?,00000018,00000000), ref: 6DFD1CF7

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: a2b36486b2eb11ddcfccf5d77958ed22c2c48b45e89fa8e5e39250b72f4865dc
Instruction ID: 13e953cd96bf34b2d83aae107a5cb71c12590a6079f839f8d9ddd84ab605d2df
Opcode Fuzzy Hash: a2b36486b2eb11ddcfccf5d77958ed22c2c48b45e89fa8e5e39250b72f4865dc
Instruction Fuzzy Hash: 0ED0A731A8430C36D260956CCC02F96766C9744705F000550BF45D61C1FB50E80191E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF80413, Relevance: 1.5, APIs: 1, Instructions: 17
nativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6DF80413(void* __ecx) {
				intOrPtr _t8;
				void* _t9;
				void* _t11;
				void* _t14;

				_t14 = __ecx;
				_t8 =  *((intOrPtr*)(__ecx + 0x18));
				if(_t8 != 0) {
					if(( *(__ecx + 0x34) & 0x00000200) != 0) {
						E6DF80440(_t11);
						_t8 =  *((intOrPtr*)(__ecx + 0x18));
					}
					_push(_t8);
					_push(0xffffffff);
					_t9 = E6DF897A0();
					 *(_t14 + 0x18) =  *(_t14 + 0x18) & 0x00000000;
					return _t9;
				}
				return _t8;
			}

0x6df80416
0x6df80418
0x6df8041d
0x6df80426
0x6df8042a
0x6df8042f
0x6df8042f
0x6df80432
0x6df80433
0x6df80435
0x6df8043a
0x00000000
0x6df8043a
0x6df8043f

APIs

ZwUnmapViewOfSection.9419(000000FF,?,?,6DF5ECE6,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001,-00000F38), ref: 6DF80435

Part of subcall function 6DF80440: RtlAcquireSRWLockExclusive.9419(6E038654,?,?,?,6DF8042F,?,6DF5ECE6,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?), ref: 6DF8044D
Part of subcall function 6DF80440: RtlReleaseSRWLockExclusive.9419(6E038654,6E038654,?,?,?,6DF8042F,?,6DF5ECE6,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?), ref: 6DF8045A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSectionUnmapView
String ID:
API String ID: 2364903655-0
Opcode ID: 93ec140d18f4a27d83a2abcbf7b31987614bb7bc669511cc8b78ad8eff2236db
Instruction ID: cd25e170e194bdf395f6627b137abb30196f811771ad952b27a5dfeef6dd3353
Opcode Fuzzy Hash: 93ec140d18f4a27d83a2abcbf7b31987614bb7bc669511cc8b78ad8eff2236db
Instruction Fuzzy Hash: 33D017326467104BE7308E2EE584B6772F4AF51324F961A0C6462829D3CBA0ED85CA92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF716E0, Relevance: 1.5, APIs: 1, Instructions: 17
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF716E0(void* __eflags) {
				void* __ecx;
				void* _t3;
				intOrPtr _t6;

				_t3 = E6DF71710(0x6e0367e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *(_t6 + 0x18) == 0) {
						goto L1;
					} else {
						return RtlAllocateHeap( *(_t6 + 0x18), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x6df716e8
0x6df716ef
0x6df716f3
0x6df716fe
0x00000000
0x6df71700
0x6df7170d
0x6df7170d
0x6df716f2
0x6df716f2
0x6df716f2
0x6df716f2

APIs

Part of subcall function 6DF71710: RtlAcquireSRWLockExclusive.9419(00000001,?,?,00000001,6DF716ED,?,6DF71630,C0000001,?,?,6DF7161A,C0000001,?,?,6E036D80,00000000), ref: 6DF71727
Part of subcall function 6DF71710: RtlReleaseSRWLockExclusive.9419(00000001,00000001,?,?,00000001,6DF716ED,?,6DF71630,C0000001,?,?,6DF7161A,C0000001,?,?,6E036D80), ref: 6DF71740

RtlAllocateHeap.9419(?,00000000,00000020,?,6DF71630,C0000001,?,?,6DF7161A,C0000001,?,?,6E036D80,00000000,00000000), ref: 6DF71707

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAllocateHeapRelease
String ID:
API String ID: 614792542-0
Opcode ID: 56bd79d5fd674b86e894bab70ba55f99a72e8735e606a434fd759f4908117416
Instruction ID: c2acc3e952f8d8d91f4eaf8e78d36cafba753836b767c557977403f159ce6ad2
Opcode Fuzzy Hash: 56bd79d5fd674b86e894bab70ba55f99a72e8735e606a434fd759f4908117416
Instruction Fuzzy Hash: 64D0A77110414152EB2D4B18BC30B653255ABC0785F34106DF217498C0CFA1CC96E058

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4B8F0, Relevance: 1.5, APIs: 1, Instructions: 17
nativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E6DF4B8F0(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t5;

				_t5 = _a4;
				if(_t5 == 0 || _a8 == 0) {
					return 0xc000000d;
				} else {
					_push(8);
					_push(_a8);
					_push(0xa);
					_push( *((intOrPtr*)(_t5 + 0x24)));
					return E6DF8AE70();
				}
			}

0x6df4b8f5
0x6df4b8fa
0x00000000
0x6df4b902
0x6df4b902
0x6df4b904
0x6df4b907
0x6df4b909
0x00000000
0x6df4b90c

APIs

ZwSetInformationWorkerFactory.9419(?,0000000A,00000000,00000008,?,6DFB47B6,00000000,?,00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000), ref: 6DF4B90C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FactoryInformationWorker
String ID:
API String ID: 270927234-0
Opcode ID: 23ffd7cbe8094487b1e50ea1dee595ab4db89c42b865c242366300342b643a79
Instruction ID: 117ec9b64257da25679c49161f6bec2b4a00e57cc5906f885ef159e9aab6cab8
Opcode Fuzzy Hash: 23ffd7cbe8094487b1e50ea1dee595ab4db89c42b865c242366300342b643a79
Instruction Fuzzy Hash: 87D0A732244308BBFB514E4DCC01F5D3FA5BB56718F02C411B5285E0E3C675DA90EB11

Uniqueness

Uniqueness Score: -1.00%

Function 6DF75306, Relevance: 1.5, APIs: 1, Instructions: 16
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DF75306(signed int* __ecx) {
				signed int _t2;
				signed int _t6;

				_t2 =  *__ecx & 0xfffffffc;
				if(_t2 != 0) {
					do {
						_t6 =  *_t2;
						_push(0);
						_push(0);
						_push(_t2);
						_push(0);
						E6DF8AB60();
						_t2 = _t6;
					} while (_t6 != 0);
					return _t2;
				} else {
					return _t2;
				}
			}

0x6df75308
0x6df7530b
0x6df7530f
0x6df7530f
0x6df75311
0x6df75313
0x6df75315
0x6df75316
0x6df75318
0x6df7531d
0x6df7531f
0x6df75324
0x6df7530d
0x6df7530d
0x6df7530d

APIs

ZwReleaseKeyedEvent.9419(00000000,00000000,00000000,00000000,6DF74F18,6DF752D3,?,C0000001,?,?,6DF74F18,?,00000004,00000000), ref: 6DF75318

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: EventKeyedRelease
String ID:
API String ID: 1152359784-0
Opcode ID: ffad6aa2b3d69ee8eeea2960fb4a1c316e0e057f5e60983c4c1a37d074f3744d
Instruction ID: df6f9d834f76d4a43447080811514d554f7943b3163ac6c02e0a306dd0957754
Opcode Fuzzy Hash: ffad6aa2b3d69ee8eeea2960fb4a1c316e0e057f5e60983c4c1a37d074f3744d
Instruction Fuzzy Hash: 6CD0223274863027D160025CBC01FA132269B45F30F110281BA14EF2E0C380AC4001D0

Uniqueness

Uniqueness Score: -1.00%

Function 6E018858, Relevance: 1.5, APIs: 1, Instructions: 11
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6E018858(intOrPtr* __ecx) {
				void* _t2;
				void* _t3;
				intOrPtr* _t4;
				intOrPtr* _t6;

				_t4 = __ecx;
				if(__ecx != 0) {
					do {
						_push( *((intOrPtr*)(_t4 + 4)));
						_t6 =  *_t4;
						_t3 = E6DF89BF0();
						_t4 = _t6;
					} while (_t6 != 0);
					return _t3;
				}
				return _t2;
			}

0x6e018858
0x6e01885a
0x6e01885d
0x6e01885d
0x6e018860
0x6e018862
0x6e018867
0x6e018869
0x00000000
0x6e01886d
0x6e01886e

APIs

ZwAlertThreadByThreadId.9419(?,00000000,6DFB98BF,?), ref: 6E018862

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Alert
String ID:
API String ID: 2775339012-0
Opcode ID: 5bb679f0607ddf91bc8b87ec5b236cb27673eae203ae6f5f73c65eedba30a577
Instruction ID: c677e0d1ce811b0b23a6f59f648907405bd0388d47693b47325b89f4f5b7e1dd
Opcode Fuzzy Hash: 5bb679f0607ddf91bc8b87ec5b236cb27673eae203ae6f5f73c65eedba30a577
Instruction Fuzzy Hash: A9C02B3150F031578E5505856120FDF3EA15F036E432240BCDC092F625C7028D0385E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4F340, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF4F340() {

				if(E6DF67D50() != 0) {
					return  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1c));
				} else {
					return  *0x7ffe02f0 >> 0x00000008 & 0x00000001;
				}
			}

0x6df4f347
0x6dfa5cb0
0x6df4f34d
0x6df4f357
0x6df4f357

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d652b91d5ef0918acbf59d3e8cd6e25e6976192bdb4fae21a80d1111f08600d0
Instruction ID: 27c5002a2992f8607b5b6348badff18bba6095c8e435a976931200adbde27615
Opcode Fuzzy Hash: d652b91d5ef0918acbf59d3e8cd6e25e6976192bdb4fae21a80d1111f08600d0
Instruction Fuzzy Hash: E6C08C396345C18FCF01CB3CC290AA43BF0FB80784F8A08D0D900CBF21D218D806CA10

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4AD30, Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF4AD30(void* _a4) {

				return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _a4);
			}

0x6df4ad49

APIs

RtlFreeHeap.9419(?,00000000,00000001,?,6DF702E9,00000000,?,6DF5ECFB,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?), ref: 6DF4AD43

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: b6c7cda222f1716a151bd460d174b24db6137a7cb96af402b97f5d0c4ded6888
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: EEC08C32080288BBC7125A49DD00F017B29E790B60F010020B6040BA618A76EC60D598

Uniqueness

Uniqueness Score: -1.00%

Function 6DF63A1C, Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF63A1C(long _a4) {

				return RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _a4);
			}

0x6df63a35

APIs

RtlAllocateHeap.9419(?,00000000,00000000,?,6DF867C0,0000004E,00000000,?,6DFD83BE,?,?), ref: 6DF63A2F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: ccd134fb5ecd98c1fac68017dfe0bd9b48bca1377112a0488a72caa131301998
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 45C08C32084288BBC7126E45DD10F02BB29E794B60F010020B7040A9608632EC60D598

Uniqueness

Uniqueness Score: -1.00%

Function 6DF74190, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF74190() {

				if(E6DF67D50() != 0) {
					return  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x14));
				} else {
					return  *0x7ffe02d0;
				}
			}

0x6df74197
0x6dfb641c
0x6df7419d
0x6df741a2
0x6df741a2

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175590c6a7dfeeadbeeb5abb91333881fb225fd9a6b890b8f217439b73e8cc0c
Instruction ID: 75c6eb96e7e403635bc12d767e34b9eba31ed70676f391ce2b021e591a1735cc
Opcode Fuzzy Hash: 175590c6a7dfeeadbeeb5abb91333881fb225fd9a6b890b8f217439b73e8cc0c
Instruction Fuzzy Hash: A5C04C35715941CFDF05CB2EC284F1537F4B744748F150890E905CBB21D724ED04CA50

Uniqueness

Uniqueness Score: -1.00%

Function 6DF72ACB, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF72ACB() {
				void* _t5;

				return E6DF5EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x6df72adc

APIs

RtlLeaveCriticalSection.9419(?,6DF72A64,00000001,?,?,?,?,?,?,?,00000000,0000000E,00000000), ref: 6DF72AD4

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: c9d563982e39afb072f032817bed47142bc00bafb50cbb0533e5a32ff18e91e9
Instruction ID: 15192751a07348e3c91fe9d61c8a3408de5d702f7dc8a68b05986aeaaf1aef67
Opcode Fuzzy Hash: c9d563982e39afb072f032817bed47142bc00bafb50cbb0533e5a32ff18e91e9
Instruction Fuzzy Hash: 1AB01232C10440DFCF02DF44C610B1D7331FB00750F064490910167D30C328AC21CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD4320, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DFD4320() {
				void* _t4;

				return E6DF5EB70(_t4,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x6dfd432e

APIs

RtlLeaveCriticalSection.9419(?,6DFD431A,?,6E0208D0,00000008,6DF79B80,?,?,?,?,6DF5ED2D,-00000F38,6E0384D8,6E0384D8,6DF917F0,00000000), ref: 6DFD4329

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: f70edb36b298999dcef8c5e05368ba9f0d7253c31339d10b6596c82cb1753443
Instruction ID: b2e6045633acbc0da84b07cc56c89e7b5ff0425617131215487cb57ab98a6a20
Opcode Fuzzy Hash: f70edb36b298999dcef8c5e05368ba9f0d7253c31339d10b6596c82cb1753443
Instruction Fuzzy Hash: 48A02232020880EFCF03AF08CA20F083330FB00A00FC208A0A20283C30832CCC30CB00

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD4248, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DFD4248() {
				void* _t4;

				return E6DF5EB70(_t4,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x6dfd4256

APIs

RtlLeaveCriticalSection.9419(?,6DFD4242,?,6E0208F0,00000008,6DFD426A,6E0208D0,00000008,6DF79B80,?,?,?,?,6DF5ED2D,-00000F38,6E0384D8), ref: 6DFD4251

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: f70edb36b298999dcef8c5e05368ba9f0d7253c31339d10b6596c82cb1753443
Instruction ID: b2e6045633acbc0da84b07cc56c89e7b5ff0425617131215487cb57ab98a6a20
Opcode Fuzzy Hash: f70edb36b298999dcef8c5e05368ba9f0d7253c31339d10b6596c82cb1753443
Instruction Fuzzy Hash: 48A02232020880EFCF03AF08CA20F083330FB00A00FC208A0A20283C30832CCC30CB00

Uniqueness

Uniqueness Score: -1.00%

Function 6DF72AE4, Relevance: 1.4, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF72AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, void* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				void* _t115;
				signed int _t116;
				signed short** _t119;
				void* _t120;
				signed int _t123;
				signed int _t124;
				int _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // 0xd
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t123 =  *(_t57 + 0x6e038204);
				_t7 = _t57 + 0x6e038208; // 0x6e038215
				_t8 = _t57 + 0x6e038208; // 0x6e038215
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x6e038450;
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t58 =  *((intOrPtr*)(_t57 + 0x6e03821c));
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t116 =  *((intOrPtr*)( *0x6e036d5c + (( *( *0x6e036d5c + (( *( *0x6e036d5c + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t128 =  *((intOrPtr*)( *0x6e036d5c + (( *( *0x6e036d5c + (( *( *0x6e036d5c + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t120 = _a8;
							_t95 = _t119[1] - _t115 >> 1;
							_t124 = _t95 - 1;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							memcpy(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t120 + _t125)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x6df72ae4
0x6df72aec
0x6df72aef
0x6df72af4
0x6df72af7
0x6df72afd
0x6df72b92
0x6df72b92
0x6df72b97
0x6df72b9c
0x6df72b9c
0x6df72b03
0x6df72b06
0x6df72b09
0x6df72b0f
0x6df72b15
0x6df72b15
0x6df72b1b
0x6df72b1e
0x6df72b21
0x6df72b26
0x6df72b29
0x6df72b81
0x6df72b84
0x6df72c0e
0x6df72c15
0x6df72c24
0x6df72c24
0x6df72b8a
0x6df72b8a
0x6df72b8a
0x6df72b90
0x00000000
0x00000000
0x00000000
0x00000000
0x6df72b4a
0x6df72b4a
0x6df72b4d
0x6df72b53
0x00000000
0x00000000
0x6df72b55
0x6df72b58
0x6df72bb7
0x6dfb5d53
0x6df72bbd
0x6df72bbd
0x6df72bbd
0x6df72bb7
0x6df72b5d
0x6df72c2f
0x6dfb5d93
0x6df72c35
0x6df72c35
0x6df72c35
0x6df72c2f
0x6df72b65
0x6df72b9f
0x6df72ba2
0x6df72b67
0x6df72b67
0x6df72b69
0x6df72b6b
0x6df72b6e
0x6df72bc9
0x6df72bcf
0x6df72bd4
0x6df72bd6
0x6df72bdb
0x6df72c02
0x6df72c05
0x6df72c07
0x00000000
0x6df72c07
0x6df72be0
0x6df72c00
0x6df72c3f
0x6df72c3f
0x00000000
0x6df72c00
0x6df72be5
0x6df72be7
0x6df72bec
0x6df72bf4
0x6df72bf6
0x00000000
0x6df72bf6
0x6df72b70
0x6df72b76
0x6df72b2b
0x6df72b2b
0x6df72b2d
0x6df72b2f
0x6df72b32
0x6df72b35
0x6df72b3a
0x00000000
0x6df72b40
0x6df72b43
0x6df72b45
0x6df72b47
0x6df72b4a
0x6df72b4d
0x6df72b53
0x00000000
0x00000000
0x00000000
0x6df72b53
0x6df72b78
0x6df72b78
0x6df72b7b
0x6df72b7e
0x00000000
0x6df72b7e
0x6df72b76
0x6df72ba5
0x6df72ba5
0x6df72ba8
0x6df72bad
0x00000000
0x00000000
0x6df72baf
0x6df72baf
0x6df72bc2
0x00000000

APIs

memcpy.9419(00000000,0000000F,?,00000000,C0000100,?,?,?,?,?,00000000,0000000E,00000000), ref: 6DF72BEC

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 415a8da720ee3d5b76615a2392c6654c91ccc3e728a0ec941c758ed637d0cedd
Instruction ID: 19f67c05bf5040182ad021b4b2de146bcaee24667830939da945194d722ef0f8
Opcode Fuzzy Hash: 415a8da720ee3d5b76615a2392c6654c91ccc3e728a0ec941c758ed637d0cedd
Instruction Fuzzy Hash: BB51D176A10126CFCB34CF1CD8809EDB7B1FB8A700715855BE89AEB350D731AA51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF6F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x6df6f71d
0x6df6f722
0x6df6f726
0x6dfb4770
0x6df6f765
0x6df6f769
0x6df6f769
0x6df6f732
0x6dfb477a
0x00000000
0x6dfb477a
0x6df6f738
0x6df6f73a
0x6df6f73c
0x6df6f73f
0x6df6f746
0x6df6f778
0x6df6f7a9
0x6df6f7a9
0x6df6f754
0x6df6f75a
0x6df6f75d
0x6df6f75f
0x6df6f761
0x6df6f76f
0x6df6f771
0x6df6f771
0x6df6f76f
0x6df6f763
0x00000000
0x6df6f763
0x6df6f77d
0x6df6f7a3
0x6df6f7a5
0x00000000
0x6df6f7a5
0x6df6f77f
0x6df6f782
0x6df6f784
0x6df6f786
0x00000000
0x00000000
0x00000000
0x6df6f788
0x6df6f748
0x6df6f74d
0x6df6f78d
0x6df6f793
0x6df6f7b7
0x6df6f7bc
0x00000000
0x6df6f7bc
0x6df6f798
0x00000000
0x00000000
0x6df6f79d
0x6df6f7b0
0x00000000
0x6df6f7b0
0x6df6f79f
0x00000000
0x6df6f74f
0x6df6f74f
0x00000000
0x6df6f74f

Strings

Actx , xrefs: 6DF6F73F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 5c8bebbf4d04a2ab71e0c204d719dd1579ec8eec44c190d46acb07cdc2e340c6
Instruction ID: b4b2199398d52694ebba641fe6b1f0021eed3fbb3daaa8759a7fc82a1773df97
Opcode Fuzzy Hash: 5c8bebbf4d04a2ab71e0c204d719dd1579ec8eec44c190d46acb07cdc2e340c6
Instruction Fuzzy Hash: B211B2363586838BEB958E1DB9917367295FF97724F20853AE870CBB91DB70C8409360

Uniqueness

Uniqueness Score: -1.00%

Function 6E0067E2, Relevance: .5, Instructions: 473
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E6E0067E2(signed int __ecx, unsigned int* __edx) {
				signed int _v8;
				signed int _v12;
				signed int _t203;
				signed short _t210;
				void* _t214;
				signed short _t215;
				intOrPtr _t216;
				signed int _t222;
				unsigned int _t223;
				signed char _t226;
				unsigned int _t227;
				signed char _t230;
				unsigned int _t231;
				unsigned int _t237;
				signed char _t241;
				signed char _t243;
				signed short _t244;
				signed int _t247;
				signed char _t251;
				signed char _t253;
				signed short _t254;
				signed short _t260;
				signed short _t266;
				intOrPtr _t269;
				signed int _t275;
				signed short _t277;
				void* _t283;
				signed short _t284;
				signed int _t287;
				unsigned int _t292;
				void* _t296;
				signed short _t299;
				void* _t305;
				signed short _t308;
				signed short _t312;
				intOrPtr _t315;
				signed short _t319;
				intOrPtr _t322;
				signed int _t326;
				signed int _t330;
				signed int _t332;
				unsigned int* _t333;
				intOrPtr _t337;
				intOrPtr _t339;
				unsigned int _t340;
				signed int _t345;
				signed int _t346;
				unsigned int _t351;
				unsigned int _t359;
				signed int _t361;
				unsigned int _t366;
				signed int _t368;
				unsigned int _t375;
				void* _t378;
				signed int _t380;
				unsigned int _t383;
				signed int _t390;
				signed char _t391;
				signed char _t392;
				signed int _t393;
				signed char _t394;
				signed int _t395;
				unsigned int _t402;
				unsigned int _t407;
				intOrPtr _t409;
				signed int _t410;
				unsigned int _t417;
				signed int _t420;
				unsigned int _t421;
				unsigned int* _t423;

				_push(__ecx);
				_push(__ecx);
				_t332 = __ecx;
				_t423 = __edx;
				if( *((char*)(__ecx + 0xda)) != 2) {
					_t203 = 0;
					_v8 = 0;
				} else {
					_t203 =  *((intOrPtr*)(__ecx + 0xd4));
					_v8 = _t203;
				}
				if(_t203 != 0) {
					_t407 =  *_t423;
					_t378 = 5;
					if(_t423[2] != 0) {
						_t407 = _t407 + 0xfffffff8;
						if( *((intOrPtr*)(_t407 + 7)) != _t378) {
							goto L10;
						} else {
							_t330 = ( *(_t407 + 6) & 0x000000ff) << 3;
							goto L9;
						}
					} else {
						_t330 = _t423[2] & 0x000000ff;
						L9:
						_t407 = _t407 - _t330;
						_t203 = _v8;
						L10:
						if( *((intOrPtr*)(_t407 + 7)) >= 0) {
							_t337 =  *((intOrPtr*)(_t203 + 0xc));
							if((( *(_t337 + 0x4c) >> 0x00000014 &  *(_t337 + 0x52) ^  *(_t407 + 2)) & 0x00000001) == 0) {
								L123:
								_t333 = _v8;
								if(E6E005A13(_t333, _t407) != 0 || _t333 ==  *_t423) {
									L127:
									_t423[2] = 8;
									_t423[2] = 0x2001;
									_t423[5] = 8;
									_t339 =  *((intOrPtr*)(_t333 + 0xc));
									if( *(_t339 + 0x4c) == 0) {
										_t210 =  *_t407 & 0x0000ffff;
									} else {
										_t215 =  *_t407;
										if(( *(_t339 + 0x4c) & _t215) != 0) {
											_t215 = _t215 ^  *(_t339 + 0x50);
										}
										_t210 = _t215 & 0x0000ffff;
									}
									_t423[1] = (_t210 & 0x0000ffff) * 8 - 8;
									_t423[2] =  *(_t407 + 6);
									L133:
									_t214 = 1;
									L134:
									return _t214;
								} else {
									_t216 =  *((intOrPtr*)(_t333 + 0xc));
									_t340 =  *(_t216 + 0x4c);
									_t380 =  *(_t216 + 0x52) & 0x000000ff;
									_v12 =  *(_t407 + 2) & 0x000000ff;
									if(((_t340 >> 0x00000014 & _t380 ^ _v12) & 0x00000001) == 0 || ((_t340 >> 0x00000011 & _t380 ^ _v12) & 0x00000008) == 0) {
										goto L4;
									} else {
										goto L127;
									}
								}
							}
							if( *(_t337 + 0x4c) == 0) {
								_t222 =  *_t407 & 0x0000ffff;
							} else {
								_t277 =  *_t407;
								if(( *(_t337 + 0x4c) & _t277) != 0) {
									_t277 = _t277 ^  *(_t337 + 0x50);
								}
								_t222 = _t277 & 0x0000ffff;
							}
							if(_t222 <= _t378) {
								goto L123;
							} else {
								_t223 =  *_t423;
								if( *((intOrPtr*)(_t223 + 0xc)) != 0xf0e0d0c0) {
									goto L123;
								}
								_v12 =  *_t223;
								if(E6E005A13(_v8,  *_t223) == 0) {
									goto L123;
								}
								_t226 =  *((intOrPtr*)(_t407 + 7));
								if((_t226 & 0x00000040) == 0) {
									if(_t226 != 4) {
										_t227 = _t407;
										L77:
										_t345 = _v12;
										_t382 =  *((intOrPtr*)(_t345 + 4));
										if( *((intOrPtr*)(_t345 + 4)) != _t227 + 8) {
											goto L123;
										}
										_t383 = E6E0055C6(_t345, _t382);
										_t230 =  *(_t383 + 7);
										if((_t230 & 0x00000040) == 0) {
											if(_t230 != 4) {
												_t231 = _t383;
											} else {
												_t231 = _t383 + ( *(_t383 + 6) & 0x000000ff) * 8;
											}
										} else {
											_t231 = _t383 + (_t230 & 0x3f) * 8;
										}
										 *_t423 = _t231 + 8;
										_t346 = 0x3f;
										if(( *(_t383 + 7) & _t346) == 0) {
											_t423[2] = 0;
											_t423[2] = 8;
											_t423[5] = 8;
											_t237 = ( *(_v12 + 0x14) & 0x0000ffff) * 8 - 8;
											goto L122;
										} else {
											_t423[2] = 1;
											_t241 =  *(_t383 + 7);
											if(_t241 != 5) {
												if((_t241 & 0x00000040) == 0) {
													_t243 = _t241 & _t346;
													if(_t243 == _t346) {
														if(_t243 >= 0) {
															_t409 = 0;
															if( *(_t332 + 0x4c) == 0) {
																_t244 =  *_t383 & 0x0000ffff;
															} else {
																_t266 =  *_t383;
																if(( *(_t332 + 0x4c) & _t266) != 0) {
																	_t266 = _t266 ^  *(_t332 + 0x50);
																}
																_t244 = _t266 & 0x0000ffff;
															}
														} else {
															_t417 = _t383 >> 0x00000003 ^  *_t383 ^  *0x6e03874c ^ _t332;
															if(_t417 == 0) {
																_t409 = 0;
																_t269 =  *((intOrPtr*)(_t383 - (_t417 >> 0xd)));
															} else {
																_t409 = 0;
																_t269 = 0;
															}
															_t244 =  *((intOrPtr*)(_t269 + 0x14));
														}
														_t247 =  *(_t383 + (_t244 & 0xffff) * 8 - 4);
														L102:
														_t423[2] = _t247;
														if((_t423[2] & 0x00000002) == 0) {
															_t423[5] = _t247;
														}
														_v12 =  *(_v12 + 0x14) & 0x0000ffff;
														_t251 =  *(_t383 + 7);
														if(_t251 != 5) {
															if((_t251 & 0x00000040) == 0) {
																_t253 = _t251 & _t346;
																if(_t253 == _t346) {
																	if(_t253 >= 0) {
																		if( *(_t332 + 0x4c) == _t409) {
																			_t254 =  *_t383 & 0x0000ffff;
																		} else {
																			_t260 =  *_t383;
																			if(( *(_t332 + 0x4c) & _t260) != 0) {
																				_t260 = _t260 ^  *(_t332 + 0x50);
																			}
																			_t254 = _t260 & 0x0000ffff;
																		}
																	} else {
																		_t351 = _t383 >> 0x00000003 ^  *_t383 ^  *0x6e03874c ^ _t332;
																		if(_t351 == 0) {
																			_t409 =  *((intOrPtr*)(_t383 - (_t351 >> 0xd)));
																		}
																		_t254 =  *((intOrPtr*)(_t409 + 0x14));
																	}
																	_t410 =  *(_t383 + (_t254 & 0xffff) * 8 - 4);
																} else {
																	_t410 = _t253 & 0x000000ff & _t346;
																}
															} else {
																_t410 =  *(_t383 + 4 + (_t251 & 0x000000ff & _t346) * 8) & 0x0000ffff;
															}
														} else {
															_t410 =  *(_t332 + 0x54) & 0x0000ffff ^  *(_t383 + 4) & 0x0000ffff;
														}
														_t237 = ((_v12 & 0x0000ffff) << 3) - _t410;
														L122:
														_t423[1] = _t237;
														_t423[2] =  *(_t383 + 6);
														L61:
														_t423[2] = _t423[2] | 0x00008000;
														goto L133;
													}
													_t247 = _t243 & 0x000000ff & _t346;
													L86:
													_t409 = 0;
													goto L102;
												}
												_t247 =  *(_t383 + 4 + (_t241 & 0x000000ff & _t346) * 8) & 0x0000ffff;
												goto L86;
											}
											_t420 =  *(_t332 + 0x54) & 0x0000ffff ^  *(_t383 + 4) & 0x0000ffff;
											_v8 = _t420;
											_t247 = _t420;
											goto L86;
										}
									}
									_t275 =  *(_t407 + 6) & 0x000000ff;
									L73:
									_t227 = _t407 + _t275 * 8;
									goto L77;
								}
								_t275 = _t226 & 0x3f;
								goto L73;
							}
						}
						_t359 = _t407 >> 0x00000003 ^  *_t407 ^  *0x6e03874c ^ _t332;
						if((_t359 & 0x0000ffff) != 0) {
							goto L4;
						}
						_t361 =  *((intOrPtr*)(_t407 - (_t359 >> 0xd)));
						_v8 = _t361;
						if(_t361 == 0) {
							goto L4;
						}
						_t421 = _t407 + (E6E005634(_t361) & 0x0000ffff) * 8;
						_t283 = E6E0055C6(_t361,  *((intOrPtr*)(_t361 + 4)));
						_t284 = E6E005634(_v8);
						_t390 = _v8;
						if((_t421 - _t283 >> 3) / (_t284 & 0x0000ffff) < ( *(_t390 + 0x18) & 0x0000ffff)) {
							_t391 =  *((intOrPtr*)(_t421 + 7));
							_t287 = _t391 & 0x000000ff;
							if((_t287 & 0xffffff3f) == 0) {
								_t423[2] = 8;
								 *_t423 = _t421 + 8;
								_t423[2] = 0;
								_t423[5] = 8;
								_t366 = ( *(_v8 + 0x14) & 0x0000ffff) * 8 - 8;
								L60:
								_t423[1] = _t366;
								_t423[2] =  *(_t421 + 6);
								goto L61;
							}
							_t368 = 0x3f;
							if((_t391 & 0x00000040) == 0) {
								if(_t391 != 4) {
									_t292 = _t421;
									goto L22;
								} else {
									_t326 =  *(_t421 + 6) & 0x000000ff;
									goto L18;
								}
							} else {
								_t326 = _t287 & _t368;
								L18:
								_t292 = _t421 + _t326 * 8;
								L22:
								 *_t423 = _t292 + 8;
								_t423[2] = 1;
								_t392 =  *((intOrPtr*)(_t421 + 7));
								_t296 = 5;
								if(_t392 != _t296) {
									if((_t392 & 0x00000040) == 0) {
										if((_t392 & _t368) == _t368) {
											if(_t392 >= 0) {
												if( *(_t332 + 0x4c) == 0) {
													_t299 =  *_t421 & 0x0000ffff;
												} else {
													_t319 =  *_t421;
													if(( *(_t332 + 0x4c) & _t319) != 0) {
														_t319 = _t319 ^  *(_t332 + 0x50);
													}
													_t299 = _t319 & 0x0000ffff;
												}
											} else {
												_t402 = _t421 >> 0x00000003 ^  *_t421 ^  *0x6e03874c ^ _t332;
												if(_t402 == 0) {
													_t322 =  *((intOrPtr*)(_t421 - (_t402 >> 0xd)));
												} else {
													_t322 = 0;
												}
												_t299 =  *((intOrPtr*)(_t322 + 0x14));
											}
											_t393 =  *(_t421 + (_t299 & 0xffff) * 8 - 4);
										} else {
											_t393 = _t392 & 0x000000ff & _t368;
										}
									} else {
										_t393 =  *(_t421 + 4 + (_t392 & 0x000000ff & _t368) * 8) & 0x0000ffff;
									}
								} else {
									_t393 =  *(_t332 + 0x54) & 0x0000ffff ^  *(_t421 + 4) & 0x0000ffff;
								}
								_t423[2] = _t393;
								if((_t423[2] & 0x00000002) == 0) {
									_t423[5] = _t393;
								}
								_t394 =  *((intOrPtr*)(_t421 + 7));
								_v12 =  *(_v8 + 0x14) & 0x0000ffff;
								_t305 = 5;
								if(_t394 != _t305) {
									if((_t394 & 0x00000040) == 0) {
										if((_t394 & _t368) == _t368) {
											if(_t394 >= 0) {
												if( *(_t332 + 0x4c) == 0) {
													_t308 =  *_t421 & 0x0000ffff;
												} else {
													_t312 =  *_t421;
													if(( *(_t332 + 0x4c) & _t312) != 0) {
														_t312 = _t312 ^  *(_t332 + 0x50);
													}
													_t308 = _t312 & 0x0000ffff;
												}
											} else {
												_t375 = _t421 >> 0x00000003 ^  *_t421 ^  *0x6e03874c ^ _t332;
												if(_t375 == 0) {
													_t315 =  *((intOrPtr*)(_t421 - (_t375 >> 0xd)));
												} else {
													_t315 = 0;
												}
												_t308 =  *((intOrPtr*)(_t315 + 0x14));
											}
											_t395 =  *(_t421 + (_t308 & 0xffff) * 8 - 4);
										} else {
											_t395 = _t394 & 0x000000ff & _t368;
										}
									} else {
										_t395 =  *(_t421 + 4 + (_t394 & 0x000000ff & _t368) * 8) & 0x0000ffff;
									}
								} else {
									_t395 =  *(_t332 + 0x54) & 0x0000ffff ^  *(_t421 + 4) & 0x0000ffff;
								}
								_t366 = ((_v12 & 0x0000ffff) << 3) - _t395;
								goto L60;
							}
						} else {
							 *_t423 =  *(_t390 + 4);
							_t423[2] = 0x2001;
							goto L4;
						}
					}
				}
				L4:
				_t214 = 0;
				goto L134;
			}

0x6e0067e7
0x6e0067e8
0x6e0067ea
0x6e0067f0
0x6e0067f9
0x6e006806
0x6e006808
0x6e0067fb
0x6e0067fb
0x6e006801
0x6e006801
0x6e00680d
0x6e006816
0x6e00681a
0x6e00681f
0x6e006827
0x6e00682d
0x00000000
0x6e00682f
0x6e006833
0x00000000
0x6e006833
0x6e006821
0x6e006821
0x6e006836
0x6e006836
0x6e006838
0x6e00683b
0x6e00683e
0x6e006a56
0x6e006a67
0x6e006c80
0x6e006c80
0x6e006c8e
0x6e006cc8
0x6e006ccd
0x6e006cd1
0x6e006cd5
0x6e006cdc
0x6e006ce3
0x6e006cf4
0x6e006ce5
0x6e006ce5
0x6e006cea
0x6e006cec
0x6e006cec
0x6e006cef
0x6e006cef
0x6e006d01
0x6e006d07
0x6e006d0a
0x6e006d0a
0x6e006d0c
0x6e006d12
0x6e006c94
0x6e006c94
0x6e006c97
0x6e006c9a
0x6e006ca2
0x6e006cb1
0x00000000
0x00000000
0x00000000
0x00000000
0x6e006cb1
0x6e006c8e
0x6e006a71
0x6e006a82
0x6e006a73
0x6e006a73
0x6e006a78
0x6e006a7a
0x6e006a7a
0x6e006a7d
0x6e006a7d
0x6e006a88
0x00000000
0x6e006a8e
0x6e006a8e
0x6e006a97
0x00000000
0x00000000
0x6e006aa4
0x6e006aae
0x00000000
0x00000000
0x6e006ab4
0x6e006ab9
0x6e006ac8
0x6e006ad0
0x6e006ad2
0x6e006ad2
0x6e006ad8
0x6e006add
0x00000000
0x00000000
0x6e006ae8
0x6e006aea
0x6e006aef
0x6e006afe
0x6e006b09
0x6e006b00
0x6e006b04
0x6e006b04
0x6e006af1
0x6e006af7
0x6e006af7
0x6e006b10
0x6e006b14
0x6e006b18
0x6e006c52
0x6e006c59
0x6e006c5d
0x6e006c6b
0x00000000
0x6e006b1e
0x6e006b1f
0x6e006b23
0x6e006b29
0x6e006b41
0x6e006b51
0x6e006b55
0x6e006b60
0x6e006b8d
0x6e006b92
0x6e006ba3
0x6e006b94
0x6e006b94
0x6e006b99
0x6e006b9b
0x6e006b9b
0x6e006b9e
0x6e006b9e
0x6e006b62
0x6e006b6f
0x6e006b74
0x6e006b83
0x6e006b85
0x6e006b76
0x6e006b76
0x6e006b78
0x6e006b78
0x6e006b87
0x6e006b87
0x6e006bac
0x6e006bb0
0x6e006bb4
0x6e006bb7
0x6e006bb9
0x6e006bb9
0x6e006bc6
0x6e006bc9
0x6e006bcf
0x6e006be0
0x6e006bf0
0x6e006bf4
0x6e006bff
0x6e006c27
0x6e006c38
0x6e006c29
0x6e006c29
0x6e006c2e
0x6e006c30
0x6e006c30
0x6e006c33
0x6e006c33
0x6e006c01
0x6e006c0e
0x6e006c13
0x6e006c1c
0x6e006c1c
0x6e006c1e
0x6e006c1e
0x6e006c41
0x6e006bf6
0x6e006bf9
0x6e006bf9
0x6e006be2
0x6e006be7
0x6e006be7
0x6e006bd1
0x6e006bd9
0x6e006bd9
0x6e006c4e
0x6e006c72
0x6e006c72
0x6e006c78
0x6e006a48
0x6e006a4d
0x00000000
0x6e006a4d
0x6e006b5a
0x6e006b3a
0x6e006b3a
0x00000000
0x6e006b3a
0x6e006b48
0x00000000
0x6e006b48
0x6e006b33
0x6e006b35
0x6e006b38
0x00000000
0x6e006b38
0x6e006b18
0x6e006aca
0x6e006ac1
0x6e006ac1
0x00000000
0x6e006ac1
0x6e006abe
0x00000000
0x6e006abe
0x6e006a88
0x6e006851
0x6e006858
0x00000000
0x00000000
0x6e006861
0x6e006863
0x6e006868
0x00000000
0x00000000
0x6e006875
0x6e006878
0x6e006884
0x6e006895
0x6e00689e
0x6e0068b3
0x6e0068b6
0x6e0068be
0x6e006a1b
0x6e006a1f
0x6e006a23
0x6e006a2a
0x6e006a38
0x6e006a3f
0x6e006a3f
0x6e006a45
0x00000000
0x6e006a45
0x6e0068c6
0x6e0068ca
0x6e0068d6
0x6e0068de
0x00000000
0x6e0068d8
0x6e0068d8
0x00000000
0x6e0068d8
0x6e0068cc
0x6e0068cc
0x6e0068ce
0x6e0068ce
0x6e0068e0
0x6e0068e3
0x6e0068e8
0x6e0068ec
0x6e0068f1
0x6e0068f4
0x6e006905
0x6e006919
0x6e006924
0x6e006951
0x6e006962
0x6e006953
0x6e006953
0x6e006958
0x6e00695a
0x6e00695a
0x6e00695d
0x6e00695d
0x6e006926
0x6e006933
0x6e006938
0x6e006945
0x6e00693a
0x6e00693a
0x6e00693a
0x6e006947
0x6e006947
0x6e00696b
0x6e00691b
0x6e00691e
0x6e00691e
0x6e006907
0x6e00690c
0x6e00690c
0x6e0068f6
0x6e0068fe
0x6e0068fe
0x6e006973
0x6e006976
0x6e006978
0x6e006978
0x6e006984
0x6e00698a
0x6e00698d
0x6e006990
0x6e0069a1
0x6e0069b5
0x6e0069c0
0x6e0069ed
0x6e0069fe
0x6e0069ef
0x6e0069ef
0x6e0069f4
0x6e0069f6
0x6e0069f6
0x6e0069f9
0x6e0069f9
0x6e0069c2
0x6e0069cf
0x6e0069d4
0x6e0069e1
0x6e0069d6
0x6e0069d6
0x6e0069d6
0x6e0069e3
0x6e0069e3
0x6e006a07
0x6e0069b7
0x6e0069ba
0x6e0069ba
0x6e0069a3
0x6e0069a8
0x6e0069a8
0x6e006992
0x6e00699a
0x6e00699a
0x6e006a14
0x00000000
0x6e006a14
0x6e0068a0
0x6e0068a3
0x6e0068aa
0x00000000
0x6e0068aa
0x6e00689e
0x6e00681f
0x6e00680f
0x6e00680f
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c7aa55e7a525d8e54bd91f892b11b046a3e66568fd2b935601ff2a6beb0e30
Instruction ID: ea76a8c0fa0bbb9af988c386250de49feb0cf4de7a97673e265d222366939822
Opcode Fuzzy Hash: 05c7aa55e7a525d8e54bd91f892b11b046a3e66568fd2b935601ff2a6beb0e30
Instruction Fuzzy Hash: CB0225742246528EF794CF9AD050375BBF3EF46340B40859AD8E5CBA81D735D9D6CB20

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5B090, Relevance: .4, Instructions: 405
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E6DF5B090(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t117;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t126;
				signed int _t134;
				signed int _t139;
				signed char _t143;
				signed int _t144;
				signed int _t146;
				signed int _t148;
				signed int* _t150;
				signed int _t152;
				signed int _t161;
				signed char _t165;
				signed int _t167;
				signed int _t170;
				signed int _t174;
				signed char _t177;
				signed int _t178;
				signed int _t181;
				signed int _t182;
				signed int _t187;
				signed int _t190;
				signed int _t192;
				signed int _t194;
				signed int _t196;
				signed int _t199;
				signed int _t202;
				signed int _t208;
				signed int _t211;

				_t182 = _a16;
				_t178 = _a8;
				_t161 = _a4;
				 *_t182 = 0;
				 *(_t182 + 4) = 0;
				_t117 =  *(_t161 + 4) & 0x00000001;
				if(_t178 == 0) {
					 *_t161 = _t182;
					 *(_t161 + 4) = _t182;
					if(_t117 != 0) {
						_t117 = _t182 | 0x00000001;
						 *(_t161 + 4) = _t117;
					}
					 *(_t182 + 8) = 0;
					goto L43;
				} else {
					_t208 = _t182 ^ _t178;
					_t192 = _t208;
					if(_t117 == 0) {
						_t192 = _t182;
					}
					_t117 = _a12 & 0x000000ff;
					 *(_t178 + _t117 * 4) = _t192;
					if(( *(_t161 + 4) & 0x00000001) == 0) {
						_t208 = _t178;
					}
					 *(_t182 + 8) = _t208 | 0x00000001;
					if(_a12 == 0) {
						_t177 =  *(_t161 + 4);
						_t117 = _t177 & 0xfffffffe;
						if(_t178 == _t117) {
							_t117 = _a4;
							 *(_t117 + 4) = _t182;
							if((_t177 & 0x00000001) != 0) {
								_t161 = _a4;
								_t117 = _t182 | 0x00000001;
								 *(_t161 + 4) = _t117;
							} else {
								_t161 = _t117;
							}
						} else {
							_t161 = _a4;
						}
					}
					if(( *(_t178 + 8) & 0x00000001) == 0) {
						L42:
						L43:
						return _t117;
					} else {
						_t165 =  *(_t161 + 4) & 0x00000001;
						do {
							_t211 =  *(_t178 + 8) & 0xfffffffc;
							if(_t165 != 0) {
								if(_t211 != 0) {
									_t211 = _t211 ^ _t178;
								}
							}
							_t119 =  *_t211;
							if(_t165 != 0) {
								if(_t119 != 0) {
									_t119 = _t119 ^ _t211;
								}
							}
							_t120 = 0;
							_t121 = _t120 & 0xffffff00 | _t119 != _t178;
							_v8 = _t121;
							_t122 = _t121 ^ 0x00000001;
							_v16 = _t122;
							_t123 =  *(_t211 + _t122 * 4);
							if(_t165 != 0) {
								if(_t123 == 0) {
									goto L20;
								}
								_t123 = _t123 ^ _t211;
								goto L13;
							} else {
								L13:
								if(_t123 == 0 || ( *(_t123 + 8) & 0x00000001) == 0) {
									L20:
									_t194 = _v16;
									if((_a12 & 0x000000ff) != _v8) {
										_t126 =  *(_t182 + 8) & 0xfffffffc;
										_t167 = _t165 & 1;
										_v12 = _t167;
										if(_t167 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t182;
											}
										}
										if(_t126 != _t178) {
											L83:
											_t178 = 0x1d;
											asm("int 0x29");
											goto L84;
										} else {
											_t126 =  *(_t178 + _t194 * 4);
											if(_t167 != 0) {
												if(_t126 != 0) {
													_t126 = _t126 ^ _t178;
												}
											}
											if(_t126 != _t182) {
												goto L83;
											} else {
												_t126 =  *(_t211 + _v8 * 4);
												if(_t167 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t211;
													}
												}
												if(_t126 != _t178) {
													goto L83;
												} else {
													_t77 = _t178 + 8; // 0x2c
													_t150 = _t77;
													_v20 = _t150;
													_t126 =  *_t150 & 0xfffffffc;
													if(_t167 != 0) {
														if(_t126 != 0) {
															_t126 = _t126 ^ _t178;
														}
													}
													if(_t126 != _t211) {
														goto L83;
													} else {
														_t202 = _t211 ^ _t182;
														_t152 = _t202;
														if(_t167 == 0) {
															_t152 = _t182;
														}
														 *(_t211 + _v8 * 4) = _t152;
														_t170 = _v12;
														if(_t170 == 0) {
															_t202 = _t211;
														}
														 *(_t182 + 8) =  *(_t182 + 8) & 0x00000003 | _t202;
														_t126 =  *(_t182 + _v8 * 4);
														if(_t170 != 0) {
															if(_t126 == 0) {
																L58:
																if(_t170 != 0) {
																	if(_t126 != 0) {
																		_t126 = _t126 ^ _t178;
																	}
																}
																 *(_t178 + _v16 * 4) = _t126;
																_t199 = _t178 ^ _t182;
																if(_t170 != 0) {
																	_t178 = _t199;
																}
																 *(_t182 + _v8 * 4) = _t178;
																if(_t170 == 0) {
																	_t199 = _t182;
																}
																 *_v20 =  *_v20 & 0x00000003 | _t199;
																_t178 = _t182;
																_t167 =  *((intOrPtr*)(_a4 + 4));
																goto L21;
															}
															_t126 = _t126 ^ _t182;
														}
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t194 = _t167 & 0xfffffffc;
															if(_v12 != 0) {
																L84:
																if(_t194 != 0) {
																	_t194 = _t194 ^ _t126;
																}
															}
															if(_t194 != _t182) {
																goto L83;
															}
															if(_v12 != 0) {
																_t196 = _t126 ^ _t178;
															} else {
																_t196 = _t178;
															}
															 *(_t126 + 8) = _t167 & 0x00000003 | _t196;
															_t170 = _v12;
														}
														goto L58;
													}
												}
											}
										}
									}
									L21:
									_t182 = _v8 ^ 0x00000001;
									_t126 =  *(_t178 + 8) & 0xfffffffc;
									_v8 = _t182;
									_t194 = _t167 & 1;
									if(_t194 != 0) {
										if(_t126 != 0) {
											_t126 = _t126 ^ _t178;
										}
									}
									if(_t126 != _t211) {
										goto L83;
									} else {
										_t134 = _t182 ^ 0x00000001;
										_v16 = _t134;
										_t126 =  *(_t211 + _t134 * 4);
										if(_t194 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t211;
											}
										}
										if(_t126 != _t178) {
											goto L83;
										} else {
											_t167 = _t211 + 8;
											_t182 =  *_t167 & 0xfffffffc;
											_v20 = _t167;
											if(_t194 != 0) {
												if(_t182 == 0) {
													L80:
													_t126 = _a4;
													if( *_t126 != _t211) {
														goto L83;
													}
													 *_t126 = _t178;
													L34:
													if(_t194 != 0) {
														if(_t182 != 0) {
															_t182 = _t182 ^ _t178;
														}
													}
													 *(_t178 + 8) =  *(_t178 + 8) & 0x00000003 | _t182;
													_t139 =  *((intOrPtr*)(_t178 + _v8 * 4));
													if(_t194 != 0) {
														if(_t139 == 0) {
															goto L37;
														}
														_t126 = _t139 ^ _t178;
														goto L36;
													} else {
														L36:
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t182 = _t167 & 0xfffffffc;
															if(_t194 != 0) {
																if(_t182 != 0) {
																	_t182 = _t182 ^ _t126;
																}
															}
															if(_t182 != _t178) {
																goto L83;
															} else {
																if(_t194 != 0) {
																	_t190 = _t126 ^ _t211;
																} else {
																	_t190 = _t211;
																}
																 *(_t126 + 8) = _t167 & 0x00000003 | _t190;
																_t167 = _v20;
																goto L37;
															}
														}
														L37:
														if(_t194 != 0) {
															if(_t139 != 0) {
																_t139 = _t139 ^ _t211;
															}
														}
														 *(_t211 + _v16 * 4) = _t139;
														_t187 = _t211 ^ _t178;
														if(_t194 != 0) {
															_t211 = _t187;
														}
														 *(_t178 + _v8 * 4) = _t211;
														if(_t194 == 0) {
															_t187 = _t178;
														}
														_t143 =  *_t167 & 0x00000003 | _t187;
														 *_t167 = _t143;
														_t117 = _t143 | 0x00000001;
														 *_t167 = _t117;
														 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
														goto L42;
													}
												}
												_t182 = _t182 ^ _t211;
											}
											if(_t182 == 0) {
												goto L80;
											}
											_t144 =  *(_t182 + 4);
											if(_t194 != 0) {
												if(_t144 != 0) {
													_t144 = _t144 ^ _t182;
												}
											}
											if(_t144 == _t211) {
												if(_t194 != 0) {
													_t146 = _t182 ^ _t178;
												} else {
													_t146 = _t178;
												}
												 *(_t182 + 4) = _t146;
												goto L34;
											} else {
												_t126 =  *_t182;
												if(_t194 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t182;
													}
												}
												if(_t126 != _t211) {
													goto L83;
												} else {
													if(_t194 != 0) {
														_t148 = _t182 ^ _t178;
													} else {
														_t148 = _t178;
													}
													 *_t182 = _t148;
													goto L34;
												}
											}
										}
									}
								} else {
									 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
									_t182 = _t211;
									 *(_t123 + 8) =  *(_t123 + 8) & 0x000000fe;
									_t174 = _a4;
									_t117 =  *(_t211 + 8);
									_t181 = _t117 & 0xfffffffc;
									if(( *(_t174 + 4) & 0x00000001) != 0) {
										if(_t181 == 0) {
											goto L42;
										}
										_t178 = _t181 ^ _t211;
									}
									if(_t178 == 0) {
										goto L42;
									}
									goto L17;
								}
							}
							L17:
							 *(_t211 + 8) = _t117 | 0x00000001;
							_t117 =  *_t178;
							_t165 =  *(_t174 + 4) & 0x00000001;
							if(_t165 != 0) {
								if(_t117 != 0) {
									_t117 = _t117 ^ _t178;
								}
							}
							_a12 = _t211 != _t117;
						} while (( *(_t178 + 8) & 0x00000001) != 0);
						goto L42;
					}
				}
			}

0x6df5b095
0x6df5b09b
0x6df5b09f
0x6df5b0a5
0x6df5b0a7
0x6df5b0ad
0x6df5b0b1
0x6df5b3f8
0x6df5b3fa
0x6df5b3ff
0x6df5b419
0x6df5b41b
0x6df5b41b
0x6df5b401
0x00000000
0x6df5b0b7
0x6df5b0b9
0x6df5b0bc
0x6df5b0c0
0x6df5b0c2
0x6df5b0c2
0x6df5b0c4
0x6df5b0c8
0x6df5b0cf
0x6df5b0d1
0x6df5b0d1
0x6df5b0da
0x6df5b0dd
0x6df5b0df
0x6df5b0e4
0x6df5b0e9
0x6df5b3e2
0x6df5b3e5
0x6df5b3eb
0x6dfaa676
0x6dfaa67b
0x6dfaa67d
0x6df5b3f1
0x6df5b3f1
0x6df5b3f1
0x6df5b0ef
0x6df5b0ef
0x6df5b0ef
0x6df5b0e9
0x6df5b0f6
0x6df5b28d
0x6df5b28e
0x6df5b293
0x6df5b0fc
0x6df5b101
0x6df5b104
0x6df5b107
0x6df5b10c
0x6dfaa687
0x6dfaa68d
0x6dfaa68d
0x6dfaa687
0x6df5b112
0x6df5b116
0x6dfaa696
0x6dfaa69c
0x6dfaa69c
0x6dfaa696
0x6df5b120
0x6df5b121
0x6df5b124
0x6df5b127
0x6df5b12a
0x6df5b12d
0x6df5b132
0x6dfaa6a5
0x00000000
0x00000000
0x6dfaa6ab
0x00000000
0x6df5b138
0x6df5b138
0x6df5b13a
0x6df5b193
0x6df5b197
0x6df5b19d
0x6df5b29c
0x6df5b29f
0x6df5b2a2
0x6df5b2a7
0x6dfaa6d2
0x6dfaa6d8
0x6dfaa6d8
0x6dfaa6d2
0x6df5b2af
0x6df5b420
0x6df5b422
0x6df5b423
0x00000000
0x6df5b2b5
0x6df5b2b5
0x6df5b2ba
0x6dfaa6e1
0x6dfaa6e7
0x6dfaa6e7
0x6dfaa6e1
0x6df5b2c2
0x00000000
0x6df5b2c8
0x6df5b2cb
0x6df5b2d0
0x6dfaa6f0
0x6dfaa6f6
0x6dfaa6f6
0x6dfaa6f0
0x6df5b2d8
0x00000000
0x6df5b2de
0x6df5b2de
0x6df5b2de
0x6df5b2e1
0x6df5b2e6
0x6df5b2eb
0x6dfaa6ff
0x6dfaa705
0x6dfaa705
0x6dfaa6ff
0x6df5b2f3
0x00000000
0x6df5b2f9
0x6df5b2fb
0x6df5b2fd
0x6df5b301
0x6df5b303
0x6df5b303
0x6df5b308
0x6df5b30b
0x6df5b310
0x6df5b312
0x6df5b312
0x6df5b31c
0x6df5b322
0x6df5b327
0x6dfaa70e
0x6df5b335
0x6df5b337
0x6dfaa71d
0x6dfaa723
0x6dfaa723
0x6dfaa71d
0x6df5b340
0x6df5b345
0x6df5b349
0x6dfaa72a
0x6dfaa72a
0x6df5b352
0x6df5b357
0x6df5b359
0x6df5b359
0x6df5b365
0x6df5b367
0x6df5b36c
0x00000000
0x6df5b36c
0x6dfaa714
0x6dfaa714
0x6df5b32f
0x6df5b3b8
0x6df5b3bd
0x6df5b3c4
0x6df5b425
0x6df5b427
0x6df5b429
0x6df5b429
0x6df5b427
0x6df5b3c8
0x00000000
0x00000000
0x6df5b3ce
0x6df5b42f
0x6df5b3d0
0x6df5b3d0
0x6df5b3d0
0x6df5b3d7
0x6df5b3da
0x6df5b3da
0x00000000
0x6df5b32f
0x6df5b2f3
0x6df5b2d8
0x6df5b2c2
0x6df5b2af
0x6df5b1a3
0x6df5b1a9
0x6df5b1af
0x6df5b1b2
0x6df5b1b5
0x6df5b1b8
0x6dfaa733
0x6dfaa739
0x6dfaa739
0x6dfaa733
0x6df5b1c0
0x00000000
0x6df5b1c6
0x6df5b1c8
0x6df5b1cb
0x6df5b1ce
0x6df5b1d3
0x6dfaa742
0x6dfaa748
0x6dfaa748
0x6dfaa742
0x6df5b1db
0x00000000
0x6df5b1e1
0x6df5b1e1
0x6df5b1e6
0x6df5b1e9
0x6df5b1ee
0x6dfaa751
0x6df5b409
0x6df5b409
0x6df5b40e
0x00000000
0x00000000
0x6df5b410
0x6df5b22d
0x6df5b22f
0x6dfaa790
0x6dfaa796
0x6dfaa796
0x6dfaa790
0x6df5b23d
0x6df5b243
0x6df5b248
0x6dfaa79f
0x00000000
0x00000000
0x6dfaa7a5
0x00000000
0x6df5b24e
0x6df5b24e
0x6df5b250
0x6df5b374
0x6df5b379
0x6df5b37e
0x6dfaa7ae
0x6dfaa7b4
0x6dfaa7b4
0x6dfaa7ae
0x6df5b386
0x00000000
0x6df5b38c
0x6df5b38e
0x6dfaa7bd
0x6df5b394
0x6df5b394
0x6df5b394
0x6df5b39b
0x6df5b39e
0x00000000
0x6df5b39e
0x6df5b386
0x6df5b256
0x6df5b258
0x6dfaa7c6
0x6dfaa7cc
0x6dfaa7cc
0x6dfaa7c6
0x6df5b261
0x6df5b266
0x6df5b26a
0x6dfaa7d3
0x6dfaa7d3
0x6df5b273
0x6df5b278
0x6df5b27a
0x6df5b27a
0x6df5b281
0x6df5b283
0x6df5b285
0x6df5b287
0x6df5b289
0x00000000
0x6df5b289
0x6df5b248
0x6dfaa757
0x6dfaa757
0x6df5b1f6
0x00000000
0x00000000
0x6df5b1fc
0x6df5b201
0x6dfaa760
0x6dfaa766
0x6dfaa766
0x6dfaa760
0x6df5b209
0x6df5b3a8
0x6dfaa76f
0x6df5b3ae
0x6df5b3ae
0x6df5b3ae
0x6df5b3b0
0x00000000
0x6df5b20f
0x6df5b20f
0x6df5b213
0x6dfaa778
0x6dfaa77e
0x6dfaa77e
0x6dfaa778
0x6df5b21b
0x00000000
0x6df5b221
0x6df5b223
0x6dfaa787
0x6df5b229
0x6df5b229
0x6df5b229
0x6df5b22b
0x00000000
0x6df5b22b
0x6df5b21b
0x6df5b209
0x6df5b1db
0x6df5b142
0x6df5b142
0x6df5b146
0x6df5b148
0x6df5b14c
0x6df5b14f
0x6df5b154
0x6df5b15b
0x6dfaa6b4
0x00000000
0x00000000
0x6dfaa6ba
0x6dfaa6ba
0x6df5b163
0x00000000
0x00000000
0x00000000
0x6df5b163
0x6df5b13a
0x6df5b169
0x6df5b16b
0x6df5b171
0x6df5b175
0x6df5b178
0x6dfaa6c3
0x6dfaa6c9
0x6dfaa6c9
0x6dfaa6c3
0x6df5b180
0x6df5b184
0x00000000
0x6df5b104
0x6df5b0f6

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: 1a7d198a109c4af82da670ee07725d14a087bcf7ad4b4cd215eb8daaee91a332
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: CAD1C032758717CBDB12CE6DC58076ABBF1AFA6354B28C968DC64CB341E731D8618760

Uniqueness

Uniqueness Score: -1.00%

Function 6DF40D20, Relevance: .4, Instructions: 372
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E6DF40D20(signed short* _a4, signed char _a8, unsigned int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				unsigned int _v36;
				signed char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int _v96;
				unsigned int _v100;
				signed int _t159;
				unsigned int _t160;
				signed int _t162;
				unsigned int _t163;
				signed int _t180;
				signed int _t192;
				signed int _t193;
				unsigned int _t194;
				signed char _t196;
				signed int _t197;
				signed char _t198;
				signed char _t199;
				unsigned int _t200;
				unsigned int _t202;
				unsigned int _t204;
				unsigned int _t205;
				unsigned int _t209;
				signed int _t210;
				signed int _t211;
				unsigned int _t212;
				signed char _t213;
				signed short* _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				unsigned int _t218;
				signed int _t220;
				signed int _t221;
				signed short _t223;
				signed char _t224;
				signed int _t229;
				signed int _t231;
				unsigned int _t233;
				unsigned int _t237;
				signed int _t238;
				unsigned int _t239;
				signed int _t240;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				unsigned int _t258;
				void* _t261;

				_t213 = _a8;
				_t159 = 0;
				_v60 = 0;
				_t237 = _t213 >> 1;
				_t210 = 0;
				_t257 = 0;
				_v56 = 0;
				_v52 = 0;
				_v44 = 0;
				_v48 = 0;
				_v92 = 0;
				_v88 = 0;
				_v76 = 0;
				_v72 = 0;
				_v64 = 0;
				_v68 = 0;
				_v24 = 0;
				_v80 = 0;
				_v84 = 0;
				_v28 = 0;
				_v32 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_v100 = _t237;
				if(_t237 > 0x100) {
					_t254 = 0x100;
					_v36 = 0x100;
					L2:
					_t261 = _t213 - 2;
					if(_t261 == 0) {
						_t214 = _a4;
						_t160 =  *_t214 & 0x0000ffff;
						__eflags = _t160;
						if(_t160 == 0) {
							L108:
							_t159 = 0;
							L8:
							_t238 = 0;
							_v96 = 0;
							if(_t254 == 0) {
								L30:
								_v24 = _t159 - 1;
								goto L31;
							} else {
								goto L11;
								L13:
								_t224 = _t223 >> 8;
								_v40 = _t224;
								_t256 = _t224 & 0x000000ff;
								_t196 = _a4[_t238];
								_v5 = _t196;
								_t197 = _t196 & 0x000000ff;
								if(_t197 == 0xd) {
									__eflags = _t257 - 0xa;
									if(_t257 == 0xa) {
										_v12 = _v12 + 1;
									}
								} else {
									if(_t197 == 0xa) {
										__eflags = _t257 - 0xd;
										if(_t257 == 0xd) {
											_v12 = _v12 + 1;
										}
									}
								}
								_v24 = (0 | _t256 == 0x00000000) + _v24 + (0 | _t197 == 0x00000000);
								if(_t256 > _t257) {
									_t229 = _t256;
								} else {
									_t229 = _t257;
								}
								if(_t257 >= _t256) {
									_t257 = _t256;
								}
								_v28 = _v28 + _t229 - _t257;
								_t231 = _t197;
								if(_t197 <= _t210) {
									_t231 = _t210;
								}
								if(_t210 >= _t197) {
									_t210 = _t197;
								}
								_v32 = _v32 + _t231 - _t210;
								_t238 = _v96 + 1;
								_t210 = _t197;
								_t257 = _t256;
								_v96 = _t238;
								if(_t238 < _v36) {
									_t214 = _a4;
									L11:
									_t223 = _t214[_t238] & 0x0000ffff;
									_t193 = _t223 & 0x0000ffff;
									if(_t193 >= 0x900 || _t193 < 0x21) {
										goto L58;
									} else {
										goto L13;
									}
								}
								_t198 = _v5;
								if(_t198 == 0xd) {
									_t199 = _v40;
									__eflags = _t199 - 0xa;
									if(_t199 != 0xa) {
										L27:
										_t233 = _v12;
										L28:
										if(_t199 != 0) {
											__eflags = _t199 - 0x1a;
											if(_t199 == 0x1a) {
												_v12 = _t233 + 1;
											}
											L31:
											_t162 = _a8;
											if(_t162 > 0x200) {
												_t255 = 0x200;
											} else {
												_t255 = _t162;
											}
											_t215 =  *0x6e036d59;
											if(_t215 != 0) {
												_t239 = 0;
												__eflags = _t255;
												if(_t255 == 0) {
													goto L34;
												} else {
													goto L119;
												}
												do {
													L119:
													_t192 =  *(_a4 + _t239) & 0x000000ff;
													__eflags =  *((short*)(0x6e036920 + _t192 * 2));
													_t163 = _v20;
													if( *((short*)(0x6e036920 + _t192 * 2)) != 0) {
														_t163 = _t163 + 1;
														_t239 = _t239 + 1;
														__eflags = _t239;
														_v20 = _t163;
													}
													_t239 = _t239 + 1;
													__eflags = _t239 - _t255;
												} while (_t239 < _t255);
												goto L35;
											} else {
												L34:
												_t163 = 0;
												L35:
												_t240 = _v32;
												_t211 = _v28;
												if(_t240 < 0x7f) {
													__eflags = _t211;
													if(_t211 != 0) {
														L37:
														if(_t240 == 0) {
															_v16 = 0x10;
														}
														L38:
														_t258 = _a12;
														if(_t215 != 0) {
															__eflags = _t163;
															if(_t163 == 0) {
																goto L39;
															}
															__eflags = _t258;
															if(_t258 == 0) {
																goto L39;
															}
															__eflags =  *_t258 & 0x00000400;
															if(( *_t258 & 0x00000400) == 0) {
																goto L39;
															}
															_t218 = _v100;
															__eflags = _t218 - 0x100;
															if(_t218 > 0x100) {
																_t218 = 0x100;
															}
															_t220 = (_t218 >> 1) - 1;
															__eflags = _v20 - 0xaaaaaaab * _t220 >> 0x20 >> 1;
															if(_v20 >= 0xaaaaaaab * _t220 >> 0x20 >> 1) {
																_t221 = _t220 + _t220;
																__eflags = _v20 - 0xaaaaaaab * _t221 >> 0x20 >> 1;
																asm("sbb ecx, ecx");
																_t216 =  ~_t221 + 1;
																__eflags = _t216;
															} else {
																_t216 = 3;
															}
															_v16 = _v16 | 0x00000400;
															_t240 = _v32;
															L40:
															if(_t211 * _t216 < _t240) {
																_v16 = _v16 | 0x00000002;
															}
															_t217 = _v16;
															if(_t240 * _t216 < _t211) {
																_t217 = _t217 | 0x00000020;
															}
															if(_v44 + _v48 + _v52 + _v56 + _v60 != 0) {
																_t217 = _t217 | 0x00000004;
															}
															if(_v64 + _v68 + _v72 + _v76 != 0) {
																_t217 = _t217 | 0x00000040;
															}
															if(_v80 + _v84 + _v88 + _v92 == 0) {
																_t212 = _v12;
																__eflags = _t212;
																if(_t212 == 0) {
																	goto L48;
																}
																__eflags = _t212 - 0xcccccccd * _t255 >> 0x20 >> 5;
																if(_t212 >= 0xcccccccd * _t255 >> 0x20 >> 5) {
																	goto L47;
																}
																goto L48;
															} else {
																L47:
																_t217 = _t217 | 0x00000100;
																L48:
																if((_a8 & 0x00000001) != 0) {
																	_t217 = _t217 | 0x00000200;
																}
																if(_v24 != 0) {
																	_t217 = _t217 | 0x00001000;
																}
																_t180 =  *_a4 & 0x0000ffff;
																if(_t180 != 0xfeff) {
																	__eflags = _t180 - 0xfffe;
																	if(_t180 == 0xfffe) {
																		_t217 = _t217 | 0x00000080;
																	}
																} else {
																	_t217 = _t217 | 0x00000008;
																}
																if(_t258 != 0) {
																	 *_t258 =  *_t258 & _t217;
																	_t217 =  *_t258;
																}
																if((_t217 & 0x00000b08) != 8) {
																	__eflags = _t217 & 0x000000f0;
																	if((_t217 & 0x000000f0) != 0) {
																		L84:
																		return 0;
																	}
																	__eflags = _t217 & 0x00000f00;
																	if((_t217 & 0x00000f00) == 0) {
																		__eflags = _t217 & 0x0000f00f;
																		if((_t217 & 0x0000f00f) == 0) {
																			goto L84;
																		}
																		goto L56;
																	}
																	goto L84;
																} else {
																	L56:
																	return 1;
																}
															}
														}
														L39:
														_t216 = 3;
														goto L40;
													}
													_v16 = 1;
													goto L38;
												}
												if(_t211 == 0) {
													goto L38;
												}
												goto L37;
											}
										} else {
											_t159 = _v24;
											goto L30;
										}
									}
									L104:
									_t233 = _v12 + 1;
									_v12 = _t233;
									goto L28;
								}
								_t199 = _v40;
								if(_t198 != 0xa || _t199 != 0xd) {
									goto L27;
								} else {
									goto L104;
								}
								L58:
								__eflags = _t193 - 0x3001;
								if(_t193 < 0x3001) {
									L60:
									__eflags = _t193 - 0xd00;
									if(__eflags > 0) {
										__eflags = _t193 - 0x3000;
										if(__eflags > 0) {
											_t194 = _t193 - 0xfeff;
											__eflags = _t194;
											if(_t194 != 0) {
												_t200 = _t194 - 0xff;
												__eflags = _t200;
												if(_t200 == 0) {
													_v88 = _v88 + 1;
												} else {
													__eflags = _t200 == 1;
													if(_t200 == 1) {
														_v92 = _v92 + 1;
													}
												}
											}
										} else {
											if(__eflags == 0) {
												_v48 = _v48 + 1;
											} else {
												_t202 = _t193 - 0x2000;
												__eflags = _t202;
												if(_t202 == 0) {
													_v68 = _v68 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v76 = _v76 + 1;
										goto L13;
									}
									__eflags = _t193 - 0x20;
									if(__eflags > 0) {
										_t204 = _t193 - 0x900;
										__eflags = _t204;
										if(_t204 == 0) {
											_v64 = _v64 + 1;
										} else {
											_t205 = _t204 - 0x100;
											__eflags = _t205;
											if(_t205 == 0) {
												_v72 = _v72 + 1;
											} else {
												__eflags = _t205 == 0xd;
												if(_t205 == 0xd) {
													_v84 = _v84 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v44 = _v44 + 1;
										goto L13;
									}
									__eflags = _t193 - 0xd;
									if(_t193 > 0xd) {
										goto L13;
									}
									_t84 = _t193 + 0x6df41174; // 0x4040400
									switch( *((intOrPtr*)(( *_t84 & 0x000000ff) * 4 +  &M6DF41160))) {
										case 0:
											_v80 = _v80 + 1;
											goto L13;
										case 1:
											_v52 = _v52 + 1;
											goto L13;
										case 2:
											_v56 = _v56 + 1;
											goto L13;
										case 3:
											_v60 = _v60 + 1;
											goto L13;
										case 4:
											goto L13;
									}
								}
								__eflags = _t193 - 0xfeff;
								if(_t193 < 0xfeff) {
									goto L13;
								}
								goto L60;
							}
						}
						__eflags = _t160 >> 8;
						if(_t160 >> 8 == 0) {
							L101:
							_t209 = _a12;
							__eflags = _t209;
							if(_t209 != 0) {
								 *_t209 = 5;
							}
							goto L84;
						}
						goto L108;
					}
					if(_t261 <= 0 || _t237 > 0x100) {
						_t214 = _a4;
					} else {
						_t214 = _a4;
						if((_t213 & 0x00000001) == 0 && ( *(_t214 + _t254 * 2 - 2) & 0x0000ff00) == 0) {
							_t254 = _t254 - 1;
							_v36 = _t254;
						}
					}
					goto L8;
				}
				_t254 = _t237;
				_v36 = _t254;
				if(_t254 == 0) {
					goto L101;
				}
				goto L2;
			}

0x6df40d2b
0x6df40d2e
0x6df40d32
0x6df40d39
0x6df40d3b
0x6df40d3d
0x6df40d3f
0x6df40d46
0x6df40d4d
0x6df40d54
0x6df40d5b
0x6df40d62
0x6df40d69
0x6df40d70
0x6df40d77
0x6df40d7e
0x6df40d85
0x6df40d88
0x6df40d8b
0x6df40d8e
0x6df40d91
0x6df40d94
0x6df40d97
0x6df40d9a
0x6df40d9d
0x6df40da6
0x6df410e9
0x6df410ee
0x6df40db9
0x6df40db9
0x6df40dbc
0x6df9e9c7
0x6df9e9ca
0x6df9e9cd
0x6df9e9d0
0x6df9e9dd
0x6df9e9dd
0x6df40dec
0x6df40dec
0x6df40dee
0x6df40df3
0x6df40ebf
0x6df40ec0
0x00000000
0x6df40df9
0x6df40df9
0x6df40e1e
0x6df40e21
0x6df40e24
0x6df40e27
0x6df40e2a
0x6df40e2d
0x6df40e30
0x6df40e36
0x6df41040
0x6df41043
0x6df41049
0x6df41049
0x6df40e3c
0x6df40e3f
0x6df41007
0x6df4100a
0x6df41010
0x6df41010
0x6df4100a
0x6df40e3f
0x6df40e58
0x6df40e5d
0x6df41000
0x6df40e63
0x6df40e63
0x6df40e63
0x6df40e67
0x6df40e69
0x6df40e69
0x6df40e6d
0x6df40e70
0x6df40e74
0x6df40e76
0x6df40e76
0x6df40e7a
0x6df40e7c
0x6df40e7c
0x6df40e83
0x6df40e86
0x6df40e87
0x6df40e89
0x6df40e8b
0x6df40e91
0x6df40e00
0x6df40e03
0x6df40e03
0x6df40e07
0x6df40e0f
0x00000000
0x00000000
0x00000000
0x00000000
0x6df40e0f
0x6df40e97
0x6df40e9c
0x6df4113e
0x6df41141
0x6df41143
0x6df40eb1
0x6df40eb1
0x6df40eb4
0x6df40eb6
0x6df41110
0x6df41112
0x6df9ea25
0x6df9ea25
0x6df40ec3
0x6df40ec3
0x6df40ecb
0x6df410fe
0x6df40ed1
0x6df40ed1
0x6df40ed1
0x6df40ed3
0x6df40edb
0x6df9ea2d
0x6df9ea2f
0x6df9ea31
0x00000000
0x00000000
0x00000000
0x00000000
0x6df9ea37
0x6df9ea37
0x6df9ea3a
0x6df9ea3e
0x6df9ea47
0x6df9ea4a
0x6df9ea4c
0x6df9ea4d
0x6df9ea4d
0x6df9ea4e
0x6df9ea4e
0x6df9ea51
0x6df9ea52
0x6df9ea52
0x00000000
0x6df40ee1
0x6df40ee1
0x6df40ee1
0x6df40ee3
0x6df40ee3
0x6df40ee6
0x6df40eec
0x6df9ea5b
0x6df9ea5d
0x6df40ef6
0x6df40ef8
0x6df9ea6f
0x6df9ea6f
0x6df40efe
0x6df40efe
0x6df40f03
0x6df9ea7b
0x6df9ea7d
0x00000000
0x00000000
0x6df9ea83
0x6df9ea85
0x00000000
0x00000000
0x6df9ea8b
0x6df9ea91
0x00000000
0x00000000
0x6df9ea97
0x6df9ea9a
0x6df9eaa0
0x6df9eaa2
0x6df9eaa2
0x6df9eaae
0x6df9eab3
0x6df9eab6
0x6df9eabf
0x6df9eaca
0x6df9eacd
0x6df9ead1
0x6df9ead1
0x6df9eab8
0x6df9eab8
0x6df9eab8
0x6df9ead2
0x6df9ead9
0x6df40f0e
0x6df40f15
0x6df40f17
0x6df40f17
0x6df40f1e
0x6df40f23
0x6df9eae1
0x6df9eae1
0x6df40f38
0x6df40f3a
0x6df40f3a
0x6df40f49
0x6df41108
0x6df41108
0x6df40f5b
0x6df410c7
0x6df410ca
0x6df410cc
0x00000000
0x00000000
0x6df410dc
0x6df410de
0x00000000
0x00000000
0x00000000
0x6df40f61
0x6df40f61
0x6df40f61
0x6df40f67
0x6df40f6b
0x6df4111d
0x6df4111d
0x6df40f75
0x6df40f77
0x6df40f77
0x6df40f85
0x6df40f8b
0x6df410b9
0x6df410bc
0x6df9eae9
0x6df9eae9
0x6df40f91
0x6df40f91
0x6df40f91
0x6df40f96
0x6df40f98
0x6df40f9a
0x6df40f9a
0x6df40fa6
0x6df4107c
0x6df4107f
0x6df4108d
0x00000000
0x6df4108d
0x6df41081
0x6df41087
0x6df9eaf4
0x6df9eafa
0x00000000
0x00000000
0x00000000
0x6df9eb00
0x00000000
0x6df40fac
0x6df40fac
0x00000000
0x6df40fac
0x6df40fa6
0x6df40f5b
0x6df40f09
0x6df40f09
0x00000000
0x6df40f09
0x6df9ea63
0x00000000
0x6df9ea63
0x6df40ef4
0x00000000
0x00000000
0x00000000
0x6df40ef4
0x6df40ebc
0x6df40ebc
0x00000000
0x6df40ebc
0x6df40eb6
0x6df41149
0x6df4114c
0x6df4114d
0x00000000
0x6df4114d
0x6df40ea4
0x6df40ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x6df40fb7
0x6df40fb7
0x6df40fbc
0x6df40fc9
0x6df40fc9
0x6df40fce
0x6df41020
0x6df41025
0x6df41094
0x6df41094
0x6df41099
0x6df9ea04
0x6df9ea04
0x6df9ea09
0x6df9ea1c
0x6df9ea0b
0x6df9ea0b
0x6df9ea0e
0x6df9ea14
0x6df9ea14
0x6df9ea0e
0x6df9ea09
0x6df41027
0x6df41027
0x6df41155
0x6df4102d
0x6df4102d
0x6df4102d
0x6df41032
0x6df9e9fc
0x6df9e9fc
0x6df41032
0x6df41027
0x00000000
0x6df41025
0x6df40fd0
0x6df9e9f4
0x00000000
0x6df9e9f4
0x6df40fd6
0x6df40fd9
0x6df41059
0x6df41059
0x6df4105e
0x6df9e9ec
0x6df41064
0x6df41064
0x6df41064
0x6df41069
0x6df410ac
0x6df4106b
0x6df4106b
0x6df4106e
0x6df41074
0x6df41074
0x6df4106e
0x6df41069
0x00000000
0x6df4105e
0x6df40fdb
0x6df410a4
0x00000000
0x6df410a4
0x6df40fe1
0x6df40fe4
0x00000000
0x00000000
0x6df40fea
0x6df40ff1
0x00000000
0x6df40ff8
0x00000000
0x00000000
0x6df9e9e4
0x00000000
0x00000000
0x6df41018
0x00000000
0x00000000
0x6df41051
0x00000000
0x00000000
0x00000000
0x00000000
0x6df40ff1
0x6df40fbe
0x6df40fc3
0x00000000
0x00000000
0x00000000
0x6df40fc3
0x6df40df3
0x6df9e9d5
0x6df9e9d7
0x6df41128
0x6df41128
0x6df4112b
0x6df4112d
0x6df41133
0x6df41133
0x00000000
0x6df4112d
0x00000000
0x6df9e9d7
0x6df40dc2
0x6df410f6
0x6df40dd4
0x6df40dd7
0x6df40dda
0x6df40de8
0x6df40de9
0x6df40de9
0x6df40dda
0x00000000
0x6df40dc2
0x6df40dac
0x6df40dae
0x6df40db3
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8519ac2513cabf2fa221ee87a4e2242280e1aaba862e7b2164b6aa641f80c7f
Instruction ID: ca37593cc660d8842ac9e4d0c8137680615c20b58c41d6e10dba3a6cd3ace5e5
Opcode Fuzzy Hash: f8519ac2513cabf2fa221ee87a4e2242280e1aaba862e7b2164b6aa641f80c7f
Instruction Fuzzy Hash: 00D19E32E1425A8BEB19CF9EC4907BEBFB1FF55340F14C029D451AB296D7B489A1CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6DF78840, Relevance: .3, Instructions: 340
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6DF78840(signed int* _a4, unsigned int _a8, signed int* _a12, char* _a16, intOrPtr _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int* _t65;
				char* _t76;
				signed char _t77;
				signed int* _t84;
				signed int* _t88;
				signed int _t91;
				unsigned int _t118;
				signed int _t119;
				void* _t122;
				signed int _t143;
				signed int* _t144;
				signed int _t145;
				intOrPtr _t147;
				signed int _t148;
				signed int _t150;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				signed int _t155;
				signed int _t156;
				signed int _t158;
				signed int _t160;
				signed int _t162;
				unsigned int _t164;
				intOrPtr _t171;
				void* _t173;
				signed int _t175;
				intOrPtr _t176;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				unsigned int _t180;
				signed int _t183;
				signed int _t186;
				signed int _t188;

				_t144 = _a4;
				_t65 = _t144;
				_t76 = _a16;
				_t174 = _a20;
				_t145 = 0;
				_v8 = _t144 + (_a8 >> 1) * 2;
				_v12 = 0;
				_t171 = _t76 + _a20;
				_v20 = _t171;
				if(_t76 == 0) {
					return 0xc00000f2;
				}
				if(_t65 != 0) {
					L3:
					while(_t76 < _t171) {
						_t175 =  *_t76;
						_t76 = _t76 + 1;
						if(_t145 != 0) {
							if((_t175 & 0x000000c0) != 0x80) {
								_t76 = _t76 - 1;
								L52:
								_t148 = 0xfffd;
								_v12 = 0x107;
								L6:
								_t176 = _v8;
								L7:
								if(_t65 >= _t176) {
									L83:
									_t88 = _a12;
									if(_t88 != 0) {
										 *_t88 = _t65 - _a4 & 0xfffffffe;
									}
									return 0xc0000023;
								}
								 *_t65 = _t148;
								_t65 =  &(_t65[0]);
								_t150 = _t171 - _t76;
								_t91 = _v8 - _t65 >> 1;
								if(_t150 <= 0xd) {
									if(_t91 < _t150) {
										_t145 = 0;
										continue;
									}
									while(_t76 < _t171) {
										_t151 =  *_t76;
										_t76 = _t76 + 1;
										if(_t151 > 0x7f) {
											L44:
											if((_t151 & 0x00000040) == 0) {
												goto L52;
											}
											if((_t151 & 0x00000020) == 0) {
												_t152 = _t151 & 0x0000001f;
												if(_t152 <= 1) {
													goto L52;
												}
												_t145 = _t152 | 0x00800000;
												goto L3;
											}
											if((_t151 & 0x00000010) != 0) {
												_t153 = _t151 & 0x0000000f;
												if(_t153 > 4) {
													goto L52;
												}
												_t145 = _t153 | 0x504d0c00;
												goto L3;
											}
											_t145 = _t151 & 0x0000000f | 0x48228000;
											goto L3;
										}
										 *_t65 = _t151;
										_t65 =  &(_t65[0]);
									}
									L26:
									_t147 = _v12;
									L27:
									_t84 = _a12;
									if(_t84 != 0) {
										 *_t84 = _t65 - _a4 & 0xfffffffe;
									}
									return _t147;
								}
								if(_t150 >= _t91) {
									_t150 = _t91;
								}
								_t173 = _t65 + (_t150 - 7) * 2;
								if(_t65 >= _t173) {
									L20:
									_t171 = _v20;
									_t145 = 0;
									continue;
								} else {
									do {
										_t155 =  *_t76;
										_t77 = _t76 + 1;
										if(_t155 > 0x7f) {
											L64:
											_t177 =  *_t77;
											_t76 = _t77 + 1;
											if((_t155 & 0x00000040) == 0 || (_t177 & 0x000000c0) != 0x80) {
												L82:
												_t76 = _t76 - 2;
												goto L20;
											} else {
												_t178 = _t177 & 0x0000003f;
												if((_t155 & 0x00000020) == 0) {
													_t156 = _t155 & 0x0000001f;
													if(_t156 <= 1) {
														goto L82;
													}
													_t179 = _t178 | _t156 << 0x00000006;
													L79:
													 *_t65 = _t179;
													_t173 = _t173 - 2;
													goto L80;
												}
												_t183 = _t178 | (_t155 & 0x0000000f) << 0x00000006;
												_v16 =  *_t76;
												_t118 = _t183;
												if((_t155 & 0x00000010) == 0) {
													_t119 = _t118 & 0x000003e0;
													if(_t119 == 0 || _t119 == 0x360) {
														goto L82;
													} else {
														_t158 = _v16;
														if((_t158 & 0x000000c0) != 0x80) {
															goto L82;
														}
														_t179 = _t183 << 0x00000006 | _t158 & 0x0000003f;
														_t122 = 1;
														L76:
														_t76 = _t76 + _t122;
														_t173 = _t173 + 0xfffffffe;
														goto L79;
													}
												}
												if((_t118 >> 4) - 1 > 0xf) {
													goto L82;
												}
												_t160 = _v16;
												if((_t160 & 0x000000c0) != 0x80) {
													goto L82;
												}
												_t186 = _t183 << 0x00000006 | _t160 & 0x0000003f;
												_t162 =  *(_t76 + 1);
												if((_t162 & 0x000000c0) != 0x80) {
													goto L82;
												}
												_t188 = _t186 << 0x00000006 | _t162 & 0x0000003f;
												 *_t65 = (_t188 >> 0x0000000a & 0x000007ff) - 0x2840;
												_t65 =  &(_t65[0]);
												_t122 = 2;
												_t179 = (_t188 & 0x000003ff) - 0x00002400 & 0x0000ffff;
												goto L76;
											}
										}
										 *_t65 = _t155;
										_t65 =  &(_t65[0]);
										if((_t77 & 0x00000001) != 0) {
											_t155 =  *_t77;
											_t77 = _t77 + 1;
											if(_t155 > 0x7f) {
												goto L64;
											}
											 *_t65 = _t155;
											_t65 =  &(_t65[0]);
										}
										if((_t77 & 0x00000002) == 0) {
											L17:
											while(_t65 < _t173) {
												_t180 =  *(_t77 + 4);
												_t164 =  *_t77;
												if(((_t180 | _t164) & 0x80808080) != 0) {
													L62:
													_t155 = _t164 & 0x000000ff;
													_t77 = _t77 + 1;
													if(_t155 > 0x7f) {
														goto L64;
													}
													 *_t65 = _t155;
													goto L80;
												}
												_t76 = _t77 + 8;
												 *_t65 = _t164 & 0x0000007f;
												_t65[0] = _t164 >> 0x00000008 & 0x0000007f;
												_t65[1] = _t164 >> 0x00000010 & 0x0000007f;
												_t65[1] = _t164 >> 0x00000018 & 0x0000007f;
												_t65[2] = _t180 & 0x0000007f;
												_t65[2] = _t180 >> 0x00000008 & 0x0000007f;
												_t65[3] = _t180 >> 0x00000010 & 0x0000007f;
												_t65[3] = _t180 >> 0x00000018 & 0x0000007f;
												_t65 =  &(_t65[4]);
											}
											goto L20;
										}
										_t164 =  *_t77 & 0x0000ffff;
										if((_t164 & 0x00008080) != 0) {
											goto L62;
										}
										_t76 = _t77 + 2;
										 *_t65 = _t164 & 0x0000007f;
										_t65[0] = _t164 >> 0x00000008 & 0x0000007f;
										_t65 =  &(_t65[1]);
										goto L17;
										L80:
										_t65 =  &(_t65[0]);
									} while (_t65 < _t173);
									goto L20;
								}
							}
							_t148 = _t145 << 0x00000006 | _t175 & 0x0000003f;
							if((_t148 & 0x20000000) != 0) {
								_t176 = _v8;
								if((_t148 & 0x101f0000) <= 0x10000000) {
									goto L7;
								}
								if(_t65 >= _t176) {
									goto L83;
								} else {
									 *_t65 = (_t148 >> 0x0000000a & 0x000007ff) - 0x2840;
									_t65 =  &(_t65[0]);
									_t148 = (_t148 & 0x000003ff) + 0xdc00;
									goto L7;
								}
								goto L44;
							}
							if((_t148 & 0x10000000) != 0) {
								if((_t148 & 0x00800000) != 0 || (_t148 & 0x000001f0) - 0x10 <= 0xf0) {
									continue;
								} else {
									goto L52;
								}
							}
							_t143 = _t148 & 0x000003e0;
							if(_t143 == 0) {
								goto L52;
							}
							if(_t143 != 0x360) {
								continue;
							}
							goto L52;
						}
						_t151 = _t175;
						if(_t151 > 0x7f) {
							goto L44;
						}
						goto L6;
					}
					if(_t145 != 0) {
						_t147 = 0x107;
						if(_t65 < _v8) {
							 *_t65 = 0xfffd;
							_t65 =  &(_t65[0]);
						} else {
							_t147 = 0xc0000023;
						}
						goto L27;
					}
					goto L26;
				}
				_t67 = _a12;
				if(_a12 == 0) {
					return 0xc000000d;
				}
				return E6DF78AC0(_t76, _t174, _t67);
			}

0x6df78848
0x6df7884b
0x6df78851
0x6df78857
0x6df7885e
0x6df78860
0x6df78865
0x6df78868
0x6df7886b
0x6df78870
0x00000000
0x6dfb8f81
0x6df78878
0x00000000
0x6df78880
0x6df78888
0x6df7888b
0x6df7888e
0x6df78a33
0x6dfb8f95
0x6dfb8f96
0x6dfb8f9b
0x6dfb8fa0
0x6df7889f
0x6df7889f
0x6df788a2
0x6df788a4
0x6dfb913f
0x6dfb913f
0x6dfb9144
0x6dfb914c
0x6dfb914c
0x00000000
0x6dfb914e
0x6df788ad
0x6df788b0
0x6df788b7
0x6df788b9
0x6df788be
0x6df789aa
0x6df78ab9
0x00000000
0x6df78ab9
0x6df789b0
0x6df789b4
0x6df789b7
0x6df789bb
0x6df78a90
0x6df78a93
0x00000000
0x00000000
0x6df78a9c
0x6dfb9010
0x6dfb9016
0x00000000
0x00000000
0x6dfb901c
0x00000000
0x6dfb901c
0x6df78aa5
0x6dfb8ffd
0x6dfb9003
0x00000000
0x00000000
0x6dfb9005
0x00000000
0x6dfb9005
0x6df78aae
0x00000000
0x6df78aae
0x6df789c1
0x6df789c4
0x6df789c4
0x6df789d1
0x6df789d1
0x6df789d4
0x6df789d4
0x6df789d9
0x6df789e1
0x6df789e1
0x00000000
0x6df789e3
0x6df788c6
0x6df78a0c
0x6df78a0c
0x6df788cf
0x6df788d4
0x6df7899e
0x6df7899e
0x6df789a1
0x00000000
0x6df788e0
0x6df788e0
0x6df788e0
0x6df788e3
0x6df788e7
0x6dfb9038
0x6dfb9038
0x6dfb903b
0x6dfb903f
0x6dfb9137
0x6dfb9137
0x00000000
0x6dfb9053
0x6dfb9053
0x6dfb9059
0x6dfb9114
0x6dfb911a
0x00000000
0x00000000
0x6dfb911f
0x6dfb9121
0x6dfb9121
0x6dfb9124
0x00000000
0x6dfb9124
0x6dfb9067
0x6dfb906c
0x6dfb906f
0x6dfb9074
0x6dfb90e3
0x6dfb90e9
0x00000000
0x6dfb90f3
0x6dfb90f3
0x6dfb90fe
0x00000000
0x00000000
0x6dfb9106
0x6dfb9108
0x6dfb910d
0x6dfb910d
0x6dfb910f
0x00000000
0x6dfb910f
0x6dfb90e9
0x6dfb907d
0x00000000
0x00000000
0x6dfb9083
0x6dfb908e
0x00000000
0x00000000
0x6dfb909a
0x6dfb909c
0x6dfb90a8
0x00000000
0x00000000
0x6dfb90b4
0x6dfb90cd
0x6dfb90d0
0x6dfb90d9
0x6dfb90de
0x00000000
0x6dfb90de
0x6dfb903f
0x6df788ed
0x6df788f0
0x6df788f6
0x6df78a13
0x6df78a16
0x6df78a1a
0x00000000
0x00000000
0x6df78a20
0x6df78a23
0x6df78a23
0x6df788ff
0x00000000
0x6df78928
0x6df7892c
0x6df78931
0x6df7893b
0x6dfb9027
0x6dfb9027
0x6dfb902a
0x6dfb902e
0x00000000
0x00000000
0x6dfb9030
0x00000000
0x6dfb9030
0x6df78943
0x6df78949
0x6df78954
0x6df78963
0x6df7896c
0x6df78973
0x6df7897f
0x6df78991
0x6df78995
0x6df78999
0x6df78999
0x00000000
0x6df78928
0x6df78901
0x6df7890a
0x00000000
0x00000000
0x6df78912
0x6df7891e
0x6df78921
0x6df78925
0x00000000
0x6dfb9127
0x6dfb9127
0x6dfb912a
0x00000000
0x6dfb9132
0x6df788d4
0x6df78a3f
0x6df78a47
0x6df78a74
0x6df78a85
0x00000000
0x00000000
0x6dfb8fcf
0x00000000
0x6dfb8fd5
0x6dfb8fec
0x6dfb8fef
0x6dfb8ff2
0x00000000
0x6dfb8ff2
0x00000000
0x6dfb8fcf
0x6df78a4f
0x6dfb8fae
0x00000000
0x6dfb8fcb
0x00000000
0x6dfb8fcb
0x6dfb8fae
0x6df78a57
0x6df78a5d
0x00000000
0x00000000
0x6df78a69
0x00000000
0x00000000
0x00000000
0x6df78a6f
0x6df78894
0x6df78899
0x00000000
0x00000000
0x00000000
0x6df78899
0x6df789cb
0x6dfb9158
0x6dfb9160
0x6dfb9171
0x6dfb9174
0x6dfb9162
0x6dfb9162
0x6dfb9162
0x00000000
0x6dfb9160
0x00000000
0x6df789cb
0x6df789ee
0x6df789f3
0x00000000
0x6dfb8f8b
0x6df78a09

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction ID: 42e656d8a672ee9523e7d8e90c7784e1acc312471d81ee51dcd84a64821a9ce2
Opcode Fuzzy Hash: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction Fuzzy Hash: 90B13A23A285529BD71D8A1DD8A13FD3673FFD6310F19C26AC9525F7E8C93889009352

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7EBB0, Relevance: .2, Instructions: 250
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6DF7EBB0(signed int* _a4, intOrPtr _a8, intOrPtr* _a12, signed short* _a16, unsigned int _a20) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				unsigned int _v20;
				intOrPtr _t42;
				unsigned int _t43;
				unsigned int _t50;
				signed char _t56;
				signed char _t60;
				signed int _t63;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				unsigned int _t82;
				signed int _t87;
				signed int _t91;
				signed short _t96;
				signed short* _t98;
				signed char _t100;
				signed int* _t102;
				signed short* _t105;
				intOrPtr _t106;
				signed int _t108;
				signed int* _t110;
				void* _t113;
				signed int _t115;
				signed short* _t117;
				signed int _t118;

				_t98 = _a16;
				_t87 = 0;
				_v16 = 0;
				if(_t98 == 0) {
					return 0xc00000f2;
				}
				_t110 = _a4;
				if(_t110 == 0) {
					if(_a12 == 0) {
						_t42 = 0xc000000d;
					} else {
						_t42 = E6DF7ED1A(_t98, _a20, _a12);
					}
					L19:
					return _t42;
				}
				_t43 = _a20;
				if((_t43 & 0x00000001) != 0) {
					_t42 = 0xc00000f3;
					goto L19;
				} else {
					_t102 = _t110;
					_t105 =  &(_t98[_t43 >> 1]);
					_v8 = _t105;
					_v12 = _a8 + _t110;
					L4:
					while(1) {
						L4:
						while(1) {
							L4:
							if(_t98 >= _t105) {
								if(_t87 == 0) {
									L17:
									_t106 = _v16;
									L18:
									_t42 = _t106;
									 *_a12 = _t102 - _a4;
									goto L19;
								}
								L8:
								_t13 = _t87 - 0xd800; // -55295
								if(_t13 <= 0x7ff) {
									_v16 = 0x107;
									_t87 = 0xfffd;
								}
								_t113 = 1;
								if(_t87 > 0x7f) {
									if(_t87 > 0x7ff) {
										if(_t87 > 0xffff) {
											_t113 = 2;
										}
										_t113 = _t113 + 1;
									}
									_t113 = _t113 + 1;
								}
								if(_t102 > _v12 - _t113) {
									_t106 = 0xc0000023;
									goto L18;
								} else {
									if(_t87 > 0x7f) {
										_t50 = _t87;
										if(_t87 > 0x7ff) {
											if(_t87 > 0xffff) {
												 *_t102 = _t50 >> 0x00000012 | 0x000000f0;
												_t102 =  &(_t102[0]);
												_t56 = _t87 >> 0x0000000c & 0x0000003f | 0x00000080;
											} else {
												_t56 = _t50 >> 0x0000000c | 0x000000e0;
											}
											 *_t102 = _t56;
											_t102 =  &(_t102[0]);
											_t60 = _t87 >> 0x00000006 & 0x0000003f | 0x00000080;
										} else {
											_t60 = _t50 >> 0x00000006 | 0x000000c0;
										}
										 *_t102 = _t60;
										_t102 =  &(_t102[0]);
										_t87 = _t87 & 0x0000003f | 0x00000080;
									}
									 *_t102 = _t87;
									_t102 =  &(_t102[0]);
									_t63 = _t105 - _t98 >> 1;
									_t115 = _v12 - _t102;
									if(_t63 > 0xd) {
										if(_t115 < _t63) {
											_t63 = _t115;
										}
										_t22 = _t63 - 5; // -5
										_t117 =  &(_t98[_t22]);
										if(_t98 < _t117) {
											do {
												_t91 =  *_t98 & 0x0000ffff;
												_t100 =  &(_t98[1]);
												if(_t91 > 0x7f) {
													L58:
													if(_t91 > 0x7ff) {
														_t38 = _t91 - 0xd800; // -55296
														if(_t38 <= 0x7ff) {
															if(_t91 > 0xdbff) {
																_t98 = _t100 - 2;
																break;
															}
															_t108 =  *_t100 & 0x0000ffff;
															_t98 = _t100 + 2;
															_t39 = _t108 - 0xdc00; // -54273
															if(_t39 > 0x3ff) {
																_t98 = _t98 - 4;
																break;
															}
															_t91 = (_t91 << 0xa) + 0xfca02400 + _t108;
															 *_t102 = _t91 >> 0x00000012 | 0x000000f0;
															_t102 =  &(_t102[0]);
															_t73 = _t91 & 0x0003f000 | 0x00080000;
															L65:
															_t117 = _t117 - 2;
															 *_t102 = _t73 >> 0xc;
															_t102 =  &(_t102[0]);
															_t77 = _t91 & 0x00000fc0 | 0x00002000;
															L66:
															 *_t102 = _t77 >> 6;
															_t117 = _t117 - 2;
															_t102[0] = _t91 & 0x0000003f | 0x00000080;
															_t102 =  &(_t102[0]);
															goto L30;
														}
														_t73 = _t91 | 0x000e0000;
														goto L65;
													}
													_t77 = _t91 | 0x00003000;
													goto L66;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												if((_t100 & 0x00000002) != 0) {
													_t91 =  *_t100 & 0x0000ffff;
													_t100 = _t100 + 2;
													if(_t91 > 0x7f) {
														goto L58;
													}
													 *_t102 = _t91;
													_t102 =  &(_t102[0]);
												}
												if(_t100 >= _t117) {
													break;
												} else {
													goto L28;
												}
												while(1) {
													L28:
													_t80 =  *(_t100 + 4);
													_t96 =  *_t100;
													_v20 = _t80;
													if(((_t80 | _t96) & 0xff80ff80) != 0) {
														break;
													}
													_t82 = _v20;
													_t100 = _t100 + 8;
													 *_t102 = _t96;
													_t102[0] = _t82;
													_t102[0] = _t96 >> 0x10;
													_t102[0] = _t82 >> 0x10;
													_t102 =  &(_t102[1]);
													if(_t100 < _t117) {
														continue;
													}
													goto L30;
												}
												_t91 = _t96 & 0x0000ffff;
												_t100 = _t100 + 2;
												if(_t91 > 0x7f) {
													goto L58;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												L30:
											} while (_t98 < _t117);
											_t105 = _v8;
										}
										goto L32;
									} else {
										if(_t115 < _t63) {
											L32:
											_t87 = 0;
											continue;
										}
										while(_t98 < _t105) {
											_t87 =  *_t98 & 0x0000ffff;
											_t98 =  &(_t98[1]);
											if(_t87 > 0x7f) {
												L7:
												_t12 = _t87 - 0xd800; // -55290
												if(_t12 <= 0x3ff) {
													goto L4;
												}
												goto L8;
											}
											 *_t102 = _t87;
											_t102 =  &(_t102[0]);
										}
										goto L17;
									}
								}
							}
							_t118 =  *_t98 & 0x0000ffff;
							if(_t87 != 0) {
								_t36 = _t118 - 0xdc00; // -56314
								if(_t36 <= 0x3ff) {
									_t87 = (_t87 << 0xa) + 0xfca02400 + _t118;
									_t98 =  &(_t98[1]);
								}
								goto L8;
							}
							_t87 = _t118;
							_t98 =  &(_t98[1]);
							goto L7;
						}
					}
				}
			}

0x6df7ebb8
0x6df7ebbf
0x6df7ebc1
0x6df7ebc6
0x00000000
0x6dfbb6d6
0x6df7ebcd
0x6df7ebd2
0x6df7ec95
0x6dfbb6e0
0x6df7ec9b
0x6df7eca1
0x6df7eca1
0x6df7ec89
0x00000000
0x6df7ec89
0x6df7ebd8
0x6df7ebdd
0x6dfbb6ea
0x00000000
0x6df7ebe3
0x6df7ebe5
0x6df7ebe7
0x6df7ebef
0x6df7ebf2
0x00000000
0x6df7ebf5
0x00000000
0x6df7ebf5
0x6df7ebf5
0x6df7ebf7
0x6dfbb6f6
0x6df7ec7c
0x6df7ec7c
0x6df7ec7f
0x6df7ec82
0x6df7ec87
0x00000000
0x6df7ec87
0x6df7ec1a
0x6df7ec1a
0x6df7ec25
0x6dfbb725
0x6dfbb72c
0x6dfbb72c
0x6df7ec2d
0x6df7ec31
0x6dfbb73c
0x6dfbb744
0x6dfbb748
0x6dfbb748
0x6dfbb749
0x6dfbb749
0x6dfbb74a
0x6dfbb74a
0x6df7ec3e
0x6dfbb860
0x00000000
0x6df7ec44
0x6df7ec47
0x6dfbb750
0x6dfbb758
0x6dfbb767
0x6dfbb775
0x6dfbb77c
0x6dfbb77f
0x6dfbb769
0x6dfbb76c
0x6dfbb76c
0x6dfbb781
0x6dfbb788
0x6dfbb78b
0x6dfbb75a
0x6dfbb75d
0x6dfbb75d
0x6dfbb78d
0x6dfbb792
0x6dfbb793
0x6dfbb793
0x6df7ec54
0x6df7ec56
0x6df7ec57
0x6df7ec59
0x6df7ec5e
0x6df7ecaa
0x6df7ed16
0x6df7ed16
0x6df7ecac
0x6df7ecaf
0x6df7ecb4
0x6df7ecb6
0x6df7ecb6
0x6df7ecb9
0x6df7ecbf
0x6dfbb7c1
0x6dfbb7c8
0x6dfbb7d3
0x6dfbb7db
0x6dfbb7ec
0x6dfbb858
0x00000000
0x6dfbb858
0x6dfbb7ee
0x6dfbb7f1
0x6dfbb7f4
0x6dfbb7ff
0x6dfbb850
0x00000000
0x6dfbb850
0x6dfbb80a
0x6dfbb813
0x6dfbb81c
0x6dfbb81d
0x6dfbb822
0x6dfbb825
0x6dfbb828
0x6dfbb831
0x6dfbb832
0x6dfbb837
0x6dfbb840
0x6dfbb842
0x6dfbb845
0x6dfbb848
0x00000000
0x6dfbb848
0x6dfbb7df
0x00000000
0x6dfbb7df
0x6dfbb7cc
0x00000000
0x6dfbb7cc
0x6df7ecc5
0x6df7ecc7
0x6df7eccb
0x6dfbb79b
0x6dfbb79e
0x6dfbb7a4
0x00000000
0x00000000
0x6dfbb7a6
0x6dfbb7a8
0x6dfbb7a8
0x6df7ecd3
0x00000000
0x00000000
0x00000000
0x00000000
0x6df7ecd5
0x6df7ecd5
0x6df7ecd5
0x6df7ecd8
0x6df7ecda
0x6df7ece4
0x00000000
0x00000000
0x6df7ecea
0x6df7eced
0x6df7ecf0
0x6df7ecf2
0x6df7ecfb
0x6df7ecfe
0x6df7ed01
0x6df7ed06
0x00000000
0x00000000
0x00000000
0x6df7ed06
0x6dfbb7ae
0x6dfbb7b1
0x6dfbb7b7
0x00000000
0x00000000
0x6dfbb7b9
0x6dfbb7bb
0x6df7ed08
0x6df7ed08
0x6df7ed0c
0x6df7ed0c
0x00000000
0x6df7ec60
0x6df7ec62
0x6df7ed0f
0x6df7ed0f
0x00000000
0x6df7ed0f
0x6df7ec68
0x6df7ec6c
0x6df7ec6f
0x6df7ec75
0x6df7ec0d
0x6df7ec0d
0x6df7ec18
0x00000000
0x00000000
0x00000000
0x6df7ec18
0x6df7ec77
0x6df7ec79
0x6df7ec79
0x00000000
0x6df7ec68
0x6df7ec5e
0x6df7ec3e
0x6df7ebfd
0x6df7ec02
0x6dfbb701
0x6dfbb70c
0x6dfbb71b
0x6dfbb71d
0x6dfbb71d
0x00000000
0x6dfbb70c
0x6df7ec08
0x6df7ec0a
0x00000000
0x6df7ec0a
0x6df7ebf5
0x6df7ebf5

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 44861e4ce32b3bfc27b79d54f4e60340f59a04cbb57e70eaaef8ef97969a6183
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 5D813B26A582578FE7228E6DE8D02E9BB61FF53300B3889BBD845CB241C235D846D791

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6AB40, Relevance: .2, Instructions: 240
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6DF6AB40(intOrPtr __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				signed short _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr* _v28;
				intOrPtr _t69;
				intOrPtr* _t70;
				intOrPtr _t71;
				intOrPtr _t73;
				void* _t74;
				signed int _t77;
				signed int _t79;
				signed int _t82;
				signed int _t88;
				unsigned int _t97;
				unsigned int _t99;
				unsigned int _t105;
				unsigned int _t107;
				intOrPtr* _t111;
				unsigned int _t118;
				void* _t123;
				intOrPtr _t127;
				signed int _t128;
				void* _t131;
				signed char _t136;
				signed char _t141;
				signed char _t146;
				signed int _t151;
				signed int _t153;
				unsigned int _t155;
				intOrPtr _t158;
				void* _t164;
				signed short _t167;
				void* _t171;
				void* _t173;
				intOrPtr* _t175;
				intOrPtr* _t178;
				signed short _t180;
				signed short _t182;

				_t149 = __ecx;
				_t111 =  *((intOrPtr*)(__edx + 0x18));
				_v24 = __edx;
				_t69 =  *((intOrPtr*)(_t111 + 4));
				_t158 = _a12;
				_v8 = __ecx;
				_v16 = _a8 -  *((intOrPtr*)(__edx + 0x14));
				_v28 = _t111;
				if(_t111 == _t69) {
					L7:
					_t70 = _t111;
					goto L8;
				} else {
					_t127 = _a4;
					if(_t127 == 0) {
						_t171 = _t158 -  *((intOrPtr*)(_t69 + 0x14));
					} else {
						_t182 =  *(_t69 - 8);
						_v20 = _t69 + 0xfffffff8;
						if( *((intOrPtr*)(__ecx + 0x4c)) != 0) {
							_t105 =  *(__ecx + 0x50) ^ _t182;
							_v12 = _t105;
							_t107 = _v12;
							_t146 = _t105 >> 0x00000010 ^ _t105 >> 0x00000008 ^ _t107;
							if(_t107 >> 0x18 != _t146) {
								_push(_t146);
								E6E00A80D(__ecx, _v20, 0, 0);
								_t149 = _v8;
							}
							_t182 = _v12;
							_t127 = _a4;
						}
						_t171 = _t158 - (_t182 & 0x0000ffff);
					}
					if(_t171 <= 0) {
						_t71 =  *_t111;
						if(_t127 == 0) {
							_t173 = _t158 -  *((intOrPtr*)(_t71 + 0x14));
						} else {
							_t180 =  *(_t71 - 8);
							_v20 = _t71 + 0xfffffff8;
							if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
								_t97 =  *(_t149 + 0x50) ^ _t180;
								_v12 = _t97;
								_t99 = _v12;
								_t141 = _t97 >> 0x00000010 ^ _t97 >> 0x00000008 ^ _t99;
								if(_t99 >> 0x18 != _t141) {
									_push(_t141);
									E6E00A80D(_t149, _v20, 0, 0);
									_t149 = _v8;
								}
								_t180 = _v12;
								_t127 = _a4;
							}
							_t173 = _t158 - (_t180 & 0x0000ffff);
						}
						if(_t173 <= 0) {
							return  *_t111;
						} else {
							_t175 = _v24;
							if( *_t175 != 0 || _a8 !=  *((intOrPtr*)(_t175 + 4)) - 1) {
								_t128 = _v16;
								_t73 =  *((intOrPtr*)(_t175 + 0x1c));
								_t151 = _t128 >> 5;
								_t164 = ( *((intOrPtr*)(_t175 + 4)) -  *((intOrPtr*)(_t175 + 0x14)) >> 5) - 1;
								_t118 =  !((1 << (_t128 & 0x0000001f)) - 1) &  *(_t73 + _t151 * 4);
								_t74 = _t73 + _t151 * 4;
								if(1 == 0) {
									while(_t151 <= _t164) {
										_t118 =  *(_t74 + 4);
										_t74 = _t74 + 4;
										_t151 = _t151 + 1;
										if(_t118 == 0) {
											continue;
										} else {
											goto L28;
										}
										goto L51;
									}
									if(_t118 != 0) {
										goto L28;
									} else {
										goto L40;
									}
								} else {
									L28:
									if(_t118 == 0) {
										_t77 = _t118 >> 0x00000010 & 0x000000ff;
										if(_t77 != 0) {
											_t79 = ( *(_t77 + 0x6df284d0) & 0x000000ff) + 0x10;
										} else {
											_t57 = (_t118 >> 0x18) + 0x6df284d0; // 0x10008
											_t79 = ( *_t57 & 0x000000ff) + 0x18;
										}
									} else {
										_t82 = _t118 & 0x000000ff;
										if(_t118 == 0) {
											_t58 = (_t118 >> 0x00000008 & 0x000000ff) + 0x6df284d0; // 0x10008
											_t79 = ( *_t58 & 0x000000ff) + 8;
										} else {
											_t51 = _t82 + 0x6df284d0; // 0x0
											_t79 =  *_t51 & 0x000000ff;
										}
									}
									_t153 = (_t151 << 5) + _t79;
									if( *((intOrPtr*)(_t175 + 8)) != 0) {
										_t153 = _t153 + _t153;
									}
									_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x20)) + _t153 * 4));
									L8:
									return _t70;
								}
							} else {
								_t88 = _v16;
								if( *((intOrPtr*)(_t175 + 8)) != 0) {
									_t88 = _t88 + _t88;
								}
								_t178 =  *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x20)) + _t88 * 4));
								if(_t111 == _t178) {
									L40:
									return 0;
								} else {
									do {
										if(_t127 == 0) {
											_t131 = _t158 -  *((intOrPtr*)(_t178 + 0x14));
										} else {
											_t167 =  *(_t178 - 8);
											_t123 = _t178 - 8;
											if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
												_t155 =  *(_t149 + 0x50) ^ _t167;
												_t167 = _t155;
												_t136 = _t155 >> 0x00000010 ^ _t155 >> 0x00000008 ^ _t155;
												_t149 = _v8;
												if(_t155 >> 0x18 != _t136) {
													_push(_t136);
													E6E00A80D(_t149, _t123, 0, 0);
													_t149 = _v8;
												}
											}
											_t111 = _v28;
											_t158 = _a12;
											_t131 = _t158 - (_t167 & 0x0000ffff);
										}
										if(_t131 <= 0) {
											return _t178;
										} else {
											goto L24;
										}
										goto L51;
										L24:
										_t178 =  *_t178;
										_t127 = _a4;
									} while (_t111 != _t178);
									goto L40;
								}
							}
						}
					} else {
						goto L7;
					}
				}
				L51:
			}

0x6df6ab4a
0x6df6ab51
0x6df6ab57
0x6df6ab5b
0x6df6ab5e
0x6df6ab61
0x6df6ab64
0x6df6ab67
0x6df6ab6c
0x6df6abbb
0x6df6abbb
0x00000000
0x6df6ab6e
0x6df6ab6e
0x6df6ab73
0x6df6ad70
0x6df6ab79
0x6df6ab79
0x6df6ab83
0x6df6ab86
0x6df6ab8b
0x6df6ab8f
0x6df6ab9a
0x6df6ab9d
0x6df6aba4
0x6dfb242c
0x6dfb2439
0x6dfb243e
0x6dfb243e
0x6df6abaa
0x6df6abad
0x6df6abad
0x6df6abb5
0x6df6abb5
0x6df6abb9
0x6df6abc6
0x6df6abca
0x6df6ad7a
0x6df6abd0
0x6df6abd0
0x6df6abda
0x6df6abdd
0x6df6abe2
0x6df6abe6
0x6df6abf1
0x6df6abf4
0x6df6abfb
0x6dfb2446
0x6dfb2453
0x6dfb2458
0x6dfb2458
0x6df6ac01
0x6df6ac04
0x6df6ac04
0x6df6ac0c
0x6df6ac0c
0x6df6ac10
0x6df6ad6b
0x6df6ac16
0x6df6ac16
0x6df6ac1c
0x6df6aca7
0x6df6acba
0x6df6acbd
0x6df6acc8
0x6df6acc9
0x6df6accc
0x6df6accf
0x6df6ad00
0x6df6ad04
0x6df6ad07
0x6df6ad0a
0x6df6ad0d
0x00000000
0x6df6ad0f
0x00000000
0x6df6ad0f
0x00000000
0x6df6ad0d
0x6df6ad40
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6acd1
0x6df6acd1
0x6df6acd4
0x6df6ad16
0x6df6ad1b
0x6df6ad54
0x6df6ad1d
0x6df6ad20
0x6df6ad27
0x6df6ad27
0x6df6acd6
0x6df6acd6
0x6df6acdb
0x6df6ad32
0x6df6ad39
0x6df6acdd
0x6df6acdd
0x6df6acdd
0x6df6acdd
0x6df6acdb
0x6df6ace7
0x6df6aced
0x6dfb247f
0x6dfb247f
0x6df6acf6
0x6df6abbd
0x6df6abc3
0x6df6abc3
0x6df6ac2b
0x6df6ac2f
0x6df6ac32
0x6dfb2460
0x6dfb2460
0x6df6ac3b
0x6df6ac40
0x6df6ad42
0x6df6ad4a
0x6df6ac46
0x6df6ac46
0x6df6ac48
0x6df6ad5b
0x6df6ac4e
0x6df6ac4e
0x6df6ac51
0x6df6ac58
0x6df6ac5d
0x6df6ac66
0x6df6ac6d
0x6df6ac74
0x6df6ac77
0x6dfb2467
0x6dfb2472
0x6dfb2477
0x6dfb2477
0x6df6ac77
0x6df6ac7d
0x6df6ac83
0x6df6ac88
0x6df6ac88
0x6df6ac8c
0x6df6aca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6ac8e
0x6df6ac8e
0x6df6ac90
0x6df6ac93
0x00000000
0x6df6ac46
0x6df6ac40
0x6df6ac1c
0x00000000
0x00000000
0x00000000
0x6df6abb9
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f314cc4db89bdb6ae9c7dc425754fc1d8adaef0c4fc7384c4a91e397b77d00
Instruction ID: ba29202f18bea7d70e1e79d3b8a853ed55d349a261cc966489c3793e716bac1d
Opcode Fuzzy Hash: b9f314cc4db89bdb6ae9c7dc425754fc1d8adaef0c4fc7384c4a91e397b77d00
Instruction Fuzzy Hash: 1781F432A0026A8BDB14CE5DC890F7AB7F1FF85315F158299D991AFB81D631ED41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401288, Relevance: .2, Instructions: 239
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401288(void* __eax, void* __ebx, void* __edx, void* __esi, void* __eflags, void* _a41, void* _a118, void* _a669621392, void* _a669621401, void* _a2055559324) {
				void* _v3;
				void* _v16;
				void* _v763725015;
				void* __edi;
				void* __ebp;
				intOrPtr _t105;
				void* _t114;
				void* _t120;
				void* _t123;
				void* _t128;
				signed int _t129;
				void* _t131;

				_t131 = __eflags;
				_t123 = __esi;
				_t114 = __ebx;
				_t129 = _t128 - 0xc;
				while(1) {
					L1:
					asm("in al, dx");
					_push(_t123);
					_push(_t120);
					L00401184(_t114, _t120, _t123, _t131);
					asm("cmpsb");
					L8:
					while(1) {
						if(_t131 >= 0) {
							asm("sbb al, 0xed");
							asm("in eax, dx");
							asm("movsb");
							_push(0x3960a6d9);
							asm("movsb");
							 *(_t123 + 0x7b7a3d50) =  *(_t123 + 0x7b7a3d50) & _t129;
							asm("lds eax, [0x1cd2d2d2]");
							asm("in al, 0xa0");
							_push(0xa425a4d9);
							asm("xlatb");
							asm("in al, dx");
							asm("iretd");
							asm("das");
						}
						if(_t131 > 0) {
							goto L1;
						}
						if(_t131 < 0) {
							continue;
						}
						_t105 =  *0x2947d578;
					}
				}
			}

0x00401288
0x00401288
0x00401288
0x0040128b
0x0040128c
0x0040128c
0x0040128c
0x0040128f
0x00401290
0x004012b9
0x004012be
0x00000000
0x004012bf
0x004012bf
0x004012c1
0x004012c2
0x004012c3
0x004012c4
0x004012c9
0x004012cd
0x004012d3
0x004012d9
0x004012db
0x004012e0
0x004012e1
0x004012e2
0x004012e3
0x004012e4
0x004012e6
0x00000000
0x00000000
0x004012e8
0x00000000
0x00000000
0x004012ea
0x004012ea
0x004012bf

Memory Dump Source

Source File: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaaf2fda476c8e61f8780dd90a6173705b5f927dd66be8e17bfda5bef6c68809
Instruction ID: d957e6299fe8a0a76a59b581a8b128a83fac2cb8ffa1355c853da5db2a87d4ac
Opcode Fuzzy Hash: eaaf2fda476c8e61f8780dd90a6173705b5f927dd66be8e17bfda5bef6c68809
Instruction Fuzzy Hash: 707100A101D2C59BDB228A74998A5D23F909E5635432C09BBD9C2FBDF7C23C5447C31B

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFFA2B, Relevance: .2, Instructions: 214
COMMONCrypto

Download Yara Rule

C-Code - Quality: 25%

			E6DFFFA2B(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t98;
				signed char _t106;
				intOrPtr _t107;
				signed char _t114;
				signed short _t116;
				signed short _t117;
				signed short _t121;
				signed short _t123;
				signed int* _t127;
				signed int _t128;
				signed int _t130;
				signed short _t134;
				void* _t135;
				signed int* _t136;
				void* _t138;
				signed int _t148;
				signed int _t154;
				signed int _t156;
				signed int _t157;
				intOrPtr _t163;
				intOrPtr _t168;
				void* _t169;

				_t157 = __edx;
				_push(0x2c);
				_push(0x6e020e38);
				_t98 = E6DF9D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t169 - 0x34)) = __edx;
				_t168 = __ecx;
				 *((intOrPtr*)(_t169 - 0x38)) = __ecx;
				 *((intOrPtr*)(_t169 - 0x20)) = 0;
				 *((intOrPtr*)(_t169 - 0x1c)) = 0;
				if( *0x6e037bc8 == 0) {
					 *((intOrPtr*)(_t169 - 4)) = 0;
					_t148 =  *__edx;
					 *(_t169 - 0x2c) = _t148 & 0x0000ffff;
					 *(_t169 - 0x28) = _t148 >> 0x18;
					 *(_t169 - 0x24) = _t148 >> 8;
					_t106 = _t148 >> 0x10;
					if(( *(__ecx + 0x4c) & _t148) == 0) {
						 *((intOrPtr*)(_t169 - 0x1c)) = 0xa;
						if(( *(__ecx + 0x40) & 0x04000000) != 0 ||  *(_t169 - 0x28) == (_t106 ^ _t148 ^  *(_t169 - 0x24))) {
							_t148 =  *(_t169 - 0x2c) & 0x0000ffff;
							 *((intOrPtr*)(_t169 - 0x1c)) = 1;
							_t114 =  *((intOrPtr*)(_t157 + 6));
							if(_t114 == 0) {
								_t163 = _t168;
							} else {
								_t163 = (1 - (_t114 & 0x000000ff) << 0x10) + (_t157 & 0xffff0000);
							}
							 *((intOrPtr*)(_t169 - 0x20)) = _t163;
							_t116 = _t148 & 0x0000ffff;
							if( *((intOrPtr*)(_t163 + 8)) == 0xffeeffee) {
								_t148 =  *((intOrPtr*)(_t157 + 7));
								if(_t148 == 4) {
									L12:
									_t117 = _t116 & 0x0000ffff;
									 *(_t169 - 0x2c) = _t117;
									 *((intOrPtr*)(_t169 - 0x1c)) = 3;
									if(_t148 != 3) {
										 *((intOrPtr*)(_t169 - 0x1c)) = 6;
										_t148 =  *(_t168 + 0x54) & 0x0000ffff;
										 *(_t169 - 0x24) = _t148;
										_push(0);
										_pop(0);
										if(( *(_t157 + 4 + (_t117 & 0x0000ffff) * 8) ^ _t148) ==  *(_t169 - 0x2c)) {
											_t121 = _t148;
											goto L23;
										}
									} else {
										_t148 = _t157 + 8;
										_t130 =  *(_t148 + 0x10);
										if((_t130 & 0x00000fff) == 0 && _t130 >=  *((intOrPtr*)(_t163 + 0x1c)) &&  *((intOrPtr*)(_t148 + 0x14)) +  *(_t148 + 0x10) <=  *((intOrPtr*)(_t163 + 0x28))) {
											 *((intOrPtr*)(_t169 - 0x1c)) = 4;
											_t148 =  *_t148;
											_t134 =  *( *(_t157 + 0xc));
											 *(_t169 - 0x2c) = _t134;
											if(_t134 ==  *((intOrPtr*)(_t148 + 4))) {
												_t135 = _t157 + 8;
												if( *(_t169 - 0x2c) == _t135) {
													 *((intOrPtr*)(_t169 - 0x1c)) = 5;
													_t136 = _t135 + 8;
													 *(_t169 - 0x2c) = _t136;
													_t148 =  *_t136;
													_t138 =  *(_t136[1]);
													if(_t138 ==  *((intOrPtr*)(_t148 + 4)) && _t138 ==  *(_t169 - 0x2c)) {
														_t121 =  *(_t168 + 0x54) & 0x0000ffff;
														 *(_t169 - 0x24) = _t121;
														L23:
														 *((intOrPtr*)(_t169 - 0x1c)) = 7;
														_t148 =  *(_t157 + 4) & 0x0000ffff;
														if(_t121 == _t148) {
															L31:
															 *((intOrPtr*)(_t169 - 0x1c)) = 8;
															if(( *(_t157 + 2) & 0x00000001) != 0) {
																L34:
																 *((intOrPtr*)(_t169 - 0x1c)) = 9;
															} else {
																_t148 =  *(_t157 + 8);
																_t123 =  *( *(_t157 + 0xc));
																 *(_t169 - 0x2c) = _t123;
																if(_t123 ==  *((intOrPtr*)(_t148 + 4)) &&  *(_t169 - 0x2c) == _t157 + 8) {
																	goto L34;
																}
															}
														} else {
															_t127 = _t157 - ((_t148 ^ _t121 & 0x0000ffff) << 3);
															if( *(_t168 + 0x4c) == 0) {
																_t128 =  *_t127;
																_t154 =  *(_t169 - 0x24) & 0x0000ffff;
															} else {
																_t156 =  *_t127;
																 *(_t169 - 0x30) = _t156;
																if(( *(_t168 + 0x4c) & _t156) == 0) {
																	_t128 = _t156;
																} else {
																	_t128 =  *(_t168 + 0x50) ^ _t156;
																	 *(_t169 - 0x30) = _t128;
																}
																_t154 =  *(_t168 + 0x54) & 0x0000ffff;
															}
															 *(_t169 - 0x24) = _t154;
															_t148 =  *(_t157 + 4) & 0x0000ffff ^  *(_t169 - 0x24);
															if(_t128 == _t148) {
																goto L31;
															}
														}
													}
												}
											}
										}
									}
								} else {
									 *((intOrPtr*)(_t169 - 0x1c)) = 2;
									if(_t157 >=  *((intOrPtr*)(_t163 + 0x1c)) && _t157 <  *((intOrPtr*)(_t163 + 0x28)) &&  *((intOrPtr*)(_t163 + 0x18)) == _t168) {
										goto L12;
									}
								}
							}
						}
					}
					 *((intOrPtr*)(_t169 - 4)) = 0xfffffffe;
					if( *(_t168 + 0x4c) != 0) {
						 *(_t157 + 3) =  *(_t157 + 2) ^  *(_t157 + 1) ^  *_t157;
						 *_t157 =  *_t157 ^  *(_t168 + 0x50);
					}
					_t107 =  *((intOrPtr*)(_t169 - 0x1c));
					if(_t107 > 0xa) {
						L45:
						_push(_t148);
						_push(0);
						_push( *((intOrPtr*)(_t169 - 0x1c)));
						_push(_t157);
						_push(2);
						goto L46;
					} else {
						switch( *((intOrPtr*)(( *(_t107 + 0x6dfffcfb) & 0x000000ff) * 4 +  &M6DFFFCE3))) {
							case 0:
								_push(_t148);
								_push(0);
								_push( *((intOrPtr*)(_t169 - 0x1c)));
								_push(_t157);
								_push(3);
								goto L46;
							case 1:
								_push(__ecx);
								_push(__ebx);
								_push( *((intOrPtr*)(__edi + 0x18)));
								_push(__edx);
								_push(0xc);
								goto L46;
							case 2:
								_push(__ecx);
								_push(__ebx);
								_push(3);
								_push(__edx);
								__ecx = 0;
								goto L47;
							case 3:
								_push(__ecx);
								_push(__ebx);
								_push( *((intOrPtr*)(__ebp - 0x1c)));
								_push(__edx);
								_push(0xe);
								goto L46;
							case 4:
								_push(__ecx);
								_push(__ebx);
								_push(8);
								_push(__edx);
								_push(0xd);
								L46:
								goto L47;
							case 5:
								goto L45;
						}
					}
					L47:
					_t98 = E6E00A80D(_t168);
				}
				return E6DF9D0D1(_t98);
			}

0x6dfffa2b
0x6dfffa2b
0x6dfffa2d
0x6dfffa32
0x6dfffa37
0x6dfffa3a
0x6dfffa3c
0x6dfffa43
0x6dfffa46
0x6dfffa4f
0x6dfffa55
0x6dfffa58
0x6dfffa5d
0x6dfffa65
0x6dfffa6d
0x6dfffa72
0x6dfffa78
0x6dfffa7e
0x6dfffa8c
0x6dfffaa2
0x6dfffaa7
0x6dfffaaa
0x6dfffaaf
0x6dfffac4
0x6dfffab1
0x6dfffac0
0x6dfffac0
0x6dfffac8
0x6dfffacb
0x6dfffad5
0x6dfffadb
0x6dfffae1
0x6dfffb05
0x6dfffb05
0x6dfffb08
0x6dfffb0b
0x6dfffb15
0x6dfffb98
0x6dfffb9f
0x6dfffba5
0x6dfffbb4
0x6dfffbb6
0x6dfffbb7
0x6dfffbbd
0x00000000
0x6dfffbbd
0x6dfffb17
0x6dfffb17
0x6dfffb1a
0x6dfffb22
0x6dfffb40
0x6dfffb47
0x6dfffb4c
0x6dfffb4e
0x6dfffb54
0x6dfffb5a
0x6dfffb60
0x6dfffb66
0x6dfffb6d
0x6dfffb70
0x6dfffb73
0x6dfffb78
0x6dfffb7d
0x6dfffb8c
0x6dfffb90
0x6dfffbbf
0x6dfffbbf
0x6dfffbc6
0x6dfffbcd
0x6dfffc18
0x6dfffc18
0x6dfffc23
0x6dfffc3d
0x6dfffc3d
0x6dfffc25
0x6dfffc25
0x6dfffc2b
0x6dfffc2d
0x6dfffc33
0x00000000
0x00000000
0x6dfffc33
0x6dfffbcf
0x6dfffbd9
0x6dfffbdf
0x6dfffc00
0x6dfffc06
0x6dfffbe1
0x6dfffbe1
0x6dfffbe3
0x6dfffbe9
0x6dfffbf5
0x6dfffbeb
0x6dfffbee
0x6dfffbf0
0x6dfffbf0
0x6dfffbf7
0x6dfffbfb
0x6dfffc09
0x6dfffc10
0x6dfffc16
0x00000000
0x00000000
0x6dfffc16
0x6dfffbcd
0x6dfffb7d
0x6dfffb60
0x6dfffb54
0x6dfffb22
0x6dfffae3
0x6dfffae3
0x6dfffaed
0x00000000
0x00000000
0x6dfffaed
0x6dfffae1
0x6dfffad5
0x6dfffa8c
0x6dfffc44
0x6dfffc72
0x6dfffc7c
0x6dfffc82
0x6dfffc82
0x6dfffc84
0x6dfffc8a
0x6dfffcca
0x6dfffcca
0x6dfffccb
0x6dfffccc
0x6dfffccf
0x6dfffcd0
0x00000000
0x6dfffc8c
0x6dfffc93
0x00000000
0x6dfffc9a
0x6dfffc9b
0x6dfffc9c
0x6dfffc9f
0x6dfffca0
0x00000000
0x00000000
0x6dfffca4
0x6dfffca5
0x6dfffca6
0x6dfffca9
0x6dfffcaa
0x00000000
0x00000000
0x6dfffcae
0x6dfffcaf
0x6dfffcb0
0x6dfffcb2
0x6dfffcb3
0x00000000
0x00000000
0x6dfffcb7
0x6dfffcb8
0x6dfffcb9
0x6dfffcbc
0x6dfffcbd
0x00000000
0x00000000
0x6dfffcc1
0x6dfffcc2
0x6dfffcc3
0x6dfffcc5
0x6dfffcc6
0x6dfffcd2
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfffc93
0x6dfffcd3
0x6dfffcd5
0x6dfffcd5
0x6dfffcdf

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4913eb4310e1528a4b93a2f9c925bdbb3ef01de7de5829877590881614d4af8
Instruction ID: 6f099fd23f3ffd0eaf5952abb34a4bb9425741bfd9175ef06ae5998ad8ad4b09
Opcode Fuzzy Hash: c4913eb4310e1528a4b93a2f9c925bdbb3ef01de7de5829877590881614d4af8
Instruction Fuzzy Hash: 34817C7090426A9FDB48CF5DC480ABEF7F2FF49308F10815AE955AB291D374998ACF64

Uniqueness

Uniqueness Score: -1.00%

Function 6E001002, Relevance: .2, Instructions: 198
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6E001002(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _t75;
				intOrPtr* _t76;
				signed int _t77;
				signed short _t78;
				signed short _t80;
				signed int _t81;
				signed short _t82;
				signed short _t83;
				signed short _t85;
				signed int _t86;
				void* _t90;
				signed short _t91;
				signed int _t95;
				signed short _t97;
				signed short _t99;
				intOrPtr* _t101;
				signed short _t102;
				signed int _t103;
				signed short _t105;
				intOrPtr _t106;
				signed int* _t108;
				signed short _t109;
				signed short _t111;
				signed short _t112;
				signed int _t113;
				signed short _t117;
				signed int _t120;
				void* _t121;
				signed int _t122;
				signed int _t126;
				signed int* _t127;
				signed short _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				signed int _t132;
				signed int _t133;

				_t121 = __edx;
				_t130 = __ecx;
				_v16 = __ecx;
				_t108 = __ecx + 0xa4;
				_t75 =  *_t108;
				L4:
				L4:
				if(_t75 != _t108) {
					goto L1;
				} else {
					_t127 = _t130 + 0x9c;
					_t120 =  *_t127;
				}
				while(_t120 != _t127) {
					_t132 = _t120 & 0xffff0000;
					__eflags = _t132 - _t121;
					if(_t132 <= _t121) {
						_t75 =  *((intOrPtr*)(_t120 + 0x14)) + _t132;
						__eflags = _t75 - _t121;
						if(_t75 > _t121) {
							 *0x6e035898 = 5;
						}
					}
					_t120 =  *_t120;
				}
				L68:
				return _t75;
				L1:
				_t3 = _t75 - 0x10; // -16
				_t126 = _t3;
				_v20 = _t126;
				__eflags =  *((intOrPtr*)(_t126 + 0x1c)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x1c)) > _t121) {
					L3:
					_t75 =  *_t75;
					goto L4;
				}
				__eflags =  *((intOrPtr*)(_t126 + 0x28)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x28)) > _t121) {
					_t8 = _t126 + 0x38; // 0x28
					_t101 = _t8;
					_t109 = 0;
					_v8 = _v8 & 0;
					_t76 =  *_t101;
					_v12 = _t101;
					__eflags = _t76 - _t101;
					if(_t76 == _t101) {
						L17:
						_t102 = 0;
						_v20 = 0;
						__eflags = _t109;
						if(_t109 == 0) {
							_t109 = _t126;
						}
						_t128 = 0;
						__eflags = _t109 - _t121;
						if(_t109 >= _t121) {
							L29:
							_t111 = _v8 + 0xfffffff8;
							__eflags = _t111 - _t121;
							if(_t111 <= _t121) {
								L33:
								 *0x6e0358b0 = _t128;
								 *0x6e0358b4 = _t102;
								__eflags = _t128;
								if(_t128 == 0) {
									L42:
									__eflags =  *(_t130 + 0x4c);
									if( *(_t130 + 0x4c) == 0) {
										_t77 =  *_t128 & 0x0000ffff;
										_t112 = 0;
										__eflags = 0;
									} else {
										_t85 =  *_t128;
										_t112 =  *(_t130 + 0x4c);
										__eflags = _t85 & _t112;
										if((_t85 & _t112) != 0) {
											_t85 = _t85 ^  *(_t130 + 0x50);
											__eflags = _t85;
										}
										_t77 = _t85 & 0x0000ffff;
									}
									_v8 = _t77;
									__eflags = _t102;
									if(_t102 != 0) {
										_t117 =  *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t117;
										 *0x6e0358b8 = _t117;
										_t112 =  *(_t130 + 0x4c);
									}
									__eflags = _t112;
									if(_t112 == 0) {
										_t78 =  *_t128 & 0x0000ffff;
									} else {
										_t83 =  *_t128;
										__eflags =  *(_t130 + 0x4c) & _t83;
										if(( *(_t130 + 0x4c) & _t83) != 0) {
											_t83 = _t83 ^  *(_t130 + 0x50);
											__eflags = _t83;
										}
										_t78 = _t83 & 0x0000ffff;
									}
									_t122 = _t78 & 0x0000ffff;
									 *0x6e0358bc = _t122;
									__eflags =  *(_t130 + 0x4c);
									_t113 = _v8 & 0x0000ffff;
									if( *(_t130 + 0x4c) == 0) {
										_t80 =  *(_t128 + _t113 * 8) & 0x0000ffff;
									} else {
										_t82 =  *(_t128 + _t113 * 8);
										__eflags =  *(_t130 + 0x4c) & _t82;
										if(( *(_t130 + 0x4c) & _t82) != 0) {
											_t82 = _t82 ^  *(_t130 + 0x50);
											__eflags = _t82;
										}
										_t122 =  *0x6e0358bc; // 0x0
										_t80 = _t82 & 0x0000ffff;
									}
									_t81 = _t80 & 0x0000ffff;
									__eflags =  *0x6e0358b8 - _t81; // 0x0
									if(__eflags == 0) {
										_t75 =  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t122 - ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75);
										if(_t122 == ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75)) {
											goto L68;
										}
										 *0x6e035898 = 7;
										return _t75;
									} else {
										 *0x6e035898 = 6;
										return _t81;
									}
								}
								__eflags = _t102;
								if(_t102 == 0) {
									goto L42;
								}
								__eflags =  *(_t130 + 0x4c);
								if( *(_t130 + 0x4c) == 0) {
									_t86 =  *_t128 & 0x0000ffff;
								} else {
									_t91 =  *_t128;
									__eflags =  *(_t130 + 0x4c) & _t91;
									if(( *(_t130 + 0x4c) & _t91) != 0) {
										_t91 = _t91 ^  *(_t130 + 0x50);
										__eflags = _t91;
									}
									_t86 = _t91 & 0x0000ffff;
								}
								_v8 = _t86;
								_t90 = _t128 + (_v8 & 0x0000ffff) * 8;
								__eflags = _t90 - _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3);
								if(_t90 == _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3)) {
									goto L42;
								} else {
									 *0x6e035898 = 4;
									return _t90;
								}
							}
							_v20 =  *(_t130 + 0x54) & 0x0000ffff;
							while(1) {
								_t102 = _t111;
								_t95 = ( *(_t111 + 4) ^ _v20) & 0x0000ffff;
								__eflags = _t95;
								if(_t95 == 0) {
									goto L33;
								}
								_t111 = _t111 + _t95 * 0xfffffff8;
								__eflags = _t111 - _t121;
								if(_t111 > _t121) {
									continue;
								}
								goto L33;
							}
							goto L33;
						} else {
							_t103 =  *(_t130 + 0x4c);
							while(1) {
								_t128 = _t109;
								__eflags = _t103;
								if(_t103 == 0) {
									_t97 =  *_t109 & 0x0000ffff;
								} else {
									_t99 =  *_t109;
									_t103 =  *(_t130 + 0x4c);
									__eflags = _t99 & _t103;
									if((_t99 & _t103) != 0) {
										_t99 = _t99 ^  *(_t130 + 0x50);
										__eflags = _t99;
									}
									_t97 = _t99 & 0x0000ffff;
								}
								__eflags = _t97;
								if(_t97 == 0) {
									break;
								}
								_t109 = _t109 + (_t97 & 0x0000ffff) * 8;
								__eflags = _t109 - _t121;
								if(_t109 < _t121) {
									continue;
								}
								break;
							}
							_t102 = _v20;
							goto L29;
						}
					}
					_t133 = _v8;
					do {
						_t105 =  *((intOrPtr*)(_t76 + 0xc)) +  *((intOrPtr*)(_t76 + 8));
						_t129 = _v12;
						__eflags = _t105 - _t121;
						if(_t105 < _t121) {
							__eflags = _t105 - _t109;
							if(_t105 > _t109) {
								_t109 = _t105;
							}
						}
						_t106 =  *((intOrPtr*)(_t76 + 8));
						__eflags = _t106 - _t121;
						if(_t106 > _t121) {
							__eflags = _t133;
							if(_t133 == 0) {
								L14:
								_t18 = _t76 - 8; // -8
								_t133 = _t18;
								goto L15;
							}
							__eflags = _t106 -  *((intOrPtr*)(_t133 + 0x10));
							if(_t106 >=  *((intOrPtr*)(_t133 + 0x10))) {
								goto L15;
							}
							goto L14;
						}
						L15:
						_t76 =  *_t76;
						__eflags = _t76 - _t129;
					} while (_t76 != _t129);
					_t126 = _v20;
					_v8 = _t133;
					_t130 = _v16;
					goto L17;
				}
				goto L3;
			}

0x6e001002
0x6e00100c
0x6e00100f
0x6e001012
0x6e001018
0x00000000
0x6e00102e
0x6e001030
0x00000000
0x6e001032
0x6e001032
0x6e001038
0x6e001038
0x6e00121e
0x6e0011ff
0x6e001205
0x6e001207
0x6e00120c
0x6e00120e
0x6e001210
0x6e001212
0x6e001212
0x6e001210
0x6e00121c
0x6e00121c
0x6e001228
0x6e001228
0x6e00101c
0x6e00101c
0x6e00101c
0x6e00101f
0x6e001022
0x6e001025
0x6e00102c
0x6e00102c
0x00000000
0x6e00102c
0x6e001027
0x6e00102a
0x6e00103f
0x6e00103f
0x6e001042
0x6e001044
0x6e001047
0x6e001049
0x6e00104c
0x6e00104e
0x6e001088
0x6e001088
0x6e00108a
0x6e00108d
0x6e00108f
0x6e001091
0x6e001091
0x6e001093
0x6e001095
0x6e001097
0x6e0010c8
0x6e0010cb
0x6e0010ce
0x6e0010d0
0x6e0010f4
0x6e0010f4
0x6e0010fa
0x6e001100
0x6e001102
0x6e001150
0x6e001150
0x6e001154
0x6e001167
0x6e00116a
0x6e00116a
0x6e001156
0x6e001156
0x6e001158
0x6e00115b
0x6e00115d
0x6e00115f
0x6e00115f
0x6e00115f
0x6e001162
0x6e001162
0x6e00116c
0x6e00116f
0x6e001171
0x6e00117b
0x6e00117b
0x6e00117d
0x6e001183
0x6e001183
0x6e001186
0x6e001188
0x6e001199
0x6e00118a
0x6e00118a
0x6e00118c
0x6e00118f
0x6e001191
0x6e001191
0x6e001191
0x6e001194
0x6e001194
0x6e00119c
0x6e0011a2
0x6e0011a8
0x6e0011ac
0x6e0011af
0x6e0011c7
0x6e0011b1
0x6e0011b1
0x6e0011b4
0x6e0011b7
0x6e0011b9
0x6e0011b9
0x6e0011b9
0x6e0011bc
0x6e0011c2
0x6e0011c2
0x6e0011cb
0x6e0011ce
0x6e0011d4
0x6e0011e7
0x6e0011ed
0x6e0011ef
0x00000000
0x00000000
0x6e0011f1
0x00000000
0x6e0011d6
0x6e0011d6
0x00000000
0x6e0011d6
0x6e0011d4
0x6e001104
0x6e001106
0x00000000
0x00000000
0x6e001108
0x6e00110c
0x6e00111d
0x6e00110e
0x6e00110e
0x6e001110
0x6e001113
0x6e001115
0x6e001115
0x6e001115
0x6e001118
0x6e001118
0x6e001126
0x6e00113a
0x6e00113d
0x6e00113f
0x00000000
0x6e001141
0x6e001141
0x00000000
0x6e001141
0x6e00113f
0x6e0010d6
0x6e0010d9
0x6e0010dd
0x6e0010e3
0x6e0010e6
0x6e0010e9
0x00000000
0x00000000
0x6e0010ee
0x6e0010f0
0x6e0010f2
0x00000000
0x00000000
0x00000000
0x6e0010f2
0x00000000
0x6e001099
0x6e001099
0x6e00109c
0x6e00109c
0x6e00109e
0x6e0010a0
0x6e0010b3
0x6e0010a2
0x6e0010a2
0x6e0010a4
0x6e0010a7
0x6e0010a9
0x6e0010ab
0x6e0010ab
0x6e0010ab
0x6e0010ae
0x6e0010ae
0x6e0010b6
0x6e0010b9
0x00000000
0x00000000
0x6e0010be
0x6e0010c1
0x6e0010c3
0x00000000
0x00000000
0x00000000
0x6e0010c3
0x6e0010c5
0x00000000
0x6e0010c5
0x6e001097
0x6e001050
0x6e001053
0x6e001056
0x6e001059
0x6e00105c
0x6e00105e
0x6e001060
0x6e001062
0x6e001064
0x6e001064
0x6e001062
0x6e001066
0x6e001069
0x6e00106b
0x6e00106d
0x6e00106f
0x6e001076
0x6e001076
0x6e001076
0x00000000
0x6e001076
0x6e001071
0x6e001074
0x00000000
0x00000000
0x00000000
0x6e001074
0x6e001079
0x6e001079
0x6e00107b
0x6e00107b
0x6e00107f
0x6e001082
0x6e001085
0x00000000
0x6e001085
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ba53175ddf3ca0e0df30d34d1f1566b4b76ce8f310c2c25821c695ef040a3b
Instruction ID: 4cd19148c10cf270fd3c37f2dec41be5c0015f35426c98822eeacd8243e3e909
Opcode Fuzzy Hash: 11ba53175ddf3ca0e0df30d34d1f1566b4b76ce8f310c2c25821c695ef040a3b
Instruction Fuzzy Hash: 72718F34A00762CFEB58CFD6C4A077AB3F1FB45349B60486ED89297640D7B1EA58CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E0132A9, Relevance: .1, Instructions: 84
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6E0132A9(void* __ecx, void* __edx, signed int _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _t30;
				unsigned int _t38;
				signed int _t45;
				signed int _t47;
				void* _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				signed int _t56;
				void* _t57;
				signed int _t67;
				signed int _t68;
				signed int _t69;

				_t57 = __edx;
				_t30 = _a4;
				_t48 = __ecx;
				_t67 =  *0x6e036110;
				if(_t30 != __edx) {
					_t50 = _t30 - 8;
					if(( *(__ecx + 0x38) & 0x00000001) != 0 && (_t30 & 0x00000fff) == 0) {
						_t50 = _t50 - 8;
					}
					_t69 = _t50 + (( *_t50 ^ _t67 ^ _t50) >> 0x00000001 & 0x00007fff) * 8;
					L11:
					_t53 = _t57 + (( *(_t57 + 0x14) & 0x0000ffff) + 3) * 8;
					while(_t69 < _t53) {
						_t38 =  *_t69 ^ _t67 ^ _t69;
						if(_t38 >= 0 || ( *(_t69 + 4) & 0x00000200) != 0) {
							_t69 = _t69 + (_t38 >> 0x00000001 & 0x00007fff) * 8;
							continue;
						} else {
							_t68 = _t69 + 8;
							if(( *(_t48 + 0x38) & 0x00000001) != 0) {
								_t45 = _t69 + 0x10;
								if((_t45 & 0x00000fff) == 0) {
									_t68 = _t45;
								}
							}
							_t55 = E6E012540(_t48, _t68, _t53, _a16);
							 *_a8 = _t55;
							 *_a12 = ((( *_t69 ^  *0x6e036110 ^ _t69) >> 0x00000001 & 0x00007fff) << 3) - _t55 - 8;
							L17:
							return _t68;
						}
					}
					L16:
					_t68 = 0;
					goto L17;
				}
				_t56 = __ecx + 0x10;
				_t47 =  *_t56 ^ _t56;
				while(_t47 != _t56) {
					if(_t47 == _t57) {
						L6:
						_t69 = _t57 + 0x18;
						goto L11;
					}
					_t47 = _t47 ^  *_t47;
				}
				if(_t47 != _t57) {
					goto L16;
				}
				goto L6;
			}

0x6e0132a9
0x6e0132ae
0x6e0132b2
0x6e0132b6
0x6e0132be
0x6e0132e0
0x6e0132e3
0x6e0132ec
0x6e0132ec
0x6e0132fc
0x6e0132ff
0x6e013306
0x6e013326
0x6e01330f
0x6e013311
0x6e013323
0x00000000
0x6e013335
0x6e013339
0x6e01333c
0x6e01333e
0x6e013346
0x6e013348
0x6e013348
0x6e013346
0x6e013359
0x6e013371
0x6e01337b
0x6e01332c
0x6e013332
0x6e013332
0x6e013311
0x6e01332a
0x6e01332a
0x00000000
0x6e01332a
0x6e0132c0
0x6e0132c5
0x6e0132cf
0x6e0132cb
0x6e0132d7
0x6e0132d7
0x00000000
0x6e0132d7
0x6e0132cd
0x6e0132cd
0x6e0132d5
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bacd3b3f66feffa92fc3e3e7147a3fcfb8cbca185d5ec18e21b6ee98519de552
Instruction ID: d2922dafbe1d9c5da29fcc026667a1d34acd98f4623845e1c020a4b718e1c714
Opcode Fuzzy Hash: bacd3b3f66feffa92fc3e3e7147a3fcfb8cbca185d5ec18e21b6ee98519de552
Instruction Fuzzy Hash: 8D21E7327181064FD718CED9C888BEA77E6FF99710B924578D910CF185DB78E846C790

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44B94, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF44B94(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _t38;
				intOrPtr _t39;
				intOrPtr _t41;
				signed int _t42;
				intOrPtr* _t46;
				intOrPtr* _t47;
				signed short _t50;
				intOrPtr _t51;
				signed int _t52;
				signed int _t54;
				intOrPtr _t56;
				signed int _t57;
				intOrPtr _t58;
				intOrPtr* _t59;

				_t58 = __ecx;
				_t56 =  *[fs:0x30];
				_v20 = __ecx;
				_v16 = _t56;
				if( *((intOrPtr*)(__ecx + 8)) == 0xddeeddee) {
					_t50 =  *(__ecx + 0x24) & 0x0000ffff;
				} else {
					_t50 =  *(__ecx + 0x7c) & 0x0000ffff;
				}
				_t38 =  *(_t56 + 0x88);
				if(_t38 == 0 || _t50 == 0) {
					L8:
					return _t38;
				} else {
					_t54 = _t50 & 0x0000ffff;
					if(_t54 > _t38) {
						goto L8;
					}
					_t51 =  *((intOrPtr*)(_t56 + 0x90));
					_v8 = _t38;
					_t46 = _t51 + _t54 * 4;
					_v12 = _t46;
					_t47 = _t46 + 0xfffffffc;
					_t11 =  &_v8;
					 *_t11 = _v8 - _t54;
					if( *_t11 != 0) {
						_t59 = _v12;
						_t57 = _v8;
						do {
							_t39 =  *_t59;
							_t59 = _t59 + 4;
							 *_t47 = _t39;
							if( *((intOrPtr*)(_t39 + 8)) == 0xddeeddee) {
								_t52 =  *(_t39 + 0x24) & 0x0000ffff;
							} else {
								_t52 =  *(_t39 + 0x7c) & 0x0000ffff;
							}
							E6DF44C73(_t39, _t52, _t52 - 1);
							_t41 =  *_t47;
							if( *((intOrPtr*)(_t41 + 8)) == 0xddeeddee) {
								 *((intOrPtr*)(_t41 + 0x24)) =  *((intOrPtr*)(_t41 + 0x24)) + 0xffff;
							} else {
								 *((intOrPtr*)(_t41 + 0x7c)) =  *((intOrPtr*)(_t41 + 0x7c)) + 0xffff;
							}
							_t47 = _t47 + 4;
							_t57 = _t57 - 1;
						} while (_t57 != 0);
						_t56 = _v16;
						_t58 = _v20;
						_t38 =  *(_t56 + 0x88);
						_t51 =  *((intOrPtr*)(_t56 + 0x90));
					}
					_t42 = _t38 - 1;
					 *(_t56 + 0x88) = _t42;
					 *(_t51 + _t42 * 4) =  *(_t51 + _t42 * 4) & 0x00000000;
					if( *((intOrPtr*)(_t58 + 8)) == 0xddeeddee) {
						 *((short*)(_t58 + 0x24)) = 0;
						return 0;
					}
					 *((short*)(_t58 + 0x7c)) = 0;
					return 0;
				}
			}

0x6df44b9d
0x6df44ba0
0x6df44ba7
0x6df44bb1
0x6df44bb4
0x6dfa0b4d
0x6df44bba
0x6df44bba
0x6df44bba
0x6df44bbe
0x6df44bc6
0x6df44c0c
0x6df44c0c
0x6df44bcd
0x6df44bcd
0x6df44bd2
0x00000000
0x00000000
0x6df44bd4
0x6df44bdb
0x6df44bde
0x6df44be1
0x6df44be4
0x6df44be7
0x6df44be7
0x6df44bea
0x6df44c0d
0x6df44c10
0x6df44c13
0x6df44c13
0x6df44c15
0x6df44c18
0x6df44c21
0x6df44c5f
0x6df44c23
0x6df44c23
0x6df44c23
0x6df44c2a
0x6df44c2f
0x6df44c3d
0x6df44c65
0x6df44c3f
0x6df44c3f
0x6df44c3f
0x6df44c43
0x6df44c46
0x6df44c46
0x6df44c4b
0x6df44c4e
0x6df44c51
0x6df44c57
0x6df44c57
0x6df44bec
0x6df44bed
0x6df44bf4
0x6df44bff
0x6df44c6d
0x00000000
0x6df44c6d
0x6df44c03
0x00000000
0x6df44c03

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be039c21412206f03258b38c48bd730f8b7be0bbe1998d3b1572028778da135b
Instruction ID: ee09c7cb6a956e3ae6e899848c324d28303abc6d115d494009dccf63b99bf5cc
Opcode Fuzzy Hash: be039c21412206f03258b38c48bd730f8b7be0bbe1998d3b1572028778da135b
Instruction Fuzzy Hash: 5831D232904626DFC714CF69C680779F7F4FF48314F18C669C969A7652E7B0A940CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7ABD8, Relevance: .1, Instructions: 70
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6DF7ABD8(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t18;
				signed char _t22;
				intOrPtr _t31;
				signed char _t34;
				signed char _t42;
				unsigned int _t44;
				void* _t49;
				signed int* _t53;

				_push(__ecx);
				_t49 = __ecx;
				_t18 = __ecx + 0xc0;
				_t31 =  *((intOrPtr*)(_t18 + 4));
				while(_t31 != _t18) {
					_t9 = _t31 - 8; // -7
					_t53 = _t9;
					if( *(_t49 + 0x4c) != 0) {
						_t44 =  *(_t49 + 0x50) ^  *_t53;
						 *_t53 = _t44;
						_t38 = _t44 >> 0x00000010 ^ _t44 >> 0x00000008 ^ _t44;
						if(_t44 >> 0x18 != (_t44 >> 0x00000010 ^ _t44 >> 0x00000008 ^ _t44)) {
							E6DFFFA2B(_t31, _t49, _t53, _t49, _t53, __eflags, _t38);
						}
					}
					_t34 =  *_t53 & 0x0000ffff;
					_t18 = 0x200;
					_t42 = _t34 >> 8;
					if(_t34 <= 0x200) {
						__eflags =  *(_t49 + 0x4c);
						if( *(_t49 + 0x4c) != 0) {
							_t53[0] = _t53[0] ^ _t42 ^ _t34;
							_t18 =  *(_t49 + 0x50);
							 *_t53 =  *_t53 ^ _t18;
							__eflags =  *_t53;
						}
						break;
					}
					_t22 = _t53[0];
					if((_t22 & 0x00000008) != 0) {
						__eflags =  *(_t49 + 0x4c);
						if(__eflags != 0) {
							_t53[0] = _t22 ^ _t42 ^ _t34;
							 *_t53 =  *_t53 ^  *(_t49 + 0x50);
							__eflags =  *_t53;
						}
					} else {
						E6DF7AC7B(_t49, _t53);
					}
					_t31 =  *((intOrPtr*)(_t31 + 4));
					_t18 = _t49 + 0xc0;
				}
				return _t18;
			}

0x6df7abe0
0x6df7abe4
0x6df7abe6
0x6df7abec
0x6df7ac0c
0x6df7ac14
0x6df7ac14
0x6df7ac17
0x6df7ac1c
0x6df7ac20
0x6df7ac2c
0x6df7ac33
0x6dfb9f40
0x6dfb9f40
0x6df7ac33
0x6df7ac39
0x6df7ac3c
0x6df7ac44
0x6df7ac4b
0x6df7ac5f
0x6df7ac63
0x6df7ac6c
0x6df7ac6f
0x6df7ac72
0x6df7ac72
0x6df7ac72
0x00000000
0x6df7ac63
0x6df7ac4d
0x6df7ac52
0x6df7abf1
0x6df7abf5
0x6df7abfb
0x6df7ac01
0x6df7ac01
0x6df7ac01
0x6df7ac54
0x6df7ac58
0x6df7ac58
0x6df7ac03
0x6df7ac06
0x6df7ac06
0x6df7ac7a

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction ID: cb7d0a24aaf2c3bb205a2b820b7113f849f6c9cd35784ab7846ffa7f5633651f
Opcode Fuzzy Hash: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction Fuzzy Hash: 1621D531214A46ABDB28CF2DD490AF3B7E5FB9A304F52811BD59987641D720F806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004012E3, Relevance: .0, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E004012E3(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __eflags) {
				intOrPtr _t100;
				intOrPtr _t104;
				void* _t112;
				void* _t119;
				signed int _t126;
				void* _t128;

				L0:
				while(1) {
					L0:
					_t128 = __eflags;
					_t119 = __edi;
					_t112 = __ebx;
					asm("das");
					_t100 =  *0x78a47f39;
					do {
						L12:
						if(_t128 > 0) {
							L1:
							asm("in al, dx");
							_push(0x2d2d2dad);
							_push(_t119);
							L3:
							L2:
							L4:
							L6:
							L5:
							L7:
							_t100 = L00401184(_t112, _t119, 0x2d2d2dad, _t128);
							asm("cmpsb");
							goto L8;
						}
						L13:
						if(_t128 < 0) {
							goto L8;
						}
						L14:
						_t104 =  *0x2947d578;
						L8:
					} while (_t128 < 0);
					asm("sbb al, 0xed");
					L10:
					asm("in eax, dx");
					asm("movsb");
					asm("movsb");
					_t100 = 0x3960a6d9;
					 *0xA8A76AFD =  *0xA8A76AFD & _t126;
					asm("lds eax, [0x1cd2d2d2]");
					asm("in al, 0xa0");
					_push(0xa425a4d9);
					asm("xlatb");
					asm("in al, dx");
					L11:
					asm("iretd");
				}
			}

0x004012e3
0x004012e3
0x004012e3
0x004012e3
0x004012e3
0x004012e3
0x004012e3
0x004012e4
0x004012e6
0x004012e6
0x004012e6
0x0040128c
0x0040128c
0x0040128f
0x00401290
0x004012a2
0x00401297
0x004012a5
0x004012b6
0x004012ab
0x004012b9
0x004012b9
0x004012be
0x00000000
0x004012be
0x004012e8
0x004012e8
0x00000000
0x00000000
0x004012ea
0x004012ea
0x004012bf
0x004012bf
0x004012c1
0x004012c2
0x004012c2
0x004012c3
0x004012c9
0x004012cc
0x004012cd
0x004012d3
0x004012d9
0x004012db
0x004012e0
0x004012e1
0x004012e2
0x004012e2
0x004012e2

Memory Dump Source

Source File: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb2d9a294760455c954de552aa188685b7b1d0a66d5a695b98eb7b602cff671
Instruction ID: cbeb0056c8a616d12674e59a364bb65ad8090c95fb0db89486e6fffec370ebad
Opcode Fuzzy Hash: 1bb2d9a294760455c954de552aa188685b7b1d0a66d5a695b98eb7b602cff671
Instruction Fuzzy Hash: F701D39383E6D197DB25CE7454CD5C17FE04E713983688A5FC4C2FBD66C2264086CB45

Uniqueness

Uniqueness Score: -1.00%

Function 6DF458EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6DF458EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x6e03d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x6df25c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E6DF45943() != 0 &&  *0x6e035320 > 5) {
					E6DFC7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E6DFC7B5E( &_v28, _t28);
					_t11 = L6DFC7B9C(0x6e035320, 0x6df2bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E6DF8B640(_t11, _t17, _v8 ^ _t29, 0x6df2bf15, _t27, _t28);
			}

0x6df458fb
0x6df458fe
0x6df45906
0x6df4590a
0x6df4593c
0x6df4593c
0x6df4590c
0x6df4590c
0x6df45911
0x00000000
0x6df45913
0x6df45913
0x6df45913
0x6df45911
0x6df4591d
0x6dfa1035
0x6dfa103c
0x6dfa103f
0x6dfa1056
0x6dfa1056
0x6df4593b

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7227f0e3b6dc948f5a63df453a9fe90708c9348140710e1dac7641a2d8281719
Instruction ID: 0b3de3b4d374e651c1b2dc3592fc7dbc6185277ae472cf4abee0a207a9add262
Opcode Fuzzy Hash: 7227f0e3b6dc948f5a63df453a9fe90708c9348140710e1dac7641a2d8281719
Instruction Fuzzy Hash: B601F231A045069BDB00EB6CC800ABFBBB8EF45238F568069E9059B349DF30DD01C692

Uniqueness

Uniqueness Score: -1.00%

Function 6DF76B90, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6DF76B90(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _t11;
				signed int _t12;
				intOrPtr _t19;
				void* _t20;
				intOrPtr* _t21;

				_t21 = _a4;
				_t19 =  *_t21;
				if(_t19 != 0) {
					if(_t19 < 0x1fff) {
						_t19 = _t19 + _t19;
					}
					L3:
					 *_t21 = _t19;
					asm("rdtsc");
					_v8 = 0;
					_t12 = _t11 & _t19 - 0x00000001;
					_t20 = _t19 + _t12;
					if(_t20 == 0) {
						L5:
						return _t12;
					} else {
						goto L4;
					}
					do {
						L4:
						asm("pause");
						_t12 = _v8 + 1;
						_v8 = _t12;
					} while (_t12 < _t20);
					goto L5;
				}
				_t12 =  *( *[fs:0x18] + 0x30);
				if( *((intOrPtr*)(_t12 + 0x64)) == 1) {
					goto L5;
				}
				_t19 = 0x40;
				goto L3;
			}

0x6df76b96
0x6df76b99
0x6df76b9d
0x6df76be9
0x6df76beb
0x6df76beb
0x6df76bb3
0x6df76bb3
0x6df76bb5
0x6df76bba
0x6df76bc1
0x6df76bc3
0x6df76bc5
0x6df76be0
0x6df76be0
0x00000000
0x00000000
0x00000000
0x6df76bc7
0x6df76bc7
0x6df76bd0
0x6df76bd5
0x6df76bd6
0x6df76bd9
0x00000000
0x6df76bc7
0x6df76ba5
0x6df76bac
0x00000000
0x00000000
0x6df76bae
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction ID: cbb4a5d5eba549cf4e81373534cc14769aec74e15a78fcd7c655909cc3dc3fb4
Opcode Fuzzy Hash: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction Fuzzy Hash: 4AF04975A04209DFDB68CE4CD690BECB7B5EB46310F2040B9F51A9B700D7399E04DB80

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF6C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E6DF6C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x6df211cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E6E0188F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x6df6c577
0x6df6c57d
0x6df6c581
0x6df6c5b5
0x6df6c5b9
0x6df6c5ce
0x6df6c5ce
0x6df6c5ca
0x00000000
0x6df6c5ca
0x6df6c5c4
0x6df6c5c8
0x00000000
0x00000000
0x00000000
0x6df6c5ad
0x00000000
0x6df6c5af

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56894850159b51ac3a773454a447bc48cdb8310d1a2b983fa5bdc1807f0fdc16
Instruction ID: 2878bc4a8d9f0e2588b896d7aff70f8ae971c684a8e2c81bc82e93612d00ddb0
Opcode Fuzzy Hash: 56894850159b51ac3a773454a447bc48cdb8310d1a2b983fa5bdc1807f0fdc16
Instruction Fuzzy Hash: 09F0F0B38196D29EDB12C35CC810B217FF89B06330F40846BD59587900E3B0DC80C271

Uniqueness

Uniqueness Score: -1.00%

Function 6E002073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6E002073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;

				_t3 = E6DFFFD22(__ecx);
				if( *0x6e03849c == _t3) {
					__eflags = __ecx -  *0x6e038748;
					if(__ecx <=  *0x6e038748) {
						E6E001C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x6e038724 & 0x00000004;
							if(( *0x6e038724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					return E6DFF8DF1(__ebx, 0xc0000374, 0x6e035890, __edi, __ecx,  !( *0x6e038724) >> 0x00000002 & 0x00000001,  !( *0x6e038724) >> 0x00000002 & 0x00000001);
				}
			}

0x6e002078
0x6e002083
0x6e0020a4
0x6e0020aa
0x6e0020ac
0x6e0020b7
0x6e0020ba
0x6e0020bc
0x6e0020c9
0x6e0020c9
0x6e0020d0
0x6e0020d2
0x00000000
0x6e0020d2
0x6e0020be
0x6e0020c3
0x6e0020c5
0x6e0020c7
0x00000000
0x00000000
0x6e0020c7
0x6e0020bc
0x6e0020d4
0x6e002085
0x6e0020a3
0x6e0020a3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionInformationPrintProcessQueryRaiseUniform
String ID:
API String ID: 3936843822-0
Opcode ID: bf59a3ea28f06af452da33863688c127d69db8ab2ae0a63654c5b55862609887
Instruction ID: 698a4d2f591ab63a72d4c6961b809cef546611642249f6ed69a3ef14806c9966
Opcode Fuzzy Hash: bf59a3ea28f06af452da33863688c127d69db8ab2ae0a63654c5b55862609887
Instruction Fuzzy Hash: 8AF0207A4297964AEEA24BE860023D23BE5CB46294B1A08C1D49097247C774CA83CA21

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF44F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E6E0188F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t1 = _t21 + 0x30; // 0x12f
				_t18 = _t1;
				if(E6DF6C5D5(_t1, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x6df21030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x6df44f2e
0x6df44f34
0x6df44f38
0x6dfa0b85
0x6dfa0b85
0x6dfa0b89
0x6dfa0b9a
0x6dfa0b9a
0x6dfa0b9f
0x00000000
0x6dfa0b9f
0x6dfa0b94
0x6dfa0b98
0x00000000
0x00000000
0x00000000
0x6dfa0b98
0x6df44f3e
0x6df44f3e
0x6df44f48
0x00000000
0x6df44f6e
0x00000000
0x6df44f70

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ef14c69cbe300a4ee7c1b3fd9fa011a9222a36475f2084ab365ee7fb483c3b
Instruction ID: dcf8e38a544fa7f7f14ce2d983cb2d258e5a2fea763500d2c75acf06c33131be
Opcode Fuzzy Hash: 30ef14c69cbe300a4ee7c1b3fd9fa011a9222a36475f2084ab365ee7fb483c3b
Instruction Fuzzy Hash: F8F0BE36929686CFD351CB5DD640F2277A8AB047F8F094466D409C7925C7B4EC44C654

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4354C, Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF4354C(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t16;
				void* _t18;
				void* _t19;
				void* _t20;

				_t17 = __ecx;
				_t20 = __ecx;
				if(__ecx == 0 || E6DF6C5D5(__ecx, _t18) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x6df21008 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E6E0188F5(_t16, _t17, _t18, _t19, _t20, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x6df4354c
0x6df43552
0x6df43556
0x6df9fef1
0x6df9fef5
0x6df9ff06
0x6df9ff06
0x6df9ff0b
0x00000000
0x6df9ff0b
0x6df9ff00
0x6df9ff04
0x00000000
0x00000000
0x00000000
0x6df43589
0x00000000
0x6df4358b

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5122457fd818971de450a4860faa0a5fce8d132684a66c75cf085aeafde3ff
Instruction ID: e865f04c38021231464f0b735e9300d7a637fb2e61e56dd1ffb1e92d1811ee55
Opcode Fuzzy Hash: 2d5122457fd818971de450a4860faa0a5fce8d132684a66c75cf085aeafde3ff
Instruction Fuzzy Hash: 8AF0A032D596DA9FE391D76DC144F22BBE8AF01774F258565F8048F902C738DC80C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6E760, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF6E760(void* __ecx, void* __eflags, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t16;
				void* _t18;
				void* _t19;
				void* _t20;

				_t17 = __ecx;
				_t20 = __ecx;
				if(E6DF6C5D5(__ecx, _t18) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x6df211dc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L7:
						E6E0188F5(_t16, _t17, _t18, _t19, _t20, __eflags);
						L8:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L8;
					}
					goto L7;
				} else {
					return 1;
				}
			}

0x6df6e760
0x6df6e766
0x6df6e76f
0x6dfb4014
0x6dfb4018
0x6dfb4029
0x6dfb4029
0x6dfb402e
0x00000000
0x6dfb402e
0x6dfb4023
0x6dfb4027
0x00000000
0x00000000
0x00000000
0x6df6e795
0x00000000
0x6df6e797

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36ceddab141f9542da65c76f258b0a80c9cbc99a15b4406612794ff287886c8
Instruction ID: 25d40c2b796977e1020a60b02d45c40deb3351112b384ed6f5a223e202f6c798
Opcode Fuzzy Hash: f36ceddab141f9542da65c76f258b0a80c9cbc99a15b4406612794ff287886c8
Instruction Fuzzy Hash: 98F0E532558299EFE311D7AEC644B217BE8EB093B8F098465E584C7511C774DC80C674

Uniqueness

Uniqueness Score: -1.00%

Function 00402368, Relevance: .0, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00402368(void* __ebx, signed int __ecx, void* __edi, void* __esi) {
				intOrPtr* _t7;
				void* _t10;
				signed int _t11;

				_t11 = __ecx;
				_t10 = __ebx;
				_pop(_t7);
				 *(__esi + 0x29) =  *(__esi + 0x29) >> __ecx;
				asm("rcr byte [eax-0x3b], cl");
				 *(__esi + 0x6d) =  *(__esi + 0x6d) >> __ecx;
				asm("scasb");
				asm("in eax, 0x81");
				asm("in al, dx");
				asm("adc al, 0x4");
				 *_t7 =  *_t7 + _t7;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				do {
					_t10 = _t10 + _t11;
					_pop(es);
					__ecx = 0x187;
					__eax = L00401184(__ebx, __edi, __esi, __eflags);
					goto 0x2d2d;
					asm("lds ebp, [0x582d2d2d]");
					 *((intOrPtr*)(__ecx + 0x2e)) =  *((intOrPtr*)(__ecx + 0x2e)) - __bl;
					__esi = __esi - __ecx;
					__eflags = __esi;
					asm("cmpsb");
				} while (__eflags >= 0);
				asm("daa");
				__eax = __eax & 0x092dc3ac;
				__eflags = __eax;
				asm("lodsb");
				return __eax;
			}

0x00402368
0x00402368
0x00402368
0x0040236a
0x0040236d
0x00402370
0x00402373
0x004023bd
0x004023bf
0x004023c0
0x004023c2
0x004023c4
0x004023c5
0x004023c6
0x004023cf
0x004023d1
0x004023d3
0x004023e1
0x004023ef
0x004023f4
0x004023fb
0x00402401
0x00402404
0x00402404
0x00402406
0x00402406
0x00402409
0x0040240a
0x0040240a
0x0040240b
0x0040240c

Memory Dump Source

Source File: 00000000.00000002.271809126.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eda75ce641aea6dcfd6ed4f3d36c286803e2087efc9775e828c1c5d95e3d9bc
Instruction ID: d2ffa7145b0f6535eec2dd6daaa2d5950c1d022c21b157d568d1310a96606bf3
Opcode Fuzzy Hash: 4eda75ce641aea6dcfd6ed4f3d36c286803e2087efc9775e828c1c5d95e3d9bc
Instruction Fuzzy Hash: B0E0DF2044D2A4E2E34201304A8C17B2F05DA0631033D08BBEA83B28C284FCE507E35F

Uniqueness

Uniqueness Score: -1.00%

Function 6DF73E70, Relevance: .0, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF73E70(intOrPtr _a4, intOrPtr _a8) {
				void* __ebp;
				void* _t10;
				void* _t12;
				void* _t14;
				void* _t15;

				_t11 = _a4;
				if(_a4 == 0 || _a8 != 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E6E0188F5(_t10, _t11, _t12, _t14, _t15, __eflags);
					return 0xc000000d;
				} else {
					return E6DF737EB(_t10, _t11, 0, _t14, _t15, 0);
				}
			}

0x6df73e75
0x6df73e7a
0x6df73e9c
0x00000000
0x6df73e91
0x00000000
0x6df73e93

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$HeaderImage
String ID:
API String ID: 2000052644-0
Opcode ID: 52c1a01be517ef78f1b4aedf4d3818d09d37ef6852fa5bb60b9eb1c718891785
Instruction ID: 12cddef3a83e26a2bea412c391c068bbb5aa17eabde788b0c2d7432cc064ab50
Opcode Fuzzy Hash: 52c1a01be517ef78f1b4aedf4d3818d09d37ef6852fa5bb60b9eb1c718891785
Instruction Fuzzy Hash: A9E08C31618348ABE720EB5DA088BA577E56B80724F058016E4684B504CB38D8C8CB12

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5AAB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 190d2c44e271318a18eef17efef9845d34b45b88c9b471017e76853ebba41a38
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 19D0C235252E81CFD6168B1DC564B1573E4BB44B44FC50490E9018B661E629E954CA10

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF8D47, Relevance: .0, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DFF8D47() {
				intOrPtr _t5;

				_t5 =  *((intOrPtr*)( *[fs:0x30] + 2));
				if(_t5 == 0) {
					return  *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003;
				}
				return _t5;
			}

0x6dff8d4d
0x6dff8d52
0x00000000
0x6dff8d5d
0x6dff8d60

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0308ce5ee14c24fb886fb9f14b489cdec504b92c80768c2a23305a5c2b521e7
Instruction ID: 2949f75f187d04c92962012696b28fb3e0d8d790a095d4c88eff7e1fccad7521
Opcode Fuzzy Hash: e0308ce5ee14c24fb886fb9f14b489cdec504b92c80768c2a23305a5c2b521e7
Instruction Fuzzy Hash: 7FC09B1F5597C54DCD178F3543127D5BF70DB429D0F1D14C1D4D11F522C1144513D625

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8967A, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4038c921f8f856259cd5d2524086d45f70c91b6f302779a31390465516521f
Instruction ID: 39f1c2aedfde0ff806803b595f1bb7f071e6cba6d623c8310d7d87212c69686c
Opcode Fuzzy Hash: 3a4038c921f8f856259cd5d2524086d45f70c91b6f302779a31390465516521f
Instruction Fuzzy Hash: 59B09BB1D054C5C5E601D7644B087277D1077D0741F26C061D1031A41F4778C491F6B7

Uniqueness

Uniqueness Score: -1.00%

Function 6DF67D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF67D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x6df67d56
0x6df67d5b
0x6df67d60
0x6df67d5d
0x6df67d5d
0x6df67d5d

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 71aad670430e374f15804bf19d540405877fb358dd76c06d05094d0ce51dc94e
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 08B092343019818FDE06DF18C080B1533F4BB44B40B8404D0E800CBE20D229E8008900

Uniqueness

Uniqueness Score: -1.00%

Function 6DF895F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6b2b0b89b9bfcf5c514e90c7c8526b11cd30afcc33bf5cd526ac729221d624
Instruction ID: 08a0163c9ec493072b0c1ebb5aca38c388848145dfbb14f3426c7abbbf204435
Opcode Fuzzy Hash: ba6b2b0b89b9bfcf5c514e90c7c8526b11cd30afcc33bf5cd526ac729221d624
Instruction Fuzzy Hash: DB9002B160100802E105615D4D04686040557D0341F61C021A6015E15E96B58C927272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89DE0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48aca9a05c5d42a04d4220ed0997600f087229fe8e940f00c80f9a1ab4262da4
Instruction ID: e142f2e4281e817a30f73d6ceb415d884c319cbfdcf1c6c530b88f7b0e0c1b1d
Opcode Fuzzy Hash: 48aca9a05c5d42a04d4220ed0997600f087229fe8e940f00c80f9a1ab4262da4
Instruction Fuzzy Hash: F39002A161114002E211615D8904706040567D0241F61C021A0805D18DC9A58CA263B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF895D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cf1a0ea8259cbe648f5135b476a1de2788884b0d3ea0a14e69100160eb47db
Instruction ID: bd2871ab5c48765a6085769c3ed67b125a260c6c6800175f94be7d1645d33570
Opcode Fuzzy Hash: 43cf1a0ea8259cbe648f5135b476a1de2788884b0d3ea0a14e69100160eb47db
Instruction Fuzzy Hash: B69002E1602000035106715D4914616440A57E0241B61C031E1005D50DC5758C927276

Uniqueness

Uniqueness Score: -1.00%

Function 6DF895C0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db758df206af2662e001c4473f38b0d2ac638da2be48be0a9540374f000901e
Instruction ID: 23df1c50b2668ba6bb1423f903d58921e5667f4a6d4ba5c288a0fc8bef1b67d5
Opcode Fuzzy Hash: 0db758df206af2662e001c4473f38b0d2ac638da2be48be0a9540374f000901e
Instruction Fuzzy Hash: 6A9002A1A01044425151715D4904606440567E0255761C121E0446D10CC5A9CC9663B6

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89DB0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9d27a83203ec8e253b036f86df601bcaf80c4ef6286a7c8736e1c8ed32bd78
Instruction ID: d5c6d8c3781e9cbb2335fe31ff74bd6a7ebb1aab1da15b42b6ad02883b9ebc2e
Opcode Fuzzy Hash: dc9d27a83203ec8e253b036f86df601bcaf80c4ef6286a7c8736e1c8ed32bd78
Instruction Fuzzy Hash: 209002B160140402E101615D4944707140567D0341F61C421E0C25D18D8BA58C5373B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF895B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94c888826ad43d14c0434c58f98fc95edc19a2418ce5842b0ca67e9ef67383ad
Instruction ID: 3b05a4d09d318542ff08c404fa2e47716a1c357ba8b38552dd933c61de6822ee
Opcode Fuzzy Hash: 94c888826ad43d14c0434c58f98fc95edc19a2418ce5842b0ca67e9ef67383ad
Instruction Fuzzy Hash: E89002B160100402E101619D4904706040557D0241F61C422E0515D18DC6A58C527672

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89DA0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da28e368acbc2923df1e9c025747b255f1fa75c5a98021ccb190babee4bc2387
Instruction ID: abc8aabc13a4b8a32adc0251f47c9897ceb05a28a8ab9fbfb3b00a8f4ceb96c4
Opcode Fuzzy Hash: da28e368acbc2923df1e9c025747b255f1fa75c5a98021ccb190babee4bc2387
Instruction Fuzzy Hash: C59002A171150002F201615D49147060405A7D1341F61C022E0805D58DC9658C6367B3

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89D70, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8d200a3e0fc12b9c2c511f6c88694f81ca764fe8fc96446f196d7262b19605
Instruction ID: 2d572d4d1a4ea2ef9df5de0b0c9c38ab8cd3ac34d1dcefdd938f5088e325995a
Opcode Fuzzy Hash: ea8d200a3e0fc12b9c2c511f6c88694f81ca764fe8fc96446f196d7262b19605
Instruction Fuzzy Hash: 5C9002E160504442E101615D4904A06040567E0245F71C021A1855D55D8A75CC52B3B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7629de1c73632de78a22fd6405beda424b6408c583054a1b2ab5a9973e7d2f5f
Instruction ID: 5d3da70e1d42770823d7026e10c3643fbe972f9802c817324228c519d9f8425c
Opcode Fuzzy Hash: 7629de1c73632de78a22fd6405beda424b6408c583054a1b2ab5a9973e7d2f5f
Instruction Fuzzy Hash: 0E9002E1601140925501A25D8904B0A490557E0241B61C026E1045D20CC5758C52A276

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8A480, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5552c0007f1a75708ba1aa9b60e21fad4d982c91e5744bbf988548b7fa7d9e2
Instruction ID: 3430c81058b96c4c19609c6fac634784c5a845c030eff86c1d10a2aacd9aaff6
Opcode Fuzzy Hash: f5552c0007f1a75708ba1aa9b60e21fad4d982c91e5744bbf988548b7fa7d9e2
Instruction Fuzzy Hash: 939002A164504142E151625D4908B5E450557E1281FA1C039A0106D54CC9658C567372

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89C70, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43a145de1b89b5054d3f2b8510b7350ede8890af5e7402c611ca56b75c5f78a
Instruction ID: 20dadf9535b954870315c10894ae4668ad5709eed78a6aa2f4a7bb371487830f
Opcode Fuzzy Hash: a43a145de1b89b5054d3f2b8510b7350ede8890af5e7402c611ca56b75c5f78a
Instruction Fuzzy Hash: 789002A1A1904082E101616D4904F16040557D02C5F61C125A0085D55CC5799C62A272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89C40, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c3395e3a100a2d15ef97dc92f79550757eeb184fceefbdb5e81a9b0dbeb200
Instruction ID: 4622f71715602631ec2dacff71f28de4ad2b8ef15323ce889ce054096ea9b04a
Opcode Fuzzy Hash: 56c3395e3a100a2d15ef97dc92f79550757eeb184fceefbdb5e81a9b0dbeb200
Instruction Fuzzy Hash: EC9002A1A0504482E501A15D4904B06040557E1281F61C125A1055D15D8779DD52B272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8A420, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5d253a804acdcc1b7481dcbc290130eeafc4b695a6499867bad68aa14031e0
Instruction ID: b129706e495657158f7cc17a333aa37db4fc00382fe2d480ca377d6ed5ca5c7e
Opcode Fuzzy Hash: 7e5d253a804acdcc1b7481dcbc290130eeafc4b695a6499867bad68aa14031e0
Instruction Fuzzy Hash: 5E9002A164505502E111615D4904616040567D0241F61C031A1415D55E86B58C527272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8AFD0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad63deaa3c1b594fad519844dcfe1bf557b2f9049d5429fab66f012af6c43030
Instruction ID: f4ff6f1c182fb2d41af88793c426a3c0889a8c175b29a104acdc2f878c72deed
Opcode Fuzzy Hash: ad63deaa3c1b594fad519844dcfe1bf557b2f9049d5429fab66f012af6c43030
Instruction Fuzzy Hash: 169002B171240002F141715D5D04646441567E1381B61C021A0915D54C85648C566373

Uniqueness

Uniqueness Score: -1.00%

Function 6DF897C0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aaf8284fc9742ec318fe7eea72ec04cdac1765aff89f0a04b75c29070d54b68
Instruction ID: eb16ff9c1fc760dcdcdbf5582880b62d5b83b42f53a6ebdc9b9b308b4a7a0a80
Opcode Fuzzy Hash: 0aaf8284fc9742ec318fe7eea72ec04cdac1765aff89f0a04b75c29070d54b68
Instruction Fuzzy Hash: 2E9002A1A01000825141716D5908906540577E0251761D121A1445D10CC5698C56A3BA

Uniqueness

Uniqueness Score: -1.00%

Function 6DF897A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f25070f4361f8923a2a8432b87f3f005bc40dc461ed216b8ada9f7a8a92d0e6
Instruction ID: 0fa234bd42066c6236875f7d6214c62cdc3ea34cef8100748d22a7ee0fd504c8
Opcode Fuzzy Hash: 2f25070f4361f8923a2a8432b87f3f005bc40dc461ed216b8ada9f7a8a92d0e6
Instruction Fuzzy Hash: 549002A170100003E141715D59186064405A7E1341F61D021E0405D14CD9658C576373

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89F70, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822d5175155a1e7da2a07bb8876e297324a79f60533540961101d696698a362b
Instruction ID: 1f2c81c5d9397ee9d6f3216b34f8b363d05ed0f496994d97734c51a84feba612
Opcode Fuzzy Hash: 822d5175155a1e7da2a07bb8876e297324a79f60533540961101d696698a362b
Instruction Fuzzy Hash: F39002B171514442E101615D4D04B06040657D1246F61C421A0855D58D86B58C52B273

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735b4af5bd76044b27741be3fbe7466924b61f983f62e83e0605f033979282bd
Instruction ID: 3190bd90ad8cc6803571cbbab6fa9060646480e54fe6d5a20cfc20528e920c87
Opcode Fuzzy Hash: 735b4af5bd76044b27741be3fbe7466924b61f983f62e83e0605f033979282bd
Instruction Fuzzy Hash: 739002A160504442E101655D5908A06040557D0245F61D021A1055D55DC6758C52B272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8AF60, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f26299a6936529e51c2b8808157f625eaafbb158a147f52ae891c1c9baa160
Instruction ID: 83d600624e45e6e34ad098a2470c8c4f3df1284a577920fef621336d243528e0
Opcode Fuzzy Hash: 05f26299a6936529e51c2b8808157f625eaafbb158a147f52ae891c1c9baa160
Instruction Fuzzy Hash: C79002B171200403F101615D4E04A47041557D1341F65C421A0815D18D96A48C527273

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89750, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a13f70db274c43101d1a728b8947fe24390819ffdaedf641c946f99eae1c78
Instruction ID: ed4a0b93a42230cebdbaeef769d69afe5d5aaf689454ce53ffff17fc8df68658
Opcode Fuzzy Hash: e9a13f70db274c43101d1a728b8947fe24390819ffdaedf641c946f99eae1c78
Instruction Fuzzy Hash: F49002A160140402E101655D5D08607041557D0342F61D021A1015D15DCA758C527276

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89740, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b7b8215de9a4872bf52613dfe56551437a31888acbfeb168c3da69cc6b31a5
Instruction ID: e32bb63f08f5f903b7637c87d2274f1f6d41f39452bb263afc4fc10800208f2c
Opcode Fuzzy Hash: d4b7b8215de9a4872bf52613dfe56551437a31888acbfeb168c3da69cc6b31a5
Instruction Fuzzy Hash: 1E9002B160104442E511A15D5908706044557D0241F61D421A1415D18DC6B58C52B272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7189330c64d1e5594d98f7df417b32dfaf17cb11345e960487a80ac558014a53
Instruction ID: 5f066d7c708538b5ac92d7e52a971aaa40a46b98ec19b7a5f1430defcaf93068
Opcode Fuzzy Hash: 7189330c64d1e5594d98f7df417b32dfaf17cb11345e960487a80ac558014a53
Instruction Fuzzy Hash: DD9002A1A0500402E141715D5918706041557D0241F61D021A0015D14DC6A98E5677F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a36e4dc4072112b668aab941bac66a125e9abd13516247505e65139983ed4818
Instruction ID: 2d23d7466aec2c759bf29ce5d927574c00a01c4db7cc89950e22c9653d61f2c2
Opcode Fuzzy Hash: a36e4dc4072112b668aab941bac66a125e9abd13516247505e65139983ed4818
Instruction Fuzzy Hash: FE9002B160100402E101659D5908646040557E0341F61D021A5015D15EC6B58C927272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF896E0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0fdadb255b795e2377a24fea36b19c76aa33d04d879d11675b523922d137e2
Instruction ID: e07b3b6c5522acc2ae5b2ef1bfdf506d53bde8362a1ab26c01c2fd320896877a
Opcode Fuzzy Hash: 0d0fdadb255b795e2377a24fea36b19c76aa33d04d879d11675b523922d137e2
Instruction Fuzzy Hash: A79002B160108802E111615D890474A040557D0341F65C421A4415E18D86E58C927272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF896D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7815375c607e04b0c7b630f1dd001aef54d0e26963af92dafd478b9e539a28
Instruction ID: c7aab19a55e6e029183030b936b51b11e8349a00e51659bbf9ea9ccdb6e7f487
Opcode Fuzzy Hash: fd7815375c607e04b0c7b630f1dd001aef54d0e26963af92dafd478b9e539a28
Instruction Fuzzy Hash: 8A9002B160100842E101615D4904B46040557E0341F61C026A0115E14D8665CC527672

Uniqueness

Uniqueness Score: -1.00%

Function 6DF896C0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e26a3af5c862489fc2e5c1a53a8fd84176fd208534eab9786482b2d84865de
Instruction ID: 637b18bda916f529129a7939f333fa4e58d59ce62671091f945da2773ae0b7e8
Opcode Fuzzy Hash: 37e26a3af5c862489fc2e5c1a53a8fd84176fd208534eab9786482b2d84865de
Instruction Fuzzy Hash: 969002B164104842F101615D4904B46140557D0341F65C421A1415E18D86A5CC527276

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8AE70, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e35ff2079e4aa984ad526eea7a1655b93036590bd6f295080d3ba44b71ad93ec
Instruction ID: bf98c9df8451653d649d062952634461ec1e2cebf8ae671c7d7a67f9b5e61930
Opcode Fuzzy Hash: e35ff2079e4aa984ad526eea7a1655b93036590bd6f295080d3ba44b71ad93ec
Instruction Fuzzy Hash: 4A9002B561504442E101615D4D14A8609055BD0345F61C821A0415D5CD86A48C52B272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1a4fba321428ba7ecbfdd5f177c15bdeda4c451caa5bcac69b1d7d91d9a219
Instruction ID: 33b8fa122892091f8b66af96f254fe72b329db663f87f2546fd1080395ab4ce1
Opcode Fuzzy Hash: 1c1a4fba321428ba7ecbfdd5f177c15bdeda4c451caa5bcac69b1d7d91d9a219
Instruction Fuzzy Hash: 7C9002B160504842E141715D4904A46041557D0345F61C021A0055E54D96758D56B7B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89E30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806dfd6382f7064e8704207ca6dddb90aa2c16c1408a0649f5ea4ebc1fe15d4e
Instruction ID: 6876487fede14879d6fdd218445ddcc6c75846a75f28c50bc35d67fcffeb64b6
Opcode Fuzzy Hash: 806dfd6382f7064e8704207ca6dddb90aa2c16c1408a0649f5ea4ebc1fe15d4e
Instruction Fuzzy Hash: 439002A1A0500002E141716D4914706450667E0241F61C431A0405D14D85A58D5667B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89E20, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4e8737c1203f7fd1c3c2407ca255599cf9330bd07eee68bf37ba570119d52d
Instruction ID: 3cfb68e7d1715e0750412274fcbb4f68b15761573582d5dfab8a2eb6f6f57d8e
Opcode Fuzzy Hash: 4e4e8737c1203f7fd1c3c2407ca255599cf9330bd07eee68bf37ba570119d52d
Instruction Fuzzy Hash: D09002A160100012E141716D4904606450577E0241F61C421A0805D14E95A58C566372

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8A9B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd450a12c99e955837ab1a23babc16d3a81b060accd4a1ff4b9c10f28dd68946
Instruction ID: b02f0089b5ef44e893ee96097754f44dadf646e77f6067559a24977eab502ed7
Opcode Fuzzy Hash: dd450a12c99e955837ab1a23babc16d3a81b060accd4a1ff4b9c10f28dd68946
Instruction Fuzzy Hash: 709002B160540402A101615D8D84546040557E1341B61C021E1065D16D8774CC537272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8B1A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad82df796499a58faaddaae55515b9e8934ce1a6099669a37806eabeb873416
Instruction ID: d9a3e77d191f7a50abadd8fb0f2c5c8a38c2d72c174baeafe7fe15af8bfed75a
Opcode Fuzzy Hash: 8ad82df796499a58faaddaae55515b9e8934ce1a6099669a37806eabeb873416
Instruction Fuzzy Hash: 749002B161240442510361DD4E545160415A6D43467A1C821E4516D14D87A0CC577373

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89990, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a71a94d160f87632ebd2a8f587fbc375284f60e38f3353d9548d45581336fd
Instruction ID: d86901a49aa71bd9662a14f2839f31712078c8ae0bceffb51ed36d1ccba2a772
Opcode Fuzzy Hash: 50a71a94d160f87632ebd2a8f587fbc375284f60e38f3353d9548d45581336fd
Instruction Fuzzy Hash: 509002E160100446E101619F5904617040557D0241F61C032A2055D15D86798C527276

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8B180, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22790732c1ceaabb5b1391811b2de4b61a398936c4398ecf7d4e3a8991b4196d
Instruction ID: 4f7b1dbdc54232fe1918b9f83b68b1f8fb523581b5f0b8f48245726a30a81d2e
Opcode Fuzzy Hash: 22790732c1ceaabb5b1391811b2de4b61a398936c4398ecf7d4e3a8991b4196d
Instruction Fuzzy Hash: 929002A1682001036181715D5D4440B440667E23413A1C421E0406D10CC5A8DC566372

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89980, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45435279341edb1a6273a52359de47ef4b54db97efbc9e14e4bbf28bc4d88f80
Instruction ID: 6348a1606efdd28bc475819bd6b760e74ba891719adf80bde302fbd62a1efc99
Opcode Fuzzy Hash: 45435279341edb1a6273a52359de47ef4b54db97efbc9e14e4bbf28bc4d88f80
Instruction Fuzzy Hash: 289002E160100402E142615D490460E040557D1241FA1C425A2056D15DCA798C567376

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8B160, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d1e097bd8497b6b3e7cfcb5327c43ff6f4142822c613bed379f1af88b59fcd
Instruction ID: 966efbaf934b968e07d1160e6d6f14796d90c3ea6a8878e1806d8a0240248337
Opcode Fuzzy Hash: 16d1e097bd8497b6b3e7cfcb5327c43ff6f4142822c613bed379f1af88b59fcd
Instruction Fuzzy Hash: EF9002B164200443B101615D4E04E47041557E0341B61C425A0015D14D9664CC527272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8A160, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf70a744f8c46755e2985d2f0032cb255f5d14f4988c8013ae1078846783b0e
Instruction ID: 1a81aac4d052b526243e9db4804ac7bb1a096c5ca5504e5cd3aa858018d510ff
Opcode Fuzzy Hash: 4bf70a744f8c46755e2985d2f0032cb255f5d14f4988c8013ae1078846783b0e
Instruction Fuzzy Hash: CE9002A561300003F151725D4A04A07040597D0241F61C521A0005E18CD5668C666372

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8B150, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647302c15415041a21c4b50772a9a0f6e369a7d0d9606e68325cccc11e45eedc
Instruction ID: b137de1b7cccf9e36804538414be6a40ace394615b620cff1b6539db44728aa5
Opcode Fuzzy Hash: 647302c15415041a21c4b50772a9a0f6e369a7d0d9606e68325cccc11e45eedc
Instruction Fuzzy Hash: 589002F164240002B201655D4D04946440657E0341B61C431A1005D14C8974DC926676

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8A130, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d352a05d135bc63eabf951ef2334c92abc550ad9084c37fa86627bbf8cc0760
Instruction ID: e22cca0afda421afc0627810ddb882d2575934bb5b60b828cfe823813b822389
Opcode Fuzzy Hash: 3d352a05d135bc63eabf951ef2334c92abc550ad9084c37fa86627bbf8cc0760
Instruction Fuzzy Hash: 019002A1A1600042F101635D4914F0A450597E0241F61C525A0005E14C85A58D5266B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89920, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf68d1f75d130f115e8d387cce7a362ab791c1d12ddc6496736a48c0eb0559c
Instruction ID: 898a29535ae779255f5516bf19dfe2d3dbc17f17d4b018029f62180206b531d3
Opcode Fuzzy Hash: 4bf68d1f75d130f115e8d387cce7a362ab791c1d12ddc6496736a48c0eb0559c
Instruction Fuzzy Hash: 9E9002E170100402E141715D4904606040567D0241FA1C021B1455D14E86A98D5677BA

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89900, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f8ba075066af716a40a1f76261a167874aff8bb5b5974e0858243977eb8212
Instruction ID: 72c8e07e4525517abcf5544e0a518b49783af6e72193a0f14d232c723e5bf914
Opcode Fuzzy Hash: 79f8ba075066af716a40a1f76261a167874aff8bb5b5974e0858243977eb8212
Instruction Fuzzy Hash: 2A9002E160100042E101625D4914B0B450557E0241F61C025A2046D14C85798C5262B6

Uniqueness

Uniqueness Score: -1.00%

Function 6DF898D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357a3c6a283398c061bb6f613981fee26b7fc1f61b87663f839a2770e29d7804
Instruction ID: 66d0781c185de333abfeeb15320115c1eda711e1d23d747d8c20938ca895ba98
Opcode Fuzzy Hash: 357a3c6a283398c061bb6f613981fee26b7fc1f61b87663f839a2770e29d7804
Instruction Fuzzy Hash: 1B9002E160100002E142715D5904706440967E0281FA1C023A0505D14C85658D57A372

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8A0D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb222e9f512ad1e04d3ce48aaed88c131afca66075727be49d78332d79488688
Instruction ID: 2989aa629d20b6e604359e3ef0731f5baeedb4f8825ed13bbe9d33aa678134d5
Opcode Fuzzy Hash: fb222e9f512ad1e04d3ce48aaed88c131afca66075727be49d78332d79488688
Instruction Fuzzy Hash: D79002A160110402E101615D4904706540557D0241F61C022A1115D25D97758C5272B3

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8B0B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7c8e04416a83547a81d69286e6d62cabf7de9222853f35ad1455f752a35315
Instruction ID: 8d84040bddc7b696d91ab6530ef77353752a6f6ee2c1e31db708bc54e5e16115
Opcode Fuzzy Hash: 7d7c8e04416a83547a81d69286e6d62cabf7de9222853f35ad1455f752a35315
Instruction Fuzzy Hash: 9B9002B160550402A141715D4D84546140557D0341B61C021E0025D64D87A48D5777F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8A890, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be21c7d303bae220d234b92e7742645c67e5ee60d1a812cfa086915cba6c35e4
Instruction ID: c665808faa5e8aed01294f5373915281aa52dee767edc5a976489879141adfea
Opcode Fuzzy Hash: be21c7d303bae220d234b92e7742645c67e5ee60d1a812cfa086915cba6c35e4
Instruction Fuzzy Hash: F19002A1601410479141759E5D0444B440567E03427A1C422A4415D10C85648C5BA377

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89890, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0ef2d797786c5fc9f4a29f015e4bc9d7b2d043d705be20fcd826b2171aa260
Instruction ID: 39c2cf388972572aee52337411c81160db626193a9b6024ca8c3324815e71ba5
Opcode Fuzzy Hash: 1f0ef2d797786c5fc9f4a29f015e4bc9d7b2d043d705be20fcd826b2171aa260
Instruction Fuzzy Hash: 559002A5612010461143759E1A44557150596D82C13A1C023F0006D14CCB618C67A372

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89850, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5724737dc98115a5b2c49d32a53ff6d28c3114749dc6caaaeb6839c3018569d6
Instruction ID: cf3309ebeede08958078fca5086fb9c2cc20bfec6e0748856d4f5fb4369c9657
Opcode Fuzzy Hash: 5724737dc98115a5b2c49d32a53ff6d28c3114749dc6caaaeb6839c3018569d6
Instruction Fuzzy Hash: 919002A161140042E102656D4D04B07041957D0382FA1C126A0005D15CC9658D63A272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89840, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7500d72d8c69a3a7ab6efd63421934665f9056e16926641bf4b8a6f38d6b463
Instruction ID: 05efd2900320dfb020324e9e7298c66b4def8512664577cbf76236a77f498cc4
Opcode Fuzzy Hash: b7500d72d8c69a3a7ab6efd63421934665f9056e16926641bf4b8a6f38d6b463
Instruction Fuzzy Hash: 8E9002A1642041526546B15D4904507440667E02817A1C022A1405D10C85769C57E772

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89830, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d89010f39e501505fec2e28395eac657c1932e54f045b0078e5c874ef76f4a1
Instruction ID: 6a95246b24747b4b0cb36cef49f39dd74379318a829760c046b026c7e22062d1
Opcode Fuzzy Hash: 3d89010f39e501505fec2e28395eac657c1932e54f045b0078e5c874ef76f4a1
Instruction Fuzzy Hash: FA9002A1A0500402E142715D4954706041957D0281FA1C022A0015D14D86A58F57B7F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89BF0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d5322c7e28460a4886f946949618278c692706f0888fa9653e64462badf4b7
Instruction ID: 8f0da852e04a636794d7f9ffde4a361faa2d426a33bc0116097a0b90f4a84031
Opcode Fuzzy Hash: 44d5322c7e28460a4886f946949618278c692706f0888fa9653e64462badf4b7
Instruction Fuzzy Hash: 269002E1601000025101715D4904516440757E0641F61C431A2006D10D85768CA2727A

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8A3A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb4ebb0e3938a818c11aff0b28b5ddb374bf785e3a2409044130004f8c219dd
Instruction ID: 9f76c76d81318eb6d73beeeabbed31d36b5b0b7c5c249bd7323bea3fd3511443
Opcode Fuzzy Hash: bbb4ebb0e3938a818c11aff0b28b5ddb374bf785e3a2409044130004f8c219dd
Instruction Fuzzy Hash: 259002A170104402E141715D892460A040597D5341F61C421E0016D14D86659D57B7B3

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8AB70, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c5583e17f9acf56f3dfc4117a9fc67bcca6c59bf1de622abd770d6b4b1f7bb
Instruction ID: cbe22ac6d3aeb6842dea384bb85ed7fa74144a62bda030831cb87874709811fb
Opcode Fuzzy Hash: 87c5583e17f9acf56f3dfc4117a9fc67bcca6c59bf1de622abd770d6b4b1f7bb
Instruction Fuzzy Hash: 0A9002E6602044425102615D4D14847440957E0745B61C031A5005D50C85758C52A276

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8AB60, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34cb05dd3d5cf508eb0706aec27d5bd9b74bc21480da4cfb7f75fd887ab23e0
Instruction ID: b86cc0691134f0f9e2e95fc059004ad12717ade2f9a47855a07ea63e59269894
Opcode Fuzzy Hash: a34cb05dd3d5cf508eb0706aec27d5bd9b74bc21480da4cfb7f75fd887ab23e0
Instruction Fuzzy Hash: 889002B1601004035102616E4F04507041597D4B41B61C821A1456D15D97B0CD527272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c3ec0252e5c5b9305cc71393d436c56e2c071748c22028554b697cbdc60e00
Instruction ID: 61f44ddd8448ceb3b6cb09d4e38b0f9de72e4a2982f72573898133fb71d5b382
Opcode Fuzzy Hash: 93c3ec0252e5c5b9305cc71393d436c56e2c071748c22028554b697cbdc60e00
Instruction Fuzzy Hash: 8A9002A164100802E141715D8914707040697D0641F61C021A0015D14D86668D6677F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89AE0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e925ec77884a19b6b89c2a14eebed8f9774628590b832f1d92c1e97e05174f7
Instruction ID: 44488793d28f4e4b0943db615912456e72871de3ee39da544943699228f49441
Opcode Fuzzy Hash: 7e925ec77884a19b6b89c2a14eebed8f9774628590b832f1d92c1e97e05174f7
Instruction Fuzzy Hash: 7D9002B160144402E115615D8D04707040557D0242F61C421A0955D18D86E68D9276B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8AAE0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3d6ea61e648c8834aa68945370390d5c8429cc83d579b9823fded2af7fcf92
Instruction ID: 652dda36fc126ec688e19663fc6365265a14c19127495727f28306104047e9ff
Opcode Fuzzy Hash: 9e3d6ea61e648c8834aa68945370390d5c8429cc83d579b9823fded2af7fcf92
Instruction Fuzzy Hash: 3B9002B1A0140082A115625D4D04A4A454657E0342B61C025A0145D24C85658D9262B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8AAC0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9dcda740d67604bb26b347148cf20491ee697f93455135753a9fc94de3fbc89
Instruction ID: f46a766029435997378f4bfba65b41cd1502fac36dcd95d903833450e31536a4
Opcode Fuzzy Hash: e9dcda740d67604bb26b347148cf20491ee697f93455135753a9fc94de3fbc89
Instruction Fuzzy Hash: 2C9002B160150446A101655D4D04546140557D1342B61C021A1155D25D86748C5272F6

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89AB0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc81d9cca86bc895a87a18edf7e2c7158cb2590539629bd3086a0008052f5f6c
Instruction ID: b7dfa00da11321c524d088b5331cf7b3e13646f337a67810c9d2dd9d566ba3f3
Opcode Fuzzy Hash: fc81d9cca86bc895a87a18edf7e2c7158cb2590539629bd3086a0008052f5f6c
Instruction Fuzzy Hash: C49002A1601404521102615D0A48607040557D4381761C022F1166D21D8772AC537272

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8AA90, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b22cfbe9a07e747ed76577b1de4b7f903cf8ee2f6be9adce4ff1f2b3349e60
Instruction ID: 60f99bce8562d7667f27727f641373f513fcbd7dfabc8a5cc14a3b6edaae5d86
Opcode Fuzzy Hash: 23b22cfbe9a07e747ed76577b1de4b7f903cf8ee2f6be9adce4ff1f2b3349e60
Instruction Fuzzy Hash: 9A9002B1601404C6A141719E5D04646040557D0342B61C022A0156D24D86648D5677B3

Uniqueness

Uniqueness Score: -1.00%

Function 6DF8B280, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9035a9c3646b564f04c64207469b02a5b01661224fcb1cb1ea33f017577ec6
Instruction ID: a1aefd5ac0288c37e7381e11c09077ff380d7f82b0dc0b354fbc2bac3a187d79
Opcode Fuzzy Hash: 4c9035a9c3646b564f04c64207469b02a5b01661224fcb1cb1ea33f017577ec6
Instruction Fuzzy Hash: 999002B160100902A145615D4D0455A040557D1341BA1C022A5017D15DCA748C527372

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89A50, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa23916434921a0eeb0029c202f3d90af362b3e2feca1a697a5bfd690fcef992
Instruction ID: 2986c731240fd4b804bd6121ca35846887f7d77ac92827669e7bfd8ed0637dfe
Opcode Fuzzy Hash: aa23916434921a0eeb0029c202f3d90af362b3e2feca1a697a5bfd690fcef992
Instruction Fuzzy Hash: EE9002A161180042E201656D4D14B07040557D0343F61C125A0145D14CC9658C626672

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89A30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94322282ffa4df9398166ed9f8184dc14cc29a9ae07fee2540196e4fad1f00bb
Instruction ID: 85a3651d8aa1cfa5bd280fa8fef27f4abc8d27df06433213b2413c27f3cfcf02
Opcode Fuzzy Hash: 94322282ffa4df9398166ed9f8184dc14cc29a9ae07fee2540196e4fad1f00bb
Instruction Fuzzy Hash: 7D9002A1E05000425141715D4D14A06440567E0251B61C121A0585D10CC5A98C6667F6

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89A00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bbfc996f4ecb557f1536fb119eed93ce942a37a56b241dfd7b74db185c85329
Instruction ID: a27daec59c49b10b70ea6110d6b699662ce507f698a175f11af667ba44c03616
Opcode Fuzzy Hash: 2bbfc996f4ecb557f1536fb119eed93ce942a37a56b241dfd7b74db185c85329
Instruction Fuzzy Hash: 329002B160140402E101615D4D1470B040557D0342F61C021A1155D15D86758C5276B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF89670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 2352d3bf3ef7c7499e163940b3149a6d4131ac55c61e6525f96289d8e4ab5924
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6DF46CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6DF46CA0(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;
				signed short _t58;
				signed short _t59;
				void* _t60;
				signed short _t61;
				signed short _t62;
				signed short _t63;
				signed short _t69;
				signed short _t73;
				signed short _t74;
				signed short _t75;
				signed int _t82;
				intOrPtr _t83;
				signed short _t84;
				signed short _t86;
				signed short _t87;
				signed int _t88;
				void* _t92;
				signed int _t97;
				short _t98;
				signed short _t99;
				signed short _t101;
				signed short _t102;
				char _t103;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t118;
				intOrPtr* _t122;
				void* _t123;
				void* _t125;
				signed int _t127;
				signed int _t129;
				signed int _t130;
				signed short _t134;
				signed int _t136;
				intOrPtr* _t139;
				void* _t146;

				_t51 = _a4;
				if(_t51 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t52 = 0xc000000d;
				} else {
					_t103 =  *_t51;
					_t97 = 0;
					_v12 = 0;
					_v20 = 0;
					_v5 = _t103;
					_t146 = _t103 - 0x5b;
					if(_t146 == 0) {
						_t51 = _t51 + 1;
						__eflags = _t103 - 0x5b;
					}
					_v6 = _t146 == 0;
					if(E6DF46D10(_t51,  &_v16, _a8) >= 0) {
						_t139 = _v16;
						_t54 = 0xa;
						__eflags =  *_t139 - 0x25;
						if( *_t139 != 0x25) {
							L22:
							__eflags =  *_t139 - 0x5d;
							if( *_t139 != 0x5d) {
								L51:
								_t98 = _v12;
								goto L52;
							} else {
								__eflags = _v5 - 0x5b;
								if(_v5 != 0x5b) {
									goto L6;
								} else {
									_t139 = _t139 + 1;
									_v6 = _t97;
									__eflags =  *_t139 - 0x3a;
									if( *_t139 != 0x3a) {
										goto L51;
									} else {
										_t139 = _t139 + 1;
										_v16 = _t54;
										_t129 = 0x10;
										__eflags =  *_t139 - 0x30;
										if( *_t139 == 0x30) {
											_t28 = _t139 + 1; // 0x4
											_t122 = _t28;
											_v16 = 8;
											_t139 = _t122;
											_t83 =  *_t139;
											__eflags = _t83 - 0x78;
											if(_t83 == 0x78) {
												L28:
												_v16 = _t129;
												_t31 = _t122 + 1; // 0x4
												_t139 = _t31;
											} else {
												__eflags = _t83 - 0x58;
												if(_t83 == 0x58) {
													goto L28;
												}
											}
										}
										_t58 =  *_t139;
										_v5 = _t58;
										__eflags = _t58;
										if(_t58 == 0) {
											goto L51;
										} else {
											_t99 = _v12;
											do {
												_t134 = _t58;
												_t59 = E6DF8CB30(_t58, _t134);
												_pop(_t107);
												__eflags = _t59;
												if(_t59 == 0) {
													L36:
													_t60 = 0x10;
													__eflags = _v16 - _t60;
													if(_v16 != _t60) {
														goto L6;
													} else {
														_t61 = E6DF8CB30(_t60, _t134);
														_pop(_t108);
														__eflags = _t61;
														if(_t61 == 0) {
															goto L6;
														} else {
															_t62 = E6DF8CDD0(_t108, _t134);
															__eflags = _t62;
															if(_t62 == 0) {
																goto L6;
															} else {
																_t63 = E6DF8CB30(_t62, _t134);
																_pop(_t110);
																__eflags = _t63;
																if(_t63 == 0) {
																	L42:
																	_push(0x41);
																} else {
																	_t74 = E6DF8CCE0(_t110, _t134);
																	__eflags = _t74;
																	if(_t74 == 0) {
																		goto L42;
																	} else {
																		_push(0x61);
																	}
																}
																_pop(_t111);
																_t68 = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134;
																__eflags = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 - 0xffff;
																if(((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 > 0xffff) {
																	goto L6;
																} else {
																	_v12 = _v12 << 4;
																	_t69 = E6DF8CB30(_t68, _t134);
																	_pop(_t112);
																	__eflags = _t69;
																	if(_t69 == 0) {
																		L47:
																		_push(0x41);
																	} else {
																		_t73 = E6DF8CCE0(_t112, _t134);
																		__eflags = _t73;
																		if(_t73 == 0) {
																			goto L47;
																		} else {
																			_push(0x61);
																		}
																	}
																	_pop(_t113);
																	asm("cbw");
																	_t114 = 0xa;
																	_t99 = _v12 + _v5 - _t113 + _t114;
																	__eflags = _t99;
																	_v12 = _t99;
																	goto L49;
																}
															}
														}
													}
												} else {
													_t75 = E6DF8CC80(_t107, _t134);
													__eflags = _t75;
													if(_t75 == 0) {
														goto L36;
													} else {
														_t118 = _v16;
														_t130 = _t118 & 0x0000ffff;
														__eflags = _t134 - 0x30 - _t130;
														if(_t134 - 0x30 >= _t130) {
															goto L36;
														} else {
															__eflags = (_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 - 0xffff;
															if((_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 > 0xffff) {
																goto L6;
															} else {
																asm("cbw");
																_t82 = _t118 * _v12 - 0x00000030 + _v5 & 0x0000ffff;
																_v12 = _t82;
																_t99 = _t82;
																goto L49;
															}
														}
													}
												}
												goto L7;
												L49:
												_t139 = _t139 + 1;
												_t58 =  *_t139;
												_v5 = _t58;
												__eflags = _t58;
											} while (_t58 != 0);
											L52:
											__eflags =  *_t139;
											if( *_t139 != 0) {
												goto L6;
											} else {
												__eflags = _v6;
												if(_v6 != 0) {
													goto L6;
												} else {
													 *_a16 = _t98;
													 *_a12 = _v20;
													_t52 = 0;
												}
											}
										}
									}
								}
							}
						} else {
							_t139 = _t139 + 1;
							_t101 =  *_t139;
							_t135 = _t101;
							_t84 = E6DF8CB30(_t54, _t101);
							_pop(_t123);
							__eflags = _t84;
							if(_t84 == 0) {
								goto L6;
							} else {
								_t85 = E6DF8CC80(_t123, _t135);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L6;
								} else {
									__eflags = _t101;
									if(_t101 == 0) {
										L21:
										_t97 = _v12;
										_t54 = 0xa;
										goto L22;
									} else {
										_t136 = _v12;
										while(1) {
											__eflags = _t101 - 0x5d;
											if(_t101 == 0x5d) {
												goto L21;
											}
											_t102 = _t101;
											_t86 = E6DF8CB30(_t85, _t102);
											_pop(_t125);
											__eflags = _t86;
											if(_t86 == 0) {
												goto L6;
											} else {
												_t87 = E6DF8CC80(_t125, _t102);
												__eflags = _t87;
												if(_t87 == 0) {
													goto L6;
												} else {
													_t88 = _v20;
													_t127 = 0xa;
													_v16 = _t88 * _t127;
													asm("cdq");
													_v16 = _v16 + _t102;
													asm("adc ecx, edx");
													_t92 = _v16 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t88 * _t127 >> 0x20 - _t136;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L20:
															_t85 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t139 = _t139 + 1;
															_v20 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t101 =  *_t139;
															__eflags = _t101;
															if(_t101 != 0) {
																continue;
															} else {
																goto L21;
															}
														} else {
															__eflags = _t92 - 0xffffffff;
															if(_t92 > 0xffffffff) {
																goto L6;
															} else {
																goto L20;
															}
														}
													}
												}
											}
											goto L7;
										}
										goto L21;
									}
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t52;
			}

0x6df46ca5
0x6df46cb0
0x6df46cef
0x6df46cef
0x6df46cc4
0x6df46cc4
0x6df46cc6
0x6df46cc8
0x6df46ccb
0x6df46cce
0x6df46cd1
0x6df46cd4
0x6df46cfd
0x6df46cfe
0x6df46cfe
0x6df46cdc
0x6df46ce9
0x6dfa1c19
0x6dfa1c1e
0x6dfa1c1f
0x6dfa1c22
0x6dfa1cc3
0x6dfa1cc3
0x6dfa1cc6
0x6dfa1e20
0x6dfa1e20
0x00000000
0x6dfa1ccc
0x6dfa1ccc
0x6dfa1cd0
0x00000000
0x6dfa1cd6
0x6dfa1cd6
0x6dfa1cd7
0x6dfa1cda
0x6dfa1cdd
0x00000000
0x6dfa1ce3
0x6dfa1ce3
0x6dfa1ce4
0x6dfa1ce9
0x6dfa1cea
0x6dfa1ced
0x6dfa1cef
0x6dfa1cef
0x6dfa1cf2
0x6dfa1cf9
0x6dfa1cfb
0x6dfa1cfd
0x6dfa1cff
0x6dfa1d05
0x6dfa1d05
0x6dfa1d08
0x6dfa1d08
0x6dfa1d01
0x6dfa1d01
0x6dfa1d03
0x00000000
0x00000000
0x6dfa1d03
0x6dfa1cff
0x6dfa1d0b
0x6dfa1d0d
0x6dfa1d10
0x6dfa1d12
0x00000000
0x6dfa1d18
0x6dfa1d18
0x6dfa1d1c
0x6dfa1d1c
0x6dfa1d20
0x6dfa1d25
0x6dfa1d26
0x6dfa1d28
0x6dfa1d76
0x6dfa1d78
0x6dfa1d79
0x6dfa1d7d
0x00000000
0x6dfa1d83
0x6dfa1d84
0x6dfa1d89
0x6dfa1d8a
0x6dfa1d8c
0x00000000
0x6dfa1d92
0x6dfa1d93
0x6dfa1d99
0x6dfa1d9b
0x00000000
0x6dfa1da1
0x6dfa1da2
0x6dfa1da7
0x6dfa1da8
0x6dfa1daa
0x6dfa1dbb
0x6dfa1dbb
0x6dfa1dac
0x6dfa1dad
0x6dfa1db3
0x6dfa1db5
0x00000000
0x6dfa1db7
0x6dfa1db7
0x6dfa1db7
0x6dfa1db5
0x6dfa1dc3
0x6dfa1dc9
0x6dfa1dcb
0x6dfa1dd0
0x00000000
0x6dfa1dd6
0x6dfa1dd6
0x6dfa1ddb
0x6dfa1de0
0x6dfa1de1
0x6dfa1de3
0x6dfa1df4
0x6dfa1df4
0x6dfa1de5
0x6dfa1de6
0x6dfa1dec
0x6dfa1dee
0x00000000
0x6dfa1df0
0x6dfa1df0
0x6dfa1df0
0x6dfa1dee
0x6dfa1dfd
0x6dfa1dfe
0x6dfa1e05
0x6dfa1e09
0x6dfa1e09
0x6dfa1e0c
0x00000000
0x6dfa1e0c
0x6dfa1dd0
0x6dfa1d9b
0x6dfa1d8c
0x6dfa1d2a
0x6dfa1d2b
0x6dfa1d31
0x6dfa1d33
0x00000000
0x6dfa1d35
0x6dfa1d35
0x6dfa1d3b
0x6dfa1d3e
0x6dfa1d40
0x00000000
0x6dfa1d42
0x6dfa1d4d
0x6dfa1d52
0x00000000
0x6dfa1d58
0x6dfa1d5f
0x6dfa1d68
0x6dfa1d6b
0x6dfa1d6e
0x00000000
0x6dfa1d6e
0x6dfa1d52
0x6dfa1d40
0x6dfa1d33
0x00000000
0x6dfa1e10
0x6dfa1e10
0x6dfa1e11
0x6dfa1e13
0x6dfa1e16
0x6dfa1e16
0x6dfa1e24
0x6dfa1e24
0x6dfa1e27
0x00000000
0x6dfa1e2d
0x6dfa1e2d
0x6dfa1e31
0x00000000
0x6dfa1e37
0x6dfa1e3e
0x6dfa1e47
0x6dfa1e49
0x6dfa1e49
0x6dfa1e31
0x6dfa1e27
0x6dfa1d12
0x6dfa1cdd
0x6dfa1cd0
0x6dfa1c28
0x6dfa1c28
0x6dfa1c29
0x6dfa1c2b
0x6dfa1c2f
0x6dfa1c34
0x6dfa1c35
0x6dfa1c37
0x00000000
0x6dfa1c3d
0x6dfa1c3e
0x6dfa1c44
0x6dfa1c46
0x00000000
0x6dfa1c4c
0x6dfa1c4c
0x6dfa1c4e
0x6dfa1cbd
0x6dfa1cbd
0x6dfa1cc2
0x00000000
0x6dfa1c50
0x6dfa1c50
0x6dfa1c53
0x6dfa1c53
0x6dfa1c56
0x00000000
0x00000000
0x6dfa1c58
0x6dfa1c5c
0x6dfa1c61
0x6dfa1c62
0x6dfa1c64
0x00000000
0x6dfa1c6a
0x6dfa1c6b
0x6dfa1c71
0x6dfa1c73
0x00000000
0x6dfa1c79
0x6dfa1c79
0x6dfa1c7e
0x6dfa1c81
0x6dfa1c88
0x6dfa1c89
0x6dfa1c8f
0x6dfa1c91
0x6dfa1c94
0x6dfa1c97
0x6dfa1c99
0x00000000
0x6dfa1c9f
0x6dfa1c9f
0x6dfa1caa
0x6dfa1cb1
0x6dfa1cb3
0x6dfa1cb4
0x6dfa1cb7
0x6dfa1cb9
0x6dfa1cbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfa1ca1
0x6dfa1ca1
0x6dfa1ca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfa1ca4
0x6dfa1c9f
0x6dfa1c99
0x6dfa1c73
0x00000000
0x6dfa1c64
0x00000000
0x6dfa1c53
0x6dfa1c4e
0x6dfa1c46
0x6dfa1c37
0x00000000
0x00000000
0x00000000
0x6df46ce9
0x6df46cf4
0x6df46cfa

APIs

RtlIpv6StringToAddressA.9419(?,00000000,?,00000000), ref: 6DF46CE2

Strings

[, xrefs: 6DFA1CCC

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: f69a0b87dccf5880f300283cd95de0393a40d8df2c9aeafc16c416227de60764
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: 1C714635E08247AAEB019A7CD9607FE7BB4EF06325F19815AF6A0E72C2E734C581C751

Uniqueness

Uniqueness Score: -1.00%

Function 6DF81CC7, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6DF81CC7(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t91;
				intOrPtr _t95;
				short _t96;
				intOrPtr _t104;
				intOrPtr _t111;
				short _t119;
				signed int _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				struct _EXCEPTION_RECORD _t143;
				intOrPtr* _t146;
				void* _t150;

				_t138 = __edx;
				_push(0x154);
				_push(0x6e020348);
				E6DF9D0E8(__ebx, __edi, __esi);
				 *(_t150 - 0xf0) = __edx;
				_t146 = __ecx;
				 *((intOrPtr*)(_t150 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t150 - 0xf8)) =  *((intOrPtr*)(_t150 + 8));
				 *(_t150 - 0xe8) =  *(_t150 + 0xc);
				 *((intOrPtr*)(_t150 - 0xf4)) =  *((intOrPtr*)(_t150 + 0x10));
				 *((intOrPtr*)(_t150 - 0xe4)) = 0;
				 *(_t150 - 0xdc) = 0;
				 *((intOrPtr*)(_t150 - 0xd8)) = 0;
				 *(_t150 - 0xe0) = 0;
				 *((intOrPtr*)(_t150 - 0x140)) = 0x40;
				memset(_t150 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t150 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t150 - 0x160)) = 1;
				_t130 = 7;
				memset(_t150 - 0x15c, 0, _t130 << 2);
				_t143 =  *(_t150 - 0xe8);
				_t91 = E6DF62430(1, _t146, 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
				_t147 = _t91;
				if(_t91 >= 0) {
					if( *0x6e038460 != 0 && ( *(_t150 - 0xe0) & 0x00000001) == 0) {
						_t95 = E6DF62D50(7, 0, 2,  *((intOrPtr*)(_t150 - 0xfc)), _t150 - 0x140);
						_t147 = _t95;
						if(_t95 < 0) {
							goto L1;
						}
						if( *(_t150 - 0x13c) == 1) {
							if(( *(_t150 - 0x118) & 0x00000001) == 0) {
								if(( *(_t150 - 0x118) & 0x00000002) != 0) {
									 *(_t150 - 0x120) = 0xfffffffc;
								}
							} else {
								 *(_t150 - 0x120) =  *(_t150 - 0x120) & 0x00000000;
							}
							_t133 =  *((intOrPtr*)(_t150 - 0x114));
							_t96 =  *((intOrPtr*)(_t133 + 0x5c));
							 *((short*)(_t150 - 0xda)) = _t96;
							 *(_t150 - 0xdc) = _t96;
							 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t133 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
							 *(_t150 - 0xe8) = _t150 - 0xd0;
							 *((short*)(_t150 - 0xea)) = 0xaa;
							_t104 = E6DF54720(_t138,  *(_t150 - 0xf0) & 0x0000ffff, _t150 - 0xec, 2, 0);
							_t147 = _t104;
							if(_t104 < 0 || RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
								goto L1;
							} else {
								 *0x6e03b1e0( *(_t150 - 0x120),  *(_t150 - 0xf0), _t150 - 0xe4);
								_t147 =  *((intOrPtr*)( *0x6e038460))();
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									goto L1;
								}
								_t111 =  *((intOrPtr*)(_t150 - 0xe4));
								if(_t111 == 0xffffffff) {
									L25:
									 *((intOrPtr*)(_t150 - 4)) = 1;
									_t143 =  *0x6e038468;
									if(_t143 != 0) {
										 *0x6e03b1e0(_t111);
										 *_t143();
									}
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									goto L1;
								}
								E6DF5F540(_t150 - 0x164, _t111);
								 *((intOrPtr*)(_t150 - 4)) = 0;
								if( *((intOrPtr*)(_t143 + 4)) != 0) {
									RtlFreeUnicodeString(_t143);
								}
								_t144 =  *((intOrPtr*)(_t150 - 0xfc));
								_t147 = E6DF62430(0,  *((intOrPtr*)(_t150 - 0xfc)), 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									L24:
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									_t111 = E6DFBD704();
									goto L25;
								} else {
									_t147 = E6DF62D50(7, 0, 2, _t144, _t150 - 0x140);
									 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
									if(_t147 < 0) {
										goto L24;
									}
									if( *(_t150 - 0x13c) == 1) {
										_t137 =  *((intOrPtr*)(_t150 - 0x114));
										_t119 =  *((intOrPtr*)(_t137 + 0x5c));
										 *((short*)(_t150 - 0xda)) = _t119;
										 *(_t150 - 0xdc) = _t119;
										 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t137 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
										if(RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
											goto L24;
										}
										_t147 = 0xc0150004;
										L23:
										 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
										goto L24;
									}
									_t147 = 0xc0150005;
									goto L23;
								}
							}
						}
						_t147 = 0xc0150005;
					}
				}
				L1:
				return E6DF9D130(1, _t143, _t147);
			}

0x6df81cc7
0x6df81cc7
0x6df81ccc
0x6df81cd1
0x6df81cd6
0x6df81cdc
0x6df81cde
0x6df81ce7
0x6df81cf0
0x6df81cf9
0x6df81d01
0x6df81d09
0x6df81d0f
0x6df81d15
0x6df81d1b
0x6df81d2f
0x6df81d37
0x6df81d44
0x6df81d4c
0x6df81d55
0x6df81d68
0x6df81d78
0x6df81d7d
0x6df81d81
0x6dfbd4e3
0x6dfbd509
0x6dfbd50e
0x6dfbd512
0x00000000
0x00000000
0x6dfbd51e
0x6dfbd531
0x6dfbd543
0x6dfbd545
0x6dfbd545
0x6dfbd533
0x6dfbd533
0x6dfbd533
0x6dfbd54f
0x6dfbd555
0x6dfbd559
0x6dfbd560
0x6dfbd570
0x6dfbd57c
0x6dfbd587
0x6dfbd5a3
0x6dfbd5a8
0x6dfbd5ac
0x00000000
0x6dfbd5ce
0x6dfbd5e9
0x6dfbd5f1
0x6dfbd5f3
0x6dfbd5fb
0x00000000
0x00000000
0x6dfbd601
0x6dfbd60a
0x6dfbd6e1
0x6dfbd6e1
0x6dfbd6e4
0x6dfbd6ec
0x6dfbd6f1
0x6dfbd6f7
0x6dfbd6f7
0x6dfbd730
0x00000000
0x6dfbd730
0x6dfbd618
0x6dfbd61f
0x6dfbd625
0x6dfbd628
0x6dfbd628
0x6dfbd644
0x6dfbd651
0x6dfbd653
0x6dfbd65b
0x6dfbd6d5
0x6dfbd6d5
0x6dfbd6dc
0x00000000
0x6dfbd65d
0x6dfbd670
0x6dfbd672
0x6dfbd67a
0x00000000
0x00000000
0x6dfbd682
0x6dfbd68b
0x6dfbd691
0x6dfbd695
0x6dfbd69c
0x6dfbd6ac
0x6dfbd6c8
0x00000000
0x00000000
0x6dfbd6ca
0x6dfbd6cf
0x6dfbd6cf
0x00000000
0x6dfbd6cf
0x6dfbd684
0x00000000
0x6dfbd684
0x6dfbd65b
0x6dfbd5ac
0x6dfbd520
0x6dfbd520
0x6dfbd4e3
0x6df81d87
0x6df81d8e

APIs

memset.9419(?,00000000,0000003C,6E020348,00000154,6DF5BC93,02BE0000,?,?,?,.mui,?,?,?,?,?), ref: 6DF81D2F
RtlDosApplyFileIsolationRedirection_Ustr.9419(00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6DF81D78
RtlFindActivationContextSectionString.9419(00000007,00000000,00000002,?,?,00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6DFBD509

Strings

@, xrefs: 6DF81D1B
$, xrefs: 6DF81D37

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationApplyContextFileFindIsolationRedirection_SectionStringUstrmemset
String ID: $$@
API String ID: 2010900335-1194432280
Opcode ID: 4a0d2ac4c1b0ac21cb3ae2a7ec689c1d7f64be793ee51c8a8e918b2c55084cd6
Instruction ID: 8a2d0d7452b7eb26dbae56ddec5ac00ac3e90c4b04df1e9c8b92bb9fed5fa4b6
Opcode Fuzzy Hash: 4a0d2ac4c1b0ac21cb3ae2a7ec689c1d7f64be793ee51c8a8e918b2c55084cd6
Instruction Fuzzy Hash: 8B813D72D006699BDB31CF58CC40BEEB6B8AF49714F0141EAA91DB7280D7709E85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF48EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

RtlpCrackActivationContextStringSectionHeader, xrefs: 6DFA34EC, 6DFA34FA, 6DFA3517, 6DFA3538, 6DFA3548, 6DFA3558, 6DFA3572, 6DFA3589, 6DFA3598
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6DFA354D
SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6DFA34F1
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6DFA355D
SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6DFA358E
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6DFA34FF
SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6DFA3577
SsHd, xrefs: 6DF48F1B
SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6DFA353D
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6DFA359D
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6DFA351C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: 831999781bdfcf7263a5bbe4f829d01e794ab392a786e3721689720c80505e4c
Instruction ID: d391cf1fde45cb67dae08c9861e284f3350c503b775aa5888205d849a0aea73c
Opcode Fuzzy Hash: 831999781bdfcf7263a5bbe4f829d01e794ab392a786e3721689720c80505e4c
Instruction Fuzzy Hash: 55418FB1214216BFE711CE4DCC81D36B7EEEF8575872AC15AB404AA102E772ED4287F1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF631F0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DF631F0(void* __ecx, void __edx, void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v12;
				void _v28;
				signed int _v32;
				void _v36;
				int _v40;
				void _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t80;
				void* _t85;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t95;
				signed int _t96;
				int _t97;
				void* _t99;
				intOrPtr _t100;
				signed int _t106;
				int _t110;
				void _t120;
				void* _t125;
				signed char _t126;
				void* _t127;
				intOrPtr _t128;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				signed int _t139;
				void* _t140;
				signed int _t152;

				_t132 = __edx;
				_v12 =  *0x6e03d360 ^ _t139;
				_t135 = __ecx;
				_t136 = 0;
				_v56 = _a8;
				_t110 =  *(__ecx + 0xc);
				_v52 = __edx;
				_v60 = _a12;
				_v40 = _t110;
				if(_t110 < 0x20 ||  *((intOrPtr*)(__ecx + 4)) < 0x20) {
					_push( *((intOrPtr*)(_t135 + 4)));
					_push(_t110);
					_push(_t135);
					_push("SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu\n");
					goto L50;
				} else {
					if(__edx != 0) {
						_t82 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
							goto L25;
						} else {
							_t132 = 1;
							_t85 = E6DFD444F(_t82, 1, 0x10, _t110);
							_t86 =  *((intOrPtr*)(_t135 + 0x14));
							_push(_t110);
							if(_t85 != 0) {
								_t120 =  *(_t86 + _t135 + 4);
								_t132 = _t120;
								_v44 = _t120;
								_push(0x18);
								_v32 =  *((intOrPtr*)(_t86 + _t135 + 8));
								if(E6DFD444F( *((intOrPtr*)(_t86 + _t135 + 8)), _t120) != 0) {
									_t123 = _v32 + _t135;
									_v32 = 0;
									_v48 = _t123;
									if(_v44 <= 0) {
										goto L25;
									} else {
										_t110 = _v52;
										_v36 = _t123;
										while(1) {
											_t90 = E6DF8F380(_t110, _t123, 0x10);
											_t140 = _t140 + 0xc;
											_t91 = _v32;
											if(_t90 == 0) {
												break;
											}
											_t106 = _t91 + 1;
											_t123 = _v36 + 0x18;
											_v32 = _t106;
											_v36 = _v36 + 0x18;
											if(_t106 < _v44) {
												continue;
											} else {
												goto L25;
											}
											goto L52;
										}
										_t132 = 1;
										_t110 =  *(_v48 + 0x10 + (_t91 + _t91 * 2) * 8);
										if(E6DFD444F(_t110, 1, 0x10,  *(_t135 + 0xc)) != 0) {
											goto L4;
										} else {
											_push(_v40);
											_push(0x10);
											_push(_t110);
											E6DFD5720(0x33, 0, "SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)\n", _v32);
											goto L51;
										}
									}
								} else {
									_push(_t110);
									_push(0x18);
									_push(_v44);
									E6DFD5720(0x33, 0, "SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _v32);
									goto L51;
								}
							} else {
								E6DFD5720(0x33, 0, "SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)\n", _t86);
								goto L51;
							}
						}
					} else {
						_t110 =  *(__ecx + 0x10);
						if(_t110 == 0) {
							L25:
							return E6DF8B640(0xc0150001, _t110, _v12 ^ _t139, _t132, _t135, _t136);
						} else {
							L4:
							_t125 = _t135 + _t110;
							if(_t125 == 0) {
								goto L25;
							} else {
								_t110 =  *(_t125 + 4);
								if(_t110 == 0) {
									goto L25;
								} else {
									_v36 =  *(_t125 + 8);
									_t95 = _t110;
									_t96 = _t95 * 0x10;
									_t152 = _t95 * 0x10 >> 0x20;
									if(_t152 < 0 || _t152 <= 0 && _t96 <= 0xffffffff) {
										_t132 =  *(_t125 + 8);
										_t137 = _t96 + _t132;
										_v48 = _t137;
										_t136 = 0;
										if(_t137 < _t96) {
											goto L47;
										} else {
											_t97 =  *(_t135 + 0xc);
											if(_t132 >= _t97 || _v48 > _t97) {
												goto L48;
											} else {
												_t126 =  *(_t125 + 0xc);
												_t99 = _t132 + _t135;
												if((_t126 & 0x00000002) == 0) {
													_t127 = 0;
													if(_t110 != 0) {
														_t132 = _a4;
														while( *_t99 != _t132) {
															_t127 = _t127 + 1;
															_t99 = _t99 + 0x10;
															if(_t127 < _t110) {
																continue;
															} else {
															}
															goto L17;
														}
														goto L16;
													}
													goto L17;
												} else {
													_t132 =  *_t99;
													_t136 = _a4;
													if(_t136 < _t132) {
														goto L25;
													} else {
														if((_t126 & 0x00000001) != 0) {
															_t136 = _t136 - _t132;
															if(_t136 >= _t110) {
																goto L25;
															} else {
																_t136 = _t99 + (_t136 << 4);
																goto L17;
															}
														} else {
															_v28 = _t136;
															_t99 = bsearch( &_v28, _t99, _t110, 0x10, 0x6df78c30);
															_t140 = _t140 + 0x14;
															L16:
															_t136 = _t99;
															L17:
															if(_t136 == 0) {
																goto L25;
															} else {
																_t100 =  *((intOrPtr*)(_t136 + 4));
																if(_t100 == 0) {
																	goto L25;
																} else {
																	_t128 =  *((intOrPtr*)(_t136 + 8));
																	_t110 =  *(_t135 + 0xc);
																	if(_t128 > 0xffffffff) {
																		L26:
																		_push(_t110);
																		_push(_t128);
																		_push(_t100);
																		_push("SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)\n");
																		L50:
																		_push(0);
																		_push(0x33);
																		E6DFD5720();
																		goto L51;
																	} else {
																		_t132 = _t128 + _t100;
																		if(_t132 < _t128 || _t100 >= _t110 || _t132 > _t110) {
																			goto L26;
																		} else {
																			 *_v56 = _t100 + _t135;
																			 *_v60 =  *((intOrPtr*)(_t136 + 8));
																			_t80 = 0;
																		}
																	}
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t132 = _v36;
										L47:
										_t97 = _v40;
										L48:
										_push(_t97);
										_push(0x10);
										_push(_t110);
										E6DFD5720(0x33, 0, "SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _t132);
										L51:
										_t80 = 0xc0150003;
										L24:
										return E6DF8B640(_t80, _t110, _v12 ^ _t139, _t132, _t135, _t136);
									}
								}
							}
						}
					}
				}
				L52:
			}

0x6df631f0
0x6df631ff
0x6df63205
0x6df6320c
0x6df6320e
0x6df63214
0x6df63217
0x6df6321a
0x6df6321d
0x6df63223
0x6dfad974
0x6dfad977
0x6dfad978
0x6dfad979
0x00000000
0x6df63233
0x6df63235
0x6dfad824
0x6dfad829
0x00000000
0x6dfad82f
0x6dfad832
0x6dfad839
0x6dfad840
0x6dfad843
0x6dfad844
0x6dfad85d
0x6dfad861
0x6dfad867
0x6dfad86c
0x6dfad86e
0x6dfad878
0x6dfad89f
0x6dfad8a1
0x6dfad8a4
0x6dfad8aa
0x00000000
0x6dfad8b0
0x6dfad8b0
0x6dfad8b3
0x6dfad8b6
0x6dfad8ba
0x6dfad8bf
0x6dfad8c4
0x6dfad8c7
0x00000000
0x00000000
0x6dfad8cc
0x6dfad8cd
0x6dfad8d0
0x6dfad8d3
0x6dfad8d9
0x00000000
0x6dfad8db
0x00000000
0x6dfad8db
0x00000000
0x6dfad8d9
0x6dfad8e9
0x6dfad8f0
0x6dfad8fd
0x00000000
0x6dfad903
0x6dfad903
0x6dfad909
0x6dfad90b
0x6dfad916
0x00000000
0x6dfad91b
0x6dfad8fd
0x6dfad87a
0x6dfad87d
0x6dfad87e
0x6dfad880
0x6dfad88d
0x00000000
0x6dfad892
0x6dfad846
0x6dfad850
0x00000000
0x6dfad855
0x6dfad844
0x6df6323b
0x6df6323b
0x6df63240
0x6df6332c
0x6df63341
0x6df63246
0x6df63246
0x6df63246
0x6df6324b
0x00000000
0x6df63251
0x6df63251
0x6df63256
0x00000000
0x6df6325c
0x6df63264
0x6df63267
0x6df63269
0x6df6326b
0x6df6326d
0x6df6327e
0x6df63281
0x6df63284
0x6df63289
0x6df6328e
0x00000000
0x6df63294
0x6df63294
0x6df63299
0x00000000
0x6df632a8
0x6df632a8
0x6df632ab
0x6df632b1
0x6dfad934
0x6dfad938
0x6dfad93e
0x6dfad941
0x6dfad949
0x6dfad94a
0x6dfad94f
0x00000000
0x00000000
0x6dfad951
0x00000000
0x6dfad94f
0x00000000
0x6dfad941
0x00000000
0x6df632b7
0x6df632b7
0x6df632b9
0x6df632be
0x00000000
0x6df632c0
0x6df632c3
0x6dfad920
0x6dfad924
0x00000000
0x6dfad92a
0x6dfad92d
0x00000000
0x6dfad92d
0x6df632c9
0x6df632d5
0x6df632d9
0x6df632de
0x6df632e1
0x6df632e1
0x6df632e3
0x6df632e5
0x00000000
0x6df632e7
0x6df632e7
0x6df632ec
0x00000000
0x6df632ee
0x6df632ee
0x6df632f1
0x6df632f7
0x6df63344
0x6df63344
0x6df63345
0x6df63346
0x6df63347
0x6dfad97e
0x6dfad97e
0x6dfad980
0x6dfad982
0x00000000
0x6df632f9
0x6df632f9
0x6df632fe
0x00000000
0x6df63308
0x6df6330d
0x6df63315
0x6df63317
0x6df63317
0x6df632fe
0x00000000
0x6df632f7
0x6df632ec
0x6df632e5
0x6df632c3
0x6df632be
0x6df632b1
0x6df63299
0x6dfad956
0x6dfad956
0x6dfad959
0x6dfad959
0x6dfad95c
0x6dfad95c
0x6dfad95d
0x6dfad95f
0x6dfad96a
0x6dfad98a
0x6dfad98a
0x6df6331c
0x6df63329
0x6df63329
0x6df6326d
0x6df63256
0x6df6324b
0x6df63240
0x6df63235
0x00000000

APIs

bsearch.9419(00000001,?,00000020,00000010,6DF78C30,00000010,?,C00000E5,00000000,00000030,?,6DF48D70,00000000,?,?,00000030), ref: 6DF632D9
DbgPrintEx.9419(00000033,00000000,SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes),?,?,00000010,?,C00000E5,00000000,00000030,?,6DF48D70,00000000,?,?,00000030), ref: 6DFAD850
DbgPrintEx.9419(00000033,00000000,SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes),?,00000020,00000010,00000030,00000010,?,C00000E5,00000000,00000030,?,6DF48D70,00000000,?), ref: 6DFAD96A
DbgPrintEx.9419(00000033,00000000,SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu,00000001,?,?,C00000E5,00000000,00000030,?,6DF48D70,00000000,?,?,00000030,?), ref: 6DFAD982

Strings

SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes), xrefs: 6DF63347
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6DFAD961
SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes), xrefs: 6DFAD847
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6DFAD884
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes), xrefs: 6DFAD90D
SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu, xrefs: 6DFAD979

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$bsearch
String ID: SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu$SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)$SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)$SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
API String ID: 3813682011-732641482
Opcode ID: 96bda049886818d3474dc980d5b1c6237ac762717b79f8c4f7b29d9fc5d843eb
Instruction ID: 784881ecbbfa7538d63a21884ee7b02eedc0a1830018a8f4250ec9aded06cc62
Opcode Fuzzy Hash: 96bda049886818d3474dc980d5b1c6237ac762717b79f8c4f7b29d9fc5d843eb
Instruction Fuzzy Hash: C881B871E0020AAFEB10CF5CDC81BAEB3B9EB49744F158129E915AB751E771EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF46D10, Relevance: 21.3, APIs: 14, Instructions: 316
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DF46D10(char* _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char** _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _t97;
				char** _t99;
				void* _t108;
				long _t115;
				void* _t118;
				char* _t120;
				char** _t121;
				long _t122;
				long _t123;
				signed int _t124;
				void* _t127;
				void* _t132;
				char* _t134;
				char** _t137;
				intOrPtr _t141;
				intOrPtr _t142;
				signed int _t143;
				char _t146;
				signed int _t151;
				char* _t153;
				intOrPtr* _t155;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				char** _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t175;
				intOrPtr _t177;
				signed int _t179;
				signed int _t180;
				void* _t182;
				void* _t189;

				_t97 = 0;
				_v32 = 0;
				_t170 = 0;
				_v5 = 0;
				_t180 = 0;
				_v28 = 0;
				_t143 = 0;
				_v24 = 0;
				_t179 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_t141 =  *_a4;
				while(_t141 != 0) {
					_t117 = _t97;
					if(_t117 != 0) {
						_t118 = _t117 - 1;
						if(_t118 != 0) {
							_t117 = _t118 == 1;
							if(_t118 == 1) {
								goto L3;
							}
							_t121 = _v20;
							_t177 = _v24;
							L27:
							if(_t177 != 1) {
								L32:
								_t142 = _a12;
								L52:
								_t153 = _v32;
								_t180 = _v12;
								if(_t153 == 0) {
									goto L28;
								}
								if(_t121 != 0) {
									if(_t180 > 3) {
										L14:
										return 0xc000000d;
									}
									_t122 = strtol(_t153, 0, 0xa);
									_t189 = _t189 + 0xc;
									if(_t122 > 0xff) {
										goto L14;
									}
									_t170 = _v20;
									 *(_t170 + _v28 * 2 + _t142 - 1) = _t122;
									L29:
									_t97 = _v24;
									L30:
									_t155 = _a4 + 1;
									_a4 = _t155;
									_t141 =  *_t155;
									_t143 = _v16;
									continue;
								}
								if(_t180 > 4) {
									goto L14;
								}
								_t123 = strtol(_t153, _t121, 0x10);
								_t189 = _t189 + 0xc;
								_t124 = _v28;
								 *((short*)(_t142 + _t124 * 2)) = _t123;
								_v28 = _t124 + 1;
							}
							L28:
							_t170 = _v20;
							goto L29;
						}
						_t185 = _t141;
						_t131 = E6DF8CB30(_t118, _t141);
						_pop(_t161);
						if(_t131 == 0 || E6DF8CC80(_t161, _t185) == 0) {
							_t132 = E6DF8CB30(_t131, _t185);
							_pop(_t162);
							if(_t132 == 0 || E6DF8CDD0(_t162, _t185) == 0) {
								if(_t141 == 0x3a) {
									if(_v20 != 0 || _t179 > 6) {
										L9:
										_t143 = _v16;
										goto L10;
									} else {
										_t134 = _a4 + 1;
										if( *_t134 != 0x3a) {
											_t177 = 0;
											L43:
											_t180 = _v12;
											_t179 = _t179 + 1;
											_t121 = _v20;
											L26:
											_v24 = _t177;
											goto L27;
										}
										_t143 = _v16;
										if(_t143 != 0) {
											L10:
											_t180 = _v12;
											break;
										}
										_t177 = 2;
										_t37 = _t179 + 1; // 0x1
										_a4 = _t134;
										_push(_t177);
										_v16 = _t37;
										_pop(1);
										goto L43;
									}
								}
								if(_t141 != 0x2e) {
									goto L9;
								}
								if(_v5 != 0) {
									goto L9;
								}
								_t137 = _v20;
								if(_t137 > 2 || _t179 > 6) {
									goto L9;
								} else {
									_t121 = _t137 + 1;
									_v20 = _t121;
									_v24 = 0;
									goto L32;
								}
							} else {
								_t170 = _v20;
								_t180 = _v12 + 1;
								_v12 = _t180;
								if(_t170 != 0) {
									_t143 = _v16;
									break;
								}
								_v5 = 1;
								goto L29;
							}
						} else {
							_t180 = _v12 + 1;
							_v12 = _t180;
							goto L28;
						}
					}
					L3:
					if(_t141 == 0x3a) {
						if(_t170 != 0 || _t179 != 0) {
							break;
						} else {
							_t120 = _a4 + 1;
							if( *_t120 != 0x3a) {
								break;
							}
							_t142 = _a12;
							_a4 = _t120;
							_t121 = _v20;
							_v16 = 1;
							_t151 = _v28;
							_t179 = 2;
							 *((short*)(_t142 + _t151 * 2)) = _t170;
							_t175 = _t179;
							_v28 = _t151 + 1;
							_v24 = _t175;
							goto L52;
						}
					}
					if(_t179 > 7) {
						break;
					}
					_t183 = _t141;
					_t126 = E6DF8CB30(_t117, _t141);
					_pop(_t156);
					if(_t126 == 0 || E6DF8CC80(_t156, _t183) == 0) {
						_t127 = E6DF8CB30(_t126, _t183);
						_pop(_t157);
						if(_t127 == 0 || E6DF8CDD0(_t157, _t183) == 0) {
							goto L9;
						} else {
							_t121 = _v20;
							if(_t121 != 0) {
								goto L9;
							}
							_v5 = 1;
							_t177 = 1;
							_v32 = _a4;
							_t180 = 1;
							_v12 = 1;
							goto L26;
						}
					} else {
						_t170 = _v20;
						_v32 = _a4;
						_t97 = 1;
						_v5 = 0;
						_t180 = 1;
						_v24 = 1;
						_v12 = 1;
						goto L30;
					}
				}
				 *_a8 = _a4;
				_t99 = _v20;
				if(_t99 != 0) {
					if(_t99 != 3) {
						goto L14;
					}
					_t179 = _t179 + 1;
				}
				if(_t143 != 0 || _t179 == 7) {
					_t172 = _v24;
					if(_t172 != 1) {
						if(_t172 != 2) {
							goto L14;
						}
						_t173 = _a12;
						 *((short*)(_t173 + _v28 * 2)) = 0;
						L73:
						if(_t143 != 0) {
							_t182 = _t173 + _t143 * 2;
							memmove(_t173 + (_t143 - _t179 + 8) * 2, _t182, _t179 - _t143 + _t179 - _t143);
							_t108 = 8;
							memset(_t182, 0, _t108 - _t179 + _t108 - _t179);
						}
						return 0;
					}
					if(_t99 != 0) {
						if(_t180 > 3) {
							goto L14;
						}
						_t146 = strtol(_v32, 0, 0xa);
						_t189 = _t189 + 0xc;
						if(_t146 > 0xff) {
							goto L14;
						}
						_t173 = _a12;
						 *((char*)(_v20 + _v28 * 2 + _t173)) = _t146;
						L70:
						_t143 = _v16;
						goto L73;
					}
					if(_t180 > 4) {
						goto L14;
					}
					_t115 = strtol(_v32, _t99, 0x10);
					_t173 = _a12;
					_t189 = _t189 + 0xc;
					 *((short*)(_t173 + _v28 * 2)) = _t115;
					goto L70;
				} else {
					goto L14;
				}
			}

0x6df46d1c
0x6df46d1e
0x6df46d21
0x6df46d23
0x6df46d26
0x6df46d28
0x6df46d2b
0x6df46d2d
0x6df46d31
0x6df46d33
0x6df46d39
0x6df46d3c
0x6df46d3f
0x6df46d41
0x6df46d45
0x6df46d48
0x6df46dc7
0x6df46dca
0x6dfa1e50
0x6dfa1e53
0x00000000
0x00000000
0x6dfa1e59
0x6dfa1e5c
0x6df46e3b
0x6df46e3e
0x6df46e60
0x6df46e60
0x6dfa1f34
0x6dfa1f34
0x6dfa1f37
0x6dfa1f3c
0x00000000
0x00000000
0x6dfa1f44
0x6dfa1f90
0x6df46db9
0x00000000
0x6df46db9
0x6dfa1f9b
0x6dfa1fa0
0x6dfa1fa8
0x00000000
0x00000000
0x6dfa1fae
0x6dfa1fb7
0x6df46e43
0x6df46e43
0x6df46e46
0x6df46e49
0x6df46e4a
0x6df46e4d
0x6df46e4f
0x00000000
0x6df46e4f
0x6dfa1f49
0x00000000
0x00000000
0x6dfa1f53
0x6dfa1f5a
0x6dfa1f5f
0x6dfa1f62
0x6dfa1f67
0x6dfa1f67
0x6df46e40
0x6df46e40
0x00000000
0x6df46e40
0x6df46dd0
0x6df46dd4
0x6df46dd9
0x6df46ddc
0x6df46dea
0x6df46def
0x6df46df2
0x6df46e06
0x6dfa1e83
0x6df46d8f
0x6df46d8f
0x00000000
0x6dfa1e92
0x6dfa1e95
0x6dfa1e99
0x6dfa1eb8
0x6dfa1ebb
0x6dfa1ebb
0x6dfa1ebe
0x6dfa1ec0
0x6df46e38
0x6df46e38
0x00000000
0x6df46e38
0x6dfa1e9b
0x6dfa1ea0
0x6df46d92
0x6df46d92
0x00000000
0x6df46d92
0x6dfa1ea8
0x6dfa1ea9
0x6dfa1eac
0x6dfa1eaf
0x6dfa1eb0
0x6dfa1eb3
0x00000000
0x6dfa1eb3
0x6dfa1e83
0x6df46e0f
0x00000000
0x00000000
0x6dfa1ecc
0x00000000
0x00000000
0x6dfa1ed2
0x6dfa1ed8
0x00000000
0x6dfa1ee7
0x6dfa1ee7
0x6dfa1eea
0x6dfa1eed
0x00000000
0x6dfa1eed
0x6dfa1e64
0x6dfa1e67
0x6dfa1e6a
0x6dfa1e6b
0x6dfa1e70
0x6dfa1fc0
0x00000000
0x6dfa1fc0
0x6dfa1e76
0x00000000
0x6dfa1e76
0x6df46e57
0x6df46e5a
0x6df46e5b
0x00000000
0x6df46e5b
0x6df46ddc
0x6df46d4a
0x6df46d4d
0x6dfa1ef7
0x00000000
0x6dfa1f05
0x6dfa1f08
0x6dfa1f0c
0x00000000
0x00000000
0x6dfa1f12
0x6dfa1f18
0x6dfa1f1b
0x6dfa1f1e
0x6dfa1f21
0x6dfa1f26
0x6dfa1f28
0x6dfa1f2d
0x6dfa1f2e
0x6dfa1f31
0x00000000
0x6dfa1f31
0x6dfa1ef7
0x6df46d56
0x00000000
0x00000000
0x6df46d58
0x6df46d5c
0x6df46d61
0x6df46d64
0x6df46d76
0x6df46d7b
0x6df46d7e
0x00000000
0x6df46e1a
0x6df46e1a
0x6df46e1f
0x00000000
0x00000000
0x6df46e2c
0x6df46e30
0x6df46e31
0x6df46e34
0x6df46e35
0x00000000
0x6df46e35
0x6dfa1f6f
0x6dfa1f74
0x6dfa1f77
0x6dfa1f7c
0x6dfa1f7d
0x6dfa1f81
0x6dfa1f82
0x6dfa1f85
0x00000000
0x6dfa1f85
0x6df46d64
0x6df46d9b
0x6df46d9d
0x6df46da2
0x6dfa1fcb
0x00000000
0x00000000
0x6dfa1fd1
0x6dfa1fd1
0x6df46daa
0x6dfa1fd7
0x6dfa1fdd
0x6dfa2047
0x00000000
0x00000000
0x6dfa204d
0x6dfa2055
0x6dfa2059
0x6dfa205b
0x6dfa205d
0x6dfa2071
0x6dfa2078
0x6dfa2081
0x6dfa2086
0x00000000
0x6dfa2089
0x6dfa1fe1
0x6dfa200d
0x00000000
0x00000000
0x6dfa201f
0x6dfa2021
0x6dfa202a
0x00000000
0x00000000
0x6dfa2039
0x6dfa203c
0x6dfa203f
0x6dfa203f
0x00000000
0x6dfa203f
0x6dfa1fe6
0x00000000
0x00000000
0x6dfa1ff2
0x6dfa1ff7
0x6dfa1ffe
0x6dfa2004
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__isascii.9419(?,?,?,00000000,?,00000000,?,00000000), ref: 6DF46D5C
isdigit.9419(?,?,?,00000000,?,00000000,?,00000000), ref: 6DF46D67
__isascii.9419(?,?,?,00000000,?,00000000,?,00000000), ref: 6DF46D76
isxdigit.9419(?,?,?,00000000,?,00000000,?,00000000), ref: 6DF46D81
__isascii.9419(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6DF46DD4
isdigit.9419(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6DF46DDF
__isascii.9419(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6DF46DEA
isxdigit.9419(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6DF46DF5
strtol.9419(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6DFA1F53

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: e61fbafceab1a19d6f426062f2695abc46dd1f02175dc498528017ffd04061ed
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 03B1BE71E0825A9BDB14CF6DC890BFFBBB5AF4A304F15C029E950AB346D7309A418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44360, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6DF44360(signed int _a4, unsigned int _a8) {
				void* _v4;
				signed int _v8;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t43;
				signed char _t46;
				signed int _t67;
				signed int _t69;
				void* _t70;
				signed int _t79;
				signed int _t82;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t86;
				signed int _t87;
				signed int _t89;

				_t89 = (_t87 & 0xfffffff8) - 0x5c;
				_t40 =  *0x6e03d360 ^ _t89;
				_v8 =  *0x6e03d360 ^ _t89;
				_push(_t85);
				if((_a4 & 0xfffffffe) != 0) {
					_push(_a4);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid flags 0x%08lx\n");
					L17:
					_push(0);
					_push(0x33);
					E6DFD5720();
					_t89 = _t89 + 0x14;
					L19:
					_push(0xc000000d);
					L21:
					L6DF9DF30(_t71, _t80);
					L22:
					_t82 =  *_t85;
					_t71 = 0;
					if(_t82 == 0) {
						_t43 = 0;
					} else {
						asm("sbb eax, eax");
						_t43 =  ~( *(_t82 + 8) & 8) & _t82;
					}
					if(_t82 == 0) {
						L20:
						_push(0xc0150010);
						goto L21;
					} else {
						while(_t43 == 0 ||  *((intOrPtr*)(_t43 + 0xc)) != _t80) {
							_t82 =  *_t82;
							_t71 = _t71 + 1;
							if(_t82 == 0) {
								_t43 = 0;
							} else {
								asm("sbb eax, eax");
								_t43 =  ~( *(_t82 + 8) & 8) & _t82;
							}
							if(_t82 != 0) {
								continue;
							}
							break;
						}
						if(_t82 == 0) {
							goto L20;
						}
						_v84 = _v84 & 0x00000000;
						_v88 = _v88 & 0x00000000;
						_push( &_v92);
						_v76 = 3;
						_v72 = _t71;
						_v68 = _t82;
						_v64 = _t85;
						_v92 = 0xc015000f;
						E6DF9DEF0(_t71, _t80);
						L8:
						_t83 =  *_t82;
						do {
							_t46 =  *(_t85 + 8);
							_t69 =  *_t85;
							if((_t46 & 0x00000001) != 0) {
								E6DF79B10( *((intOrPtr*)(_t85 + 4)));
								_t46 =  *(_t85 + 8);
							}
							if((_t46 & 0x00000008) != 0) {
								_t80 = _t85;
								E6DF44439(_v88, _t85);
							}
							_t85 = _t69;
						} while (_t69 != _t83);
						_t40 = _v88;
						 *_v88 = _t83;
						L14:
						_pop(_t84);
						_pop(_t86);
						_pop(_t70);
						return E6DF8B640(_t40, _t70,  *(_t89 + 0x64) ^ _t89, _t80, _t84, _t86);
					}
				}
				_t80 = _a8;
				if(_t80 == 0) {
					goto L14;
				}
				if((_t80 & 0xf0000000) != 0x10000000) {
					_push(_t80);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid cookie type 0x%08Ix\n");
					goto L17;
				}
				_t85 = 0xfff;
				_t71 = _t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14);
				_t40 =  *( *[fs:0x18] + 0x1a8);
				if((0x00000fff & (_t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14))) != 0) {
					_push( *(_t40 + 0x14) & 0x00000fff);
					_push(_t80);
					E6DFD5720(0x33, 0, "SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix\n", "RtlDeactivateActivationContext");
					_t89 = _t89 + 0x18;
					goto L19;
				}
				_t85 =  *_t40;
				_v96 = _t40;
				if(_t85 == 0) {
					goto L14;
				}
				_t67 =  *(_t85 + 8) & 0x00000008;
				asm("sbb ecx, ecx");
				_t79 =  ~_t67 & _t85;
				if(_t67 == 0 ||  *((intOrPtr*)(_t79 + 0xc)) != _t80) {
					goto L22;
				} else {
					_t82 = _t85;
					goto L8;
				}
			}

0x6df44368
0x6df44370
0x6df44372
0x6df4437e
0x6df44380
0x6dfa072a
0x6dfa072d
0x6dfa0732
0x6dfa0744
0x6dfa0744
0x6dfa0746
0x6dfa0748
0x6dfa074d
0x6dfa076f
0x6dfa076f
0x6dfa077b
0x6dfa077b
0x6dfa0780
0x6dfa0780
0x6dfa0782
0x6dfa0786
0x6dfa0798
0x6dfa0788
0x6dfa0792
0x6dfa0794
0x6dfa0794
0x6dfa079c
0x6dfa0776
0x6dfa0776
0x00000000
0x6dfa079e
0x6dfa079e
0x6dfa07a7
0x6dfa07a9
0x6dfa07ac
0x6dfa07be
0x6dfa07ae
0x6dfa07b8
0x6dfa07ba
0x6dfa07ba
0x6dfa07c2
0x00000000
0x00000000
0x00000000
0x6dfa07c2
0x6dfa07c6
0x00000000
0x00000000
0x6dfa07c8
0x6dfa07d1
0x6dfa07d6
0x6dfa07d7
0x6dfa07df
0x6dfa07e3
0x6dfa07e7
0x6dfa07eb
0x6dfa07f3
0x6df443fb
0x6df443fb
0x6df443fd
0x6df443fd
0x6df44400
0x6df44404
0x6dfa0800
0x6dfa0805
0x6dfa0805
0x6df4440c
0x6df44412
0x6df44414
0x6df44414
0x6df44419
0x6df4441b
0x6df4441f
0x6df44423
0x6df44425
0x6df44429
0x6df4442a
0x6df4442b
0x6df44436
0x6df44436
0x6dfa079c
0x6df44386
0x6df4438b
0x00000000
0x00000000
0x6df4439d
0x6dfa0739
0x6dfa073a
0x6dfa073f
0x00000000
0x6dfa073f
0x6df443ae
0x6df443b9
0x6df443c2
0x6df443ca
0x6dfa0757
0x6dfa0758
0x6dfa0767
0x6dfa076c
0x00000000
0x6dfa076c
0x6df443d0
0x6df443d2
0x6df443d8
0x00000000
0x00000000
0x6df443dd
0x6df443e4
0x6df443e6
0x6df443ea
0x00000000
0x6df443f9
0x6df443f9
0x00000000
0x6df443f9

APIs

DbgPrintEx.9419(00000033,00000000,SXS: %s() called with invalid flags 0x%08lx,RtlDeactivateActivationContext,FFFFFFFE), ref: 6DFA0748
DbgPrintEx.9419(00000033,00000000,SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix,RtlDeactivateActivationContext,?,?), ref: 6DFA0767
RtlRaiseStatus.9419(C000000D), ref: 6DFA077B
RtlRaiseException.9419(?,?,?), ref: 6DFA07F3
RtlReleaseActivationContext.9419(?), ref: 6DFA0800

Strings

RtlDeactivateActivationContext, xrefs: 6DFA072D, 6DFA073A, 6DFA0759
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 6DFA075E
SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 6DFA073F
SXS: %s() called with invalid flags 0x%08lx, xrefs: 6DFA0732

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintRaise$ActivationContextExceptionReleaseStatus
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 1148088771-1245972979
Opcode ID: 1c7e852b5a62beb6414ecdcdf9e22f8ce6db3025a4bd4ed65d74b17787ad2c15
Instruction ID: dfd401530a7d9a7238e06ae6024c6cbd3f3b9bdccbbd8e99f6cd644e5f739845
Opcode Fuzzy Hash: 1c7e852b5a62beb6414ecdcdf9e22f8ce6db3025a4bd4ed65d74b17787ad2c15
Instruction Fuzzy Hash: C041F432654A13DBD311CF1EE841B36B7E1EB84B54F1A852DF8659B285DBB4E8008FD1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF85969, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6DF85969(void* __ecx) {
				intOrPtr _v8;
				void* _v12;
				short* _t29;
				intOrPtr _t32;
				signed int* _t37;
				signed int _t38;
				void* _t41;
				intOrPtr _t43;
				signed int** _t44;
				signed int* _t45;
				void _t47;
				intOrPtr* _t49;
				void* _t51;

				_push(__ecx);
				_push(__ecx);
				_t51 = __ecx;
				if(__ecx == 0) {
					E6DFE5100(__ecx, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x20c, "This != NULL");
					_t47 = 0xc00000e5;
					L9:
					return _t47;
				}
				if( *((char*)(__ecx + 0x28)) == 0) {
					L7:
					_t47 = 0;
					L8:
					memset(_t51, 0, 0x2c);
					goto L9;
				}
				_t41 =  *(__ecx + 0x20);
				if(_t41 == 0 ||  *((intOrPtr*)(_t41 + 4)) == 0) {
					_t45 =  *(_t51 + 0x1c);
					if(_t45 != 0) {
						if(_t45[1] !=  *((intOrPtr*)(_t51 + 4))) {
							goto L5;
						}
						_t38 =  *_t51 & 0x0000ffff;
						if(_t38 > _t45[0]) {
							_push("rUS.Length <= This->PrivatePreallocatedString->MaximumLength");
							_push(0x219);
							goto L14;
						}
						 *_t45 = _t38;
						_t44 =  *(_t51 + 0x24);
						if(_t44 == 0) {
							goto L7;
						}
						_t37 =  *(_t51 + 0x1c);
						L19:
						 *_t44 = _t37;
						goto L7;
					}
					L5:
					if(_t41 == 0) {
						_t49 = _t51 + 8;
						if(_t49 != 0) {
							_t32 =  *_t49;
							if(_t32 != 0) {
								_t43 =  *((intOrPtr*)(_t51 + 0xc));
								if(_t32 != _t43) {
									_v8 = _t32;
									RtlFreeUnicodeString( &_v12);
									_t43 =  *((intOrPtr*)(_t51 + 0xc));
								}
								 *_t49 = _t43;
								 *((intOrPtr*)(_t51 + 0x10)) =  *((intOrPtr*)(_t51 + 0x14));
							}
						}
						_t29 =  *((intOrPtr*)(_t51 + 0xc));
						 *((intOrPtr*)(_t51 + 4)) = _t29;
						if(_t29 != 0) {
							 *_t29 = 0;
						}
						 *_t51 = 0;
						 *((short*)(_t51 + 2)) =  *((intOrPtr*)(_t51 + 0x14));
						goto L7;
					}
					 *_t41 =  *_t51;
					 *((intOrPtr*)(_t41 + 4)) =  *((intOrPtr*)(_t51 + 4));
					_t44 =  *(_t51 + 0x24);
					if(_t44 != 0) {
						_t37 =  *(_t51 + 0x20);
						goto L19;
					}
					goto L7;
				} else {
					_push("(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)");
					_push(0x214);
					L14:
					_push("minkernel\\ntdll\\sxsisol.cpp");
					_push("Internal error check failed");
					E6DFE5100(_t41);
					_t47 = 0xc00000e5;
					goto L8;
				}
			}

0x6df8596e
0x6df8596f
0x6df85971
0x6df85976
0x6dfbf9b3
0x6dfbf9b8
0x6df859c6
0x6df859cd
0x6df859cd
0x6df85980
0x6df859b7
0x6df859b7
0x6df859b9
0x6df859be
0x00000000
0x6df859c3
0x6df85982
0x6df85987
0x6df85993
0x6df85998
0x6dfbf9f7
0x00000000
0x00000000
0x6dfbf9fd
0x6dfbfa04
0x6dfbf9ce
0x6dfbf9d3
0x00000000
0x6dfbf9d3
0x6dfbfa06
0x6dfbfa09
0x6dfbfa0e
0x00000000
0x00000000
0x6dfbfa14
0x6dfbfa17
0x6dfbfa17
0x00000000
0x6dfbfa17
0x6df8599e
0x6df859a0
0x6dfbfa1e
0x6dfbfa23
0x6dfbfa25
0x6dfbfa29
0x6dfbfa2b
0x6dfbfa30
0x6dfbfa32
0x6dfbfa39
0x6dfbfa3e
0x6dfbfa3e
0x6dfbfa44
0x6dfbfa46
0x6dfbfa46
0x6dfbfa29
0x6dfbfa49
0x6dfbfa4c
0x6dfbfa51
0x6dfbfa55
0x6dfbfa55
0x6dfbfa5a
0x6dfbfa61
0x00000000
0x6dfbfa61
0x6df859a8
0x6df859ad
0x6df859b0
0x6df859b5
0x6df859ce
0x00000000
0x6df859ce
0x00000000
0x6dfbf9c2
0x6dfbf9c2
0x6dfbf9c7
0x6dfbf9d8
0x6dfbf9d8
0x6dfbf9dd
0x6dfbf9e2
0x6dfbf9e7
0x00000000
0x6dfbf9e7

APIs

memset.9419(?,00000000,0000002C,?,00000000,?,?,?,6DF6291C), ref: 6DF859BE
RtlAssert.9419(Internal error check failed,minkernel\ntdll\sxsisol.cpp,0000020C,This != NULL,?,00000000,?,?,?,6DF6291C), ref: 6DFBF9B3
RtlAssert.9419(Internal error check failed,minkernel\ntdll\sxsisol.cpp,00000219,rUS.Length <= This->PrivatePreallocatedString->MaximumLength,?,00000000,?,?,?,6DF6291C), ref: 6DFBF9E2

Strings

rUS.Length <= This->PrivatePreallocatedString->MaximumLength, xrefs: 6DFBF9CE
This != NULL, xrefs: 6DFBF99F
(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL), xrefs: 6DFBF9C2
Internal error check failed, xrefs: 6DFBF9AE, 6DFBF9DD
minkernel\ntdll\sxsisol.cpp, xrefs: 6DFBF9A9, 6DFBF9D8

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Assert$memset
String ID: (This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)$Internal error check failed$This != NULL$minkernel\ntdll\sxsisol.cpp$rUS.Length <= This->PrivatePreallocatedString->MaximumLength
API String ID: 2494167153-3589341846
Opcode ID: 1dd3ffe25127e0fb274ec9ced56e17c235975ebc56b822e0b1a12405ebc3a72a
Instruction ID: 303f025d5340e0c8fe425e16128166975536ea639be49751f9cc424c596e4bda
Opcode Fuzzy Hash: 1dd3ffe25127e0fb274ec9ced56e17c235975ebc56b822e0b1a12405ebc3a72a
Instruction Fuzzy Hash: D8318139205702ABE768CF1EC840E36B3F5EF45718B12891EE49ADBB42D772F8458791

Uniqueness

Uniqueness Score: -1.00%

Function 6DF819F0, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF819F0(signed int __ecx, void* __edx, struct _EXCEPTION_RECORD _a4) {
				void* _t3;
				WCHAR* _t4;
				void* _t6;
				void* _t7;

				_t3 = (__ecx & 0x0000ffff) - 1;
				if(_t3 == 0) {
					_t4 = L"\\System32\\";
					if(__edx == 0) {
						_t4 = L"System32";
					}
					L4:
					RtlInitUnicodeString(_a4, _t4);
					return 0;
				}
				_t6 = _t3 - 0x14b;
				if(_t6 != 0) {
					_t7 = _t6 - 0x78;
					if(_t7 == 0) {
						if(__edx == 0) {
							_t4 = L"SysARM32";
						} else {
							_t4 = L"\\SysARM32\\";
						}
						goto L4;
					}
					if(_t7 == 0x38a0) {
						if(__edx == 0) {
							_t4 = L"SyCHPE32";
						} else {
							_t4 = L"\\SyCHPE32\\";
						}
						goto L4;
					}
					return 0xc000000d;
				} else {
					if(__edx != 0) {
						_t4 = L"\\SysWOW64\\";
					} else {
						_t4 = L"SysWOW64";
					}
					goto L4;
				}
			}

0x6df819f8
0x6df819fb
0x6df81a20
0x6df81a27
0x6df81a29
0x6df81a29
0x6df81a11
0x6df81a15
0x00000000
0x6df81a1a
0x6df819fd
0x6df81a02
0x6dfbd31c
0x6dfbd31f
0x6dfbd34c
0x6dfbd358
0x6dfbd34e
0x6dfbd34e
0x6dfbd34e
0x00000000
0x6dfbd34c
0x6dfbd326
0x6dfbd334
0x6dfbd340
0x6dfbd336
0x6dfbd336
0x6dfbd336
0x00000000
0x6dfbd334
0x00000000
0x6df81a08
0x6df81a0a
0x6df81a30
0x6df81a0c
0x6df81a0c
0x6df81a0c
0x00000000
0x6df81a0a

APIs

RtlInitUnicodeString.9419(?,\System32\,?,6DF819C0,?,?,\SysWOW64,02140000,00000000,?,?), ref: 6DF81A15

Strings

SysWOW64, xrefs: 6DF81A0C
\System32\, xrefs: 6DF81A20
System32, xrefs: 6DF81A11, 6DF81A29
SyCHPE32, xrefs: 6DFBD340
\SysWOW64\, xrefs: 6DF81A30
SysARM32, xrefs: 6DFBD358
\SysARM32\, xrefs: 6DFBD34E
\SyCHPE32\, xrefs: 6DFBD336

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode
String ID: SyCHPE32$SysARM32$SysWOW64$System32$\SyCHPE32\$\SysARM32\$\SysWOW64\$\System32\
API String ID: 4228678080-2516413534
Opcode ID: bf067788e0e62c9e4786758dd45772881dc0aa7cd8ba6e689ac2445c7d1d5ea6
Instruction ID: 35b5d90f081966b2c72a4de4091857ccaf1f05c5014720a2e82ba9e5b444c6a8
Opcode Fuzzy Hash: bf067788e0e62c9e4786758dd45772881dc0aa7cd8ba6e689ac2445c7d1d5ea6
Instruction Fuzzy Hash: 24F030662E821686B601C47D9E8027639646782358B0B8222AC66DF61FD13BCD8443C7

Uniqueness

Uniqueness Score: -1.00%

Function 6DF40BD0, Relevance: 15.3, APIs: 10, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF40BD0(wchar_t* _a4, wchar_t** _a8, intOrPtr _a12) {
				char _v5;
				wchar_t* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				wchar_t* _v28;
				signed int _v32;
				long _t110;
				wchar_t** _t113;
				wchar_t* _t114;
				wchar_t* _t115;
				long _t116;
				long _t117;
				signed int _t118;
				int _t121;
				int _t122;
				void* _t123;
				wchar_t** _t126;
				int _t127;
				int _t128;
				wchar_t** _t129;
				signed int _t130;
				wchar_t* _t134;
				char _t135;
				wchar_t** _t138;
				char _t141;
				wchar_t** _t144;
				intOrPtr _t145;
				wchar_t* _t146;
				signed int _t147;
				long _t150;
				wchar_t** _t151;
				void* _t153;
				intOrPtr _t154;
				wchar_t* _t155;
				void* _t157;

				_t146 = _a4;
				_t144 = 0;
				_t129 = 0;
				_v20 = 0;
				_v28 = 0;
				_v5 = 0;
				_t150 =  *_t146 & 0x0000ffff;
				_v12 = 0;
				_v16 = 0;
				_v32 = 0;
				_v24 = 0;
				if(_t150 == 0) {
					_t134 = 0;
					L10:
					_t151 = _v20;
					 *_a8 = _t146;
					if(_t151 != 0) {
						if(_t151 != 3) {
							L13:
							return 0xc000000d;
						}
						_t134 = _t134 + 1;
						_v12 = _t134;
					}
					_t147 = _v32;
					if(_t147 != 0 || _t134 == 7) {
						if(_t129 != 1) {
							if(_t129 != 2) {
								goto L13;
							}
							_t145 = _a12;
							 *((short*)(_t145 + _v24 * 2)) = 0;
							L68:
							if(_t147 != 0) {
								_t153 = _t145 + _t147 * 2;
								_t89 = _t145 + 0x10; // 0x10
								memmove(_t89 + (_t147 - _t134) * 2, _t153, _t134 - _t147 + _t134 - _t147);
								memset(_t153, 0, 8 - _v12 + 8 - _v12);
							}
							return 0;
						}
						if(_t151 != 0) {
							if(_v16 > 3) {
								goto L13;
							}
							_t135 = wcstol(_v28, 0, 0xa);
							_t157 = _t157 + 0xc;
							if(_t135 > 0xff) {
								goto L13;
							}
							_t145 = _a12;
							 *((char*)(_t151 + _v24 * 2 + _t145)) = _t135;
							_t134 = _v12;
							goto L68;
						}
						if(_v16 > 4) {
							goto L13;
						}
						_t110 = wcstol(_v28, _t151, 0x10);
						_t145 = _a12;
						_t157 = _t157 + 0xc;
						 *((short*)(_t145 + _v24 * 2)) = _t110;
						_t134 = _v12;
						goto L68;
					} else {
						goto L13;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					_t113 = _t129;
					if(_t113 == 0) {
						L15:
						if(_t150 == 0x3a) {
							if(_t144 != 0 || _v12 > _t144) {
								L9:
								_t134 = _v12;
								goto L10;
							} else {
								_t114 =  &(_t146[0]);
								if(_t146[0] != 0x3a) {
									goto L9;
								}
								_t130 = _v24;
								_t154 = _a12;
								_v32 = 1;
								_v12 = 2;
								 *((short*)(_t154 + _t130 * 2)) = 0;
								_v24 = 1 + _t130;
								_t146 = _t114;
								_t47 =  &(_t144[0]); // 0x2
								_t129 = _t47;
								L49:
								_t115 = _v28;
								if(_t115 == 0) {
									goto L24;
								}
								if(_t144 != 0) {
									if(_v16 > 3) {
										goto L13;
									}
									_t116 = wcstol(_t115, 0, 0xa);
									_t157 = _t157 + 0xc;
									if(_t116 > 0xff) {
										goto L13;
									}
									_t144 = _v20;
									 *(_t144 + _v24 * 2 + _t154 - 1) = _t116;
									_t141 = _v5;
									goto L24;
								}
								if(_v16 > 4) {
									goto L13;
								}
								_t117 = wcstol(_t115, _t144, 0x10);
								_t144 = _v20;
								_t157 = _t157 + 0xc;
								_t118 = _v24;
								 *((short*)(_t154 + _t118 * 2)) = _t117;
								_t141 = _v5;
								_v24 = 1 + _t118;
								goto L24;
							}
						}
						_t134 = _v12;
						if(_t134 > 7 || _t150 >= 0x80) {
							goto L10;
						} else {
							_t121 = iswctype(_t150, 4);
							_t157 = _t157 + 8;
							if(_t121 != 0) {
								_t144 = _v20;
								_t129 = 1;
								_t138 = 0;
								_v28 = _t146;
								_v16 = 1;
								L23:
								_v5 = _t138;
								goto L24;
							}
							_t122 = iswctype(_t150, 0x80);
							_t157 = _t157 + 8;
							if(_t122 == 0) {
								goto L9;
							}
							_t144 = _v20;
							if(_t144 != 0) {
								goto L9;
							}
							_t129 = 1;
							_v28 = _t146;
							_v16 = 1;
							L22:
							_t138 = 1;
							goto L23;
						}
					}
					_t123 = _t113 - 1;
					if(_t123 != 0) {
						if(_t123 == 1) {
							goto L15;
						}
						L39:
						if(_t129 == 1) {
							goto L24;
						}
						_t154 = _a12;
						goto L49;
					}
					if(_t150 >= 0x80) {
						L7:
						if(_t150 == 0x3a) {
							if(_t144 != 0) {
								goto L9;
							}
							_t155 = _v12;
							if(_t155 > 6) {
								goto L9;
							}
							if(_t146[0] != 0x3a) {
								_t129 = 0;
								_t126 = 1;
								L38:
								_v12 = _t155 + _t126;
								goto L39;
							}
							if(_v32 != _t144) {
								goto L9;
							}
							_t146 =  &(_t146[0]);
							_v32 = _t155 + 1;
							_t129 = 2;
							_t126 = 2;
							goto L38;
						}
						if(_t150 == 0x2e) {
							if(_t141 != 0 || _t144 > 2 || _v12 > 6) {
								goto L9;
							} else {
								_t154 = _a12;
								_t144 =  &(_t144[0]);
								_v20 = _t144;
								_t129 = 0;
								goto L49;
							}
						}
						goto L9;
					}
					_t127 = iswctype(_t150, 4);
					_t157 = _t157 + 8;
					if(_t127 != 0) {
						_v16 = 1 + _v16;
						_t141 = _v5;
						_t144 = _v20;
						goto L24;
					}
					_t128 = iswctype(_t150, 0x80);
					_t144 = _v20;
					_t157 = _t157 + 8;
					if(_t128 != 0) {
						_v16 =  &(_v16[0]);
						if(_t144 == 0) {
							goto L22;
						}
						goto L9;
					}
					_t141 = _v5;
					goto L7;
					L24:
					_t150 = _t146[0] & 0x0000ffff;
					_t146 =  &(_t146[0]);
				} while (_t150 != 0);
				goto L9;
			}

0x6df40bdb
0x6df40bde
0x6df40be0
0x6df40be2
0x6df40be7
0x6df40bea
0x6df40bed
0x6df40bf0
0x6df40bf3
0x6df40bf6
0x6df40bf9
0x6df40bff
0x6df40d14
0x6df40c69
0x6df40c6c
0x6df40c6f
0x6df40c73
0x6df9e8fd
0x6df40c8d
0x00000000
0x6df40c8d
0x6df9e903
0x6df9e904
0x6df9e904
0x6df40c79
0x6df40c7e
0x6df9e90f
0x6df9e97b
0x00000000
0x00000000
0x6df9e981
0x6df9e989
0x6df9e98d
0x6df9e98f
0x6df9e993
0x6df9e99d
0x6df9e9a5
0x6df9e9b8
0x6df9e9bd
0x00000000
0x6df9e9c0
0x6df9e913
0x6df9e944
0x00000000
0x00000000
0x6df9e956
0x6df9e958
0x6df9e961
0x00000000
0x00000000
0x6df9e96a
0x6df9e970
0x6df9e973
0x00000000
0x6df9e973
0x6df9e919
0x00000000
0x00000000
0x6df9e925
0x6df9e92a
0x6df9e931
0x6df9e937
0x6df9e93b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df40c05
0x6df40c05
0x6df40c07
0x6df40c0a
0x6df40c9b
0x6df40c9f
0x6df9e82f
0x6df40c66
0x6df40c66
0x00000000
0x6df9e83e
0x6df9e843
0x6df9e846
0x00000000
0x00000000
0x6df9e84c
0x6df9e851
0x6df9e854
0x6df9e85b
0x6df9e862
0x6df9e867
0x6df9e86a
0x6df9e86c
0x6df9e86c
0x6df9e86f
0x6df9e86f
0x6df9e874
0x00000000
0x00000000
0x6df9e87c
0x6df9e8b2
0x00000000
0x00000000
0x6df9e8bd
0x6df9e8c2
0x6df9e8ca
0x00000000
0x00000000
0x6df9e8d0
0x6df9e8d9
0x6df9e8dd
0x00000000
0x6df9e8dd
0x6df9e882
0x00000000
0x00000000
0x6df9e88c
0x6df9e891
0x6df9e898
0x6df9e89b
0x6df9e89e
0x6df9e8a3
0x6df9e8a6
0x00000000
0x6df9e8a6
0x6df9e82f
0x6df40ca5
0x6df40cab
0x00000000
0x6df40cb7
0x6df40cba
0x6df40cbf
0x6df40cc4
0x6df9e8e5
0x6df9e8e8
0x6df9e8ed
0x6df9e8ef
0x6df9e8f2
0x6df40cf0
0x6df40cf0
0x00000000
0x6df40cf0
0x6df40cd0
0x6df40cd5
0x6df40cda
0x00000000
0x00000000
0x6df40cdc
0x6df40ce1
0x00000000
0x00000000
0x6df40ce3
0x6df40ce8
0x6df40ceb
0x6df40cee
0x6df40cee
0x00000000
0x6df40cee
0x6df40cab
0x6df40c10
0x6df40c13
0x6df9e7a1
0x00000000
0x00000000
0x6df9e7f9
0x6df9e7fc
0x00000000
0x00000000
0x6df9e802
0x00000000
0x6df9e802
0x6df40c21
0x6df40c52
0x6df40c56
0x6df9e7b9
0x00000000
0x00000000
0x6df9e7bf
0x6df9e7c5
0x00000000
0x00000000
0x6df9e7d0
0x6df9e7ed
0x6df9e7ef
0x6df9e7f4
0x6df9e7f6
0x00000000
0x6df9e7f6
0x6df9e7d5
0x00000000
0x00000000
0x6df9e7de
0x6df9e7e1
0x6df9e7e4
0x6df9e7e9
0x00000000
0x6df9e7e9
0x6df40c60
0x6df9e809
0x00000000
0x6df9e822
0x6df9e822
0x6df9e825
0x6df9e826
0x6df9e829
0x00000000
0x6df9e829
0x6df9e809
0x00000000
0x6df40c60
0x6df40c26
0x6df40c2b
0x6df40c30
0x6df9e7a9
0x6df9e7ac
0x6df9e7af
0x00000000
0x6df9e7af
0x6df40c3c
0x6df40c41
0x6df40c44
0x6df40c49
0x6df40d08
0x6df40d0d
0x00000000
0x00000000
0x00000000
0x6df40d0f
0x6df40c4f
0x00000000
0x6df40cf3
0x6df40cf3
0x6df40cf7
0x6df40cfa
0x00000000

APIs

iswctype.9419(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6DF40C26
iswctype.9419(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6DF40C3C
iswctype.9419(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6DF40CBA
iswctype.9419(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6DF40CD0
wcstol.9419(?,00000000,00000010,00000000,?,00000000), ref: 6DF9E88C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$wcstol
String ID:
API String ID: 3196148086-0
Opcode ID: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction ID: 5a7f2b70d272028f1fa448a86cbff52f930bd7a5e6c07e979546d516569a253b
Opcode Fuzzy Hash: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction Fuzzy Hash: B491A275D04216DBDB21CFAEC9807AFBBB1FF51304F10C425EA50AB382E6719A44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF471D0, Relevance: 13.7, APIs: 9, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6DF471D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short* _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _t35;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t49;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t66;
				void* _t69;
				void* _t70;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				intOrPtr* _t82;
				signed int _t83;
				signed int _t84;
				short* _t85;
				intOrPtr _t86;
				intOrPtr* _t87;
				intOrPtr* _t88;

				if(_a4 == 0 || _a12 == 0) {
					L4:
					return 0xc000000d;
				} else {
					_t85 = _a16;
					if(_t85 == 0 || E6DF47220(_a4, _a8,  &_v12, _a12) < 0) {
						goto L4;
					} else {
						_t87 = _v12;
						_t35 =  *_t87;
						if(_t35 != 0x3a) {
							if(_t35 != 0) {
								goto L4;
							}
							_v8 = _v8 & 0x00000000;
							L37:
							 *_t85 = _v8;
							return 0;
						}
						_v8 = _v8 & 0x00000000;
						_t88 = _t87 + 1;
						_t38 = 0xa;
						_v12 = _t38;
						_t83 = 0x10;
						if( *_t88 == 0x30) {
							_t12 = _t88 + 1; // 0x2
							_t82 = _t12;
							_v12 = 8;
							_t88 = _t82;
							_t38 =  *_t88;
							if(_t38 == 0x78 || _t38 == 0x58) {
								_v12 = _t83;
								_t15 = _t82 + 1; // 0x3
								_t88 = _t15;
							}
						}
						_t66 =  *_t88;
						if(_t66 == 0) {
							L33:
							if(_t66 != 0) {
								goto L37;
							}
							goto L4;
						} else {
							do {
								_t86 = _t66;
								_t88 = _t88 + 1;
								_t39 = E6DF8CB30(_t38, _t86);
								_pop(_t69);
								if(_t39 == 0) {
									_t84 = _v12;
									L18:
									_t40 = 0x10;
									if(_t84 != _t40) {
										goto L4;
									}
									_t41 = E6DF8CB30(_t40, _t86);
									_pop(_t70);
									if(_t41 == 0 || E6DF8CDD0(_t70, _t86) == 0) {
										goto L4;
									} else {
										_t43 = E6DF8CB30(_t42, _t86);
										_pop(_t72);
										if(_t43 == 0 || E6DF8CCE0(_t72, _t86) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_pop(_t73);
										_t48 = ((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86;
										if(((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86 > 0xffff) {
											goto L4;
										} else {
											_v8 = _v8 << 4;
											_t49 = E6DF8CB30(_t48, _t86);
											_pop(_t74);
											if(_t49 == 0 || E6DF8CCE0(_t74, _t86) == 0) {
												_push(0x41);
											} else {
												_push(0x61);
											}
											_pop(_t75);
											_t76 = 0xa;
											_t38 = _t66 - _t75 + _t76;
											_v8 = _v8 + _t66 - _t75 + _t76;
											goto L31;
										}
									}
								}
								_t54 = E6DF8CC80(_t69, _t86);
								_t84 = _v12;
								if(_t54 == 0) {
									goto L18;
								}
								_t55 = _t66;
								_v16 = _t55;
								if(_t55 + 0xffffffd0 >= _t84) {
									goto L18;
								}
								if((_v8 & 0x0000ffff) * (_t84 & 0x0000ffff) + 0xffffffd0 + _t86 > 0xffff) {
									goto L4;
								}
								_t38 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								_v8 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								L31:
								_t66 =  *_t88;
							} while (_t66 != 0);
							_t85 = _a16;
							goto L33;
						}
					}
				}
			}

0x6df471df
0x6df47208
0x00000000
0x6df471e7
0x6df471e7
0x6df471ec
0x00000000
0x6dfa22f2
0x6dfa22f2
0x6dfa22f5
0x6dfa22f9
0x6dfa2446
0x00000000
0x00000000
0x6dfa244c
0x6dfa2450
0x6dfa245a
0x00000000
0x6dfa245a
0x6dfa22ff
0x6dfa2303
0x6dfa2306
0x6dfa230c
0x6dfa230f
0x6dfa2310
0x6dfa2312
0x6dfa2312
0x6dfa2315
0x6dfa231c
0x6dfa231e
0x6dfa2322
0x6dfa2328
0x6dfa232b
0x6dfa232b
0x6dfa232b
0x6dfa2322
0x6dfa2330
0x6dfa2334
0x6dfa243b
0x6dfa243d
0x00000000
0x00000000
0x00000000
0x6dfa233a
0x6dfa233a
0x6dfa233a
0x6dfa233d
0x6dfa233f
0x6dfa2344
0x6dfa2347
0x6dfa2399
0x6dfa239c
0x6dfa239e
0x6dfa23a2
0x00000000
0x00000000
0x6dfa23a9
0x6dfa23ae
0x6dfa23b1
0x00000000
0x6dfa23c6
0x6dfa23c7
0x6dfa23cc
0x6dfa23cf
0x6dfa23e0
0x6dfa23dc
0x6dfa23dc
0x6dfa23dc
0x6dfa23e9
0x6dfa23ef
0x6dfa23f6
0x00000000
0x6dfa23fc
0x6dfa23fc
0x6dfa2401
0x6dfa2406
0x6dfa2409
0x6dfa241a
0x6dfa2416
0x6dfa2416
0x6dfa2416
0x6dfa241c
0x6dfa2426
0x6dfa2427
0x6dfa242a
0x00000000
0x6dfa242a
0x6dfa23f6
0x6dfa23b1
0x6dfa234a
0x6dfa234f
0x6dfa2355
0x00000000
0x00000000
0x6dfa2357
0x6dfa235b
0x6dfa2364
0x00000000
0x00000000
0x6dfa237a
0x00000000
0x00000000
0x6dfa238e
0x6dfa2391
0x6dfa242e
0x6dfa242e
0x6dfa2430
0x6dfa2438
0x00000000
0x6dfa2438
0x6dfa2334
0x6df471ec

APIs

RtlIpv4StringToAddressA.9419(00000000,?,00000000,00000000), ref: 6DF471FB

Part of subcall function 6DF47220: __isascii.9419(0000000A,?), ref: 6DF47275
Part of subcall function 6DF47220: isdigit.9419(00000000,?), ref: 6DF47283

__isascii.9419(?,00000000,?,00000000,00000000), ref: 6DFA233F
isdigit.9419(?,00000000,?,00000000,00000000), ref: 6DFA234A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit$AddressIpv4String
String ID:
API String ID: 960699662-0
Opcode ID: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction ID: 15c6e0e48ce87e8c20393f5c6e61cb62641771e8926ae91f7100e7fdd0ffa2f0
Opcode Fuzzy Hash: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction Fuzzy Hash: 3D415C36A44207D7EB118E6DD8507FE3BB49F43324F28812AED90AB1C1D735DA82D760

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD46A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DFD46A4(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t120;
				intOrPtr _t121;
				signed int _t126;
				signed int _t127;
				intOrPtr* _t145;
				intOrPtr* _t147;
				signed int _t148;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr* _t151;
				signed int _t152;
				void* _t153;
				intOrPtr _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t167;
				int _t168;
				intOrPtr _t169;
				signed int _t171;
				intOrPtr* _t172;
				intOrPtr* _t174;
				void* _t175;
				short* _t176;
				signed int _t177;
				void* _t178;

				_t153 = __ecx;
				_t177 = 0;
				_v20 = 0xc00000e5;
				_t172 = _a12;
				_t145 = __edx;
				_v8 = 0;
				_v24 = 0;
				if(_t172 != 0) {
					 *_t172 = 0;
				}
				_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x18)) + _t153 + 8));
				_v16 =  *_t145;
				if( *_t145 < _t162 - 1) {
					E6DF71D47( &_v20, _a4, _a8, _t172, 0x58, _t153, _t153, 2,  &_v8,  &_v28);
					if(_v24 == 0) {
						_t177 = _v20;
					} else {
						_t164 = _v8;
						_t19 = _t145 + 4; // 0x0
						_t115 =  *_t19;
						_v24 = _t115;
						_t155 =  *((intOrPtr*)(_t164 + 0x14));
						if(_t115 < _t155) {
							_t116 =  *((intOrPtr*)(_t164 + 0x18));
							if(_t116 == 0) {
								L16:
								_t177 = 0xc0150015;
							} else {
								_v20 = _t177;
								_v12 = _t116 + _t164;
								_v16 = _t177;
								if(_t155 != 0) {
									_v28 =  *_t145 + 1;
									_t147 = _v12 + 0xc;
									_t120 = _v24;
									do {
										_t166 = _v8;
										if( *((intOrPtr*)(_t147 + 8)) != _v28) {
											goto L15;
										} else {
											if(_v20 != _t120 ||  *_t147 == _t177) {
												_v20 = _v20 + 1;
												goto L15;
											} else {
												_t157 =  *_t147 + _t166;
												_v24 = _t157;
												if(_t157 == 0) {
													goto L16;
												} else {
													_t148 = _v16 * 0x18;
													_t121 = 0x14;
													_v20 = _t148;
													_t149 =  *((intOrPtr*)(_t148 + _v12 + 8));
													_t174 = _a12;
													if(_t149 != 0) {
														_t121 = _t149 + 0x16;
													}
													_t150 =  *((intOrPtr*)(_t157 + 8));
													if(_t150 != 0) {
														_t121 = _t121 + 2 + _t150;
													}
													if(_t121 <= _a8) {
														_t151 = _a4;
														_t167 = _v12;
														 *_t151 =  *((intOrPtr*)(_t157 + 4));
														_t51 = _t151 + 0x14; // 0x15
														_t175 = _t51;
														 *((intOrPtr*)(_t151 + 4)) =  *((intOrPtr*)(_v20 + _t167 + 8));
														 *((intOrPtr*)(_t151 + 8)) =  *((intOrPtr*)(_t157 + 8));
														_t126 = _v20;
														 *(_t151 + 0xc) = _t177;
														 *(_t151 + 0x10) = _t177;
														_t168 =  *((intOrPtr*)(_t126 + _t167 + 8));
														_v28 = _t168;
														_t169 = _v8;
														if(_t168 != 0) {
															memcpy(_t175,  *((intOrPtr*)(_t126 + _v12 + 4)) + _t169, _v28);
															_t178 = _t178 + 0xc;
															 *(_t151 + 0xc) = _t175;
															_t176 = _t175 +  *((intOrPtr*)(_v20 + _v12 + 8));
															_t157 = _v24;
															 *_t176 = 0;
															_t175 = _t176 + 2;
														}
														if( *((intOrPtr*)(_t157 + 8)) != _t177) {
															_t127 =  *(_t157 + 0x10);
															if(_t127 != 0) {
																_t171 = _t127 * 0x2c + _v8;
																_v20 = _t171;
																if(_t171 != 0) {
																	 *(_t151 + 0x10) = _t175;
																	_t152 = _t177;
																	if( *((intOrPtr*)(_t157 + 0xc)) <= _t177) {
																		L37:
																		 *_t175 = 0;
																	} else {
																		_t158 = _v24;
																		_v28 = _a4 + _a8;
																		while( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) + 2 + _t175 <= _v28) {
																			if( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) != _t177) {
																				memcpy(_t175, _v8 +  *((intOrPtr*)(_t171 + 4 + _t152 * 8)),  *(_t171 + _t152 * 8));
																				_t171 = _v20;
																				_t178 = _t178 + 0xc;
																				_t158 = _v24;
																				_t175 = _t175 +  *(_t171 + _t152 * 8);
																			}
																			_t152 = _t152 + 1;
																			if(_t152 <  *((intOrPtr*)(_t158 + 0xc))) {
																				continue;
																			} else {
																				goto L37;
																			}
																			goto L39;
																		}
																		goto L16;
																	}
																}
															}
														}
													} else {
														if(_t174 != 0) {
															 *_t174 = _t121;
														}
														_t177 = 0xc0000023;
													}
												}
											}
										}
										goto L39;
										L15:
										_v16 = _v16 + 1;
										_t147 = _t147 + 0x18;
									} while (_v16 < _t155);
								}
								goto L16;
							}
						} else {
							_push( *_t145);
							_push(_t155);
							_push(_t115);
							E6DFD5720(0x33, _t177, "SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
							goto L4;
						}
					}
				} else {
					_push(_t162);
					_push(_v16);
					E6DFD5720(0x33, _t177, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
					L4:
					_t177 = 0xc000000d;
				}
				L39:
				return _t177;
			}

0x6dfd46a4
0x6dfd46ae
0x6dfd46b0
0x6dfd46b8
0x6dfd46bb
0x6dfd46bd
0x6dfd46c0
0x6dfd46c5
0x6dfd46c7
0x6dfd46c7
0x6dfd46cc
0x6dfd46d2
0x6dfd46da
0x6dfd471b
0x6dfd4727
0x6dfd48c0
0x6dfd472d
0x6dfd472d
0x6dfd4730
0x6dfd4730
0x6dfd4733
0x6dfd4736
0x6dfd473b
0x6dfd4758
0x6dfd475d
0x6dfd479f
0x6dfd479f
0x6dfd475f
0x6dfd4761
0x6dfd4764
0x6dfd4767
0x6dfd476c
0x6dfd4774
0x6dfd4777
0x6dfd477a
0x6dfd477d
0x6dfd4783
0x6dfd4786
0x00000000
0x6dfd4788
0x6dfd478b
0x6dfd4791
0x00000000
0x6dfd47a9
0x6dfd47ab
0x6dfd47ad
0x6dfd47b0
0x00000000
0x6dfd47b2
0x6dfd47b2
0x6dfd47bb
0x6dfd47bc
0x6dfd47bf
0x6dfd47c3
0x6dfd47c8
0x6dfd47ca
0x6dfd47ca
0x6dfd47cd
0x6dfd47d2
0x6dfd47d7
0x6dfd47d7
0x6dfd47dc
0x6dfd47ee
0x6dfd47f4
0x6dfd47f7
0x6dfd47f9
0x6dfd47f9
0x6dfd4803
0x6dfd4809
0x6dfd480c
0x6dfd480f
0x6dfd4812
0x6dfd4815
0x6dfd481b
0x6dfd481e
0x6dfd4821
0x6dfd4831
0x6dfd4839
0x6dfd483f
0x6dfd4842
0x6dfd4848
0x6dfd484b
0x6dfd484e
0x6dfd484e
0x6dfd4854
0x6dfd4856
0x6dfd485b
0x6dfd4860
0x6dfd4863
0x6dfd4866
0x6dfd4868
0x6dfd486b
0x6dfd4870
0x6dfd48b9
0x6dfd48bb
0x6dfd4872
0x6dfd4878
0x6dfd487b
0x6dfd487e
0x6dfd4894
0x6dfd48a2
0x6dfd48a7
0x6dfd48aa
0x6dfd48ad
0x6dfd48b0
0x6dfd48b0
0x6dfd48b3
0x6dfd48b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfd48b7
0x00000000
0x6dfd487e
0x6dfd4870
0x6dfd4866
0x6dfd485b
0x6dfd47de
0x6dfd47e0
0x6dfd47e2
0x6dfd47e2
0x6dfd47e4
0x6dfd47e4
0x6dfd47dc
0x6dfd47b0
0x6dfd478b
0x00000000
0x6dfd4794
0x6dfd4794
0x6dfd4797
0x6dfd479a
0x6dfd477d
0x00000000
0x6dfd476c
0x6dfd473d
0x6dfd473d
0x6dfd473f
0x6dfd4740
0x6dfd474e
0x00000000
0x6dfd4753
0x6dfd473b
0x6dfd46dc
0x6dfd46dc
0x6dfd46dd
0x6dfd46ed
0x6dfd46f5
0x6dfd46f5
0x6dfd46f5
0x6dfd48c4
0x6dfd48cb

APIs

DbgPrintEx.9419(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6DF917F0,00000000,?,00000000,?), ref: 6DFD46ED

Part of subcall function 6DF71D47: memset.9419(00000000,00000000,6DF917F0,?,00000001,00000000,?,6DF48D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6DF71D87

DbgPrintEx.9419(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6E01FE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6DFD474E
memcpy.9419(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6DF917F0,00000000,?,00000000), ref: 6DFD4831
memcpy.9419(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6DF917F0,00000000,?,00000000), ref: 6DFD48A2

Strings

RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6DFD46E0, 6DFD4741
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6DFD46E5
SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6DFD4746

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: c918ca6ed849b56f42e48302aaeea146768289b19ca87aa749022ee7d23633c2
Instruction ID: 6751828ef05e9c301a47a2ce4959d2f3f4b4a0f0d0692798cbae2754cf3f084d
Opcode Fuzzy Hash: c918ca6ed849b56f42e48302aaeea146768289b19ca87aa749022ee7d23633c2
Instruction Fuzzy Hash: AC811C75E0021ADFDB40CF9CC8C0AAEB7B5FF49354B298559E914AB306D331EA51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD4496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6DFD4496(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				short _v12;
				char _v16;
				char _v20;
				intOrPtr _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr* _t128;
				void* _t154;
				intOrPtr _t155;
				intOrPtr* _t162;
				void* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				void* _t171;
				short* _t172;
				short* _t173;
				short* _t174;
				void* _t175;

				_t170 = _a12;
				_t167 = __edx;
				_v16 = 0xc00000e5;
				_t165 = __ecx;
				_v12 = 0;
				if(_t170 != 0) {
					 *_t170 = 0;
				}
				_t96 =  *((intOrPtr*)(_t165 + 0x18));
				_t154 =  *((intOrPtr*)(_t96 + _t165 + 0xc)) + _t165;
				if(_t167 <  *((intOrPtr*)(_t96 + _t165 + 8))) {
					asm("lfence");
					_push( &_v20);
					_t169 =  *((intOrPtr*)(_t167 * 0x18 + _t154 + 0x10)) + _t165;
					_push( &_v8);
					_push(1);
					_push(0);
					_push(_t165);
					_t155 = 0x58;
					_push(_t155);
					_push(_t170);
					_push(_a8);
					_push(_a4);
					E6DF71D47( &_v16);
					if(_v12 == 0) {
						return _v16;
					}
					_t20 = _t169 + 8; // 0xffffff98
					_t106 =  *_t20;
					if(_t106 != 0) {
						_t21 = _t106 + 0x5a; // 0xfffffff2
						_t155 = _t21;
					}
					_t22 = _t169 + 0x14; // 0x0
					_t107 =  *_t22;
					if(_t107 != 0) {
						_t155 = _t155 + 2 + _t107;
					}
					_t23 = _t169 + 0x28; // 0xffffffc4
					_t108 =  *_t23;
					if(_t108 != 0) {
						_t155 = _t155 + 2 + _t108;
					}
					_t24 = _t169 + 0x50; // 0xfffffecc
					_t109 =  *_t24;
					if(_t109 != 0) {
						_t155 = _t155 + 2 + _t109;
					}
					if(_t155 <= _a8) {
						_t162 = _a4;
						_t27 = _t169 + 4; // 0x0
						 *_t162 =  *_t27;
						_t28 = _t162 + 0x58; // 0x59
						_t171 = _t28;
						_t29 = _t169 + 8; // 0xffffff98
						 *((intOrPtr*)(_t162 + 4)) =  *_t29;
						_t31 = _t169 + 0x10; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 8)) =  *_t31;
						_t33 = _t169 + 0x14; // 0x0
						 *((intOrPtr*)(_t162 + 0xc)) =  *_t33;
						_t35 = _t169 + 0x1c; // 0x0
						 *((intOrPtr*)(_t162 + 0x10)) =  *_t35;
						_t37 = _t169 + 0x20; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x14)) =  *_t37;
						_t39 = _t169 + 0x24; // 0x0
						 *((intOrPtr*)(_t162 + 0x18)) =  *_t39;
						_t41 = _t169 + 0x28; // 0xffffffc4
						 *((intOrPtr*)(_t162 + 0x1c)) =  *_t41;
						_t43 = _t169 + 0x30; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x20)) =  *_t43;
						_t45 = _t169 + 0x34; // 0x0
						 *((intOrPtr*)(_t162 + 0x24)) =  *_t45;
						_t47 = _t169 + 0x38; // 0x6dfb4794
						 *((intOrPtr*)(_t162 + 0x28)) =  *_t47;
						_t49 = _t169 + 0x40; // 0x0
						 *((intOrPtr*)(_t162 + 0x2c)) =  *_t49;
						_t51 = _t169 + 0x44; // 0x6dfb47bb
						 *((intOrPtr*)(_t162 + 0x30)) =  *_t51;
						_t53 = _t169 + 0x48; // 0xffffffe4
						 *((intOrPtr*)(_t162 + 0x34)) =  *_t53;
						_t55 = _t169 + 0x4c; // 0x0
						 *((intOrPtr*)(_t162 + 0x38)) =  *_t55;
						_t57 = _t169 + 0x50; // 0xfffffecc
						 *((intOrPtr*)(_t162 + 0x3c)) =  *_t57;
						 *((intOrPtr*)(_t162 + 0x40)) = 0;
						 *((intOrPtr*)(_t162 + 0x44)) = 0;
						 *((intOrPtr*)(_t162 + 0x48)) = 0;
						 *((intOrPtr*)(_t162 + 0x4c)) = 0;
						_t63 = _t169 + 0x58; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x50)) =  *_t63;
						if( *(_t169 + 8) != 0) {
							_t66 = _t169 + 8; // 0xffffff98
							_t67 = _t169 + 0xc; // 0x0
							memcpy(_t171,  *_t67 + _v8,  *_t66);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x40) = _t171;
							_t71 = _t169 + 8; // 0xffffff98
							_t174 = _t171 +  *_t71;
							 *_t174 = 0;
							_t171 = _t174 + 2;
						}
						if( *(_t169 + 0x14) != 0) {
							_t73 = _t169 + 0x14; // 0x0
							_t74 = _t169 + 0x18; // 0x6dfb4765
							memcpy(_t171,  *_t74 + _v8,  *_t73);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x44) = _t171;
							_t78 = _t169 + 0x14; // 0x0
							_t173 = _t171 +  *_t78;
							 *_t173 = 0;
							_t171 = _t173 + 2;
						}
						if( *(_t169 + 0x28) != 0) {
							_t80 = _t169 + 0x28; // 0xffffffc4
							_t81 = _t169 + 0x2c; // 0x0
							memcpy(_t171,  *_t81 + _v8,  *_t80);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x48) = _t171;
							_t85 = _t169 + 0x28; // 0xffffffc4
							_t172 = _t171 +  *_t85;
							 *_t172 = 0;
							_t171 = _t172 + 2;
						}
						if( *(_t169 + 0x50) != 0) {
							_t87 = _t169 + 0x50; // 0xfffffecc
							_t88 = _t169 + 0x54; // 0x0
							memcpy(_t171,  *_t88 + _v8,  *_t87);
							 *(_a4 + 0x4c) = _t171;
							_t92 = _t169 + 0x50; // 0xfffffecc
							 *((short*)(_t171 +  *_t92)) = 0;
						}
						_t128 = _a12;
						if(_t128 != 0) {
							 *_t128 = _t155;
						}
						return 0;
					} else {
						if(_t170 != 0) {
							 *_t170 = _t155;
						}
						return 0xc0000023;
					}
				} else {
					_push( *((intOrPtr*)(_t96 + _t165 + 8)));
					_push(_t167);
					E6DFD5720(0x33, 0, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryAssemblyInformationActivationContextDetailedInformation");
					return 0xc000000d;
				}
			}

0x6dfd44a0
0x6dfd44a4
0x6dfd44a6
0x6dfd44ad
0x6dfd44b1
0x6dfd44b6
0x6dfd44b8
0x6dfd44b8
0x6dfd44ba
0x6dfd44c1
0x6dfd44c7
0x6dfd44f0
0x6dfd44fa
0x6dfd44fe
0x6dfd4500
0x6dfd4504
0x6dfd4506
0x6dfd4507
0x6dfd450a
0x6dfd450b
0x6dfd450c
0x6dfd450d
0x6dfd4513
0x6dfd4517
0x6dfd4523
0x00000000
0x6dfd4698
0x6dfd4529
0x6dfd4529
0x6dfd452e
0x6dfd4530
0x6dfd4530
0x6dfd4530
0x6dfd4533
0x6dfd4533
0x6dfd4538
0x6dfd453d
0x6dfd453d
0x6dfd453f
0x6dfd453f
0x6dfd4544
0x6dfd4549
0x6dfd4549
0x6dfd454b
0x6dfd454b
0x6dfd4550
0x6dfd4555
0x6dfd4555
0x6dfd455a
0x6dfd456c
0x6dfd456f
0x6dfd4572
0x6dfd4574
0x6dfd4574
0x6dfd4577
0x6dfd457a
0x6dfd457d
0x6dfd4580
0x6dfd4583
0x6dfd4586
0x6dfd4589
0x6dfd458c
0x6dfd458f
0x6dfd4592
0x6dfd4595
0x6dfd4598
0x6dfd459b
0x6dfd459e
0x6dfd45a1
0x6dfd45a4
0x6dfd45a7
0x6dfd45aa
0x6dfd45ad
0x6dfd45b0
0x6dfd45b3
0x6dfd45b6
0x6dfd45b9
0x6dfd45bc
0x6dfd45bf
0x6dfd45c2
0x6dfd45c5
0x6dfd45c8
0x6dfd45cb
0x6dfd45ce
0x6dfd45d3
0x6dfd45d6
0x6dfd45d9
0x6dfd45dc
0x6dfd45df
0x6dfd45e2
0x6dfd45e9
0x6dfd45eb
0x6dfd45ee
0x6dfd45f6
0x6dfd45fe
0x6dfd4601
0x6dfd4606
0x6dfd4606
0x6dfd4609
0x6dfd460c
0x6dfd460c
0x6dfd4613
0x6dfd4615
0x6dfd4618
0x6dfd4620
0x6dfd4628
0x6dfd462b
0x6dfd4630
0x6dfd4630
0x6dfd4633
0x6dfd4636
0x6dfd4636
0x6dfd463d
0x6dfd463f
0x6dfd4642
0x6dfd464a
0x6dfd4652
0x6dfd4655
0x6dfd465a
0x6dfd465a
0x6dfd465d
0x6dfd4660
0x6dfd4660
0x6dfd4667
0x6dfd4669
0x6dfd466c
0x6dfd4674
0x6dfd4681
0x6dfd4684
0x6dfd4687
0x6dfd4687
0x6dfd468b
0x6dfd4690
0x6dfd4692
0x6dfd4692
0x00000000
0x6dfd455c
0x6dfd455e
0x6dfd4560
0x6dfd4560
0x00000000
0x6dfd4562
0x6dfd44c9
0x6dfd44c9
0x6dfd44cd
0x6dfd44db
0x00000000
0x6dfd44e3

APIs

DbgPrintEx.9419(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6DF917F0,00000000,?,?), ref: 6DFD44DB

Part of subcall function 6DF71D47: memset.9419(00000000,00000000,6DF917F0,?,00000001,00000000,?,6DF48D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6DF71D87

memcpy.9419(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6DF917F0,00000000,?,?), ref: 6DFD45F6
memcpy.9419(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6DF917F0,00000000,?,?), ref: 6DFD4620
memcpy.9419(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6DF917F0,00000000,?,?), ref: 6DFD464A
memcpy.9419(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6DF917F0,00000000,?,?), ref: 6DFD4674

Strings

RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6DFD44CE
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6DFD44D3

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: 375696726b623449b5fe07d867aa89ca44c902f9f1ab3707448e5ab7dd10796e
Instruction ID: 6b4e3c9334e6ebed727e145243c8e7418fbe27468d11c80edfa786cc318a6ed5
Opcode Fuzzy Hash: 375696726b623449b5fe07d867aa89ca44c902f9f1ab3707448e5ab7dd10796e
Instruction Fuzzy Hash: 2B81E6B5A00606AFD754CF2DC880A9AB7F4FF08318B154569E919DB701E332F9A2CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6DF442EB, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 90
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6DF442EB(void* __ecx) {
				int _v8;
				void* _v12;
				void* _t25;
				void* _t29;
				int _t32;
				int _t35;
				intOrPtr _t37;
				char* _t40;
				intOrPtr _t42;
				int _t45;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t52;
				void* _t54;
				void* _t55;

				_push(__ecx);
				_push(__ecx);
				_t37 =  *((intOrPtr*)(__ecx + 0x18));
				_t52 = 0;
				E6DF5E9C0(3, _t37, 0, 0,  &_v12);
				_t49 = _v12;
				_t42 =  *((intOrPtr*)(_t49 + 0x78));
				if(_t42 != 0) {
					if( *((intOrPtr*)(_t49 + 0x7c)) <= 0) {
						goto L1;
					}
					_t46 =  *((intOrPtr*)(_t49 + 0x50));
					if(_t42 >= _t46 - 0xd) {
						goto L1;
					}
					_t43 =  *((intOrPtr*)(_t42 + _t37 + 0xc));
					if( *((intOrPtr*)(_t42 + _t37 + 0xc)) > _t46 - 0xc) {
						goto L1;
					}
					_push(0xc);
					_t29 = E6DF8E000(_t43 + _t37, "secserv.dll");
					_t55 = _t54 + 0xc;
					if(_t29 != 0) {
						goto L1;
					}
					_t40 = _t49 + 0x18 + ( *(_t49 + 0x14) & 0x0000ffff);
					_t45 = 1;
					_t32 = 1;
					_v12 = 1;
					_v8 = 1;
					if(0 >=  *(_t49 + 6)) {
						goto L1;
					} else {
						L9:
						while(1) {
							if(_t32 != 0) {
								_t35 = strncmp(_t40, ".txt", 5);
								_t45 = _v12;
								_t55 = _t55 + 0xc;
								_v8 = _t35;
							}
							if(_t45 != 0) {
								_t45 = strncmp(_t40, ".txt2", 6);
								_t55 = _t55 + 0xc;
								_v12 = _t45;
							}
							if(_v8 != 0 || _t45 != 0) {
								_t40 =  &(_t40[0x28]);
								_t52 = _t52 + 1;
								if(_t52 >= ( *(_t49 + 6) & 0x0000ffff)) {
									goto L1;
								}
								_t32 = _v8;
								continue;
							} else {
								_t25 = 1;
								L2:
								return _t25;
							}
						}
					}
				}
				L1:
				_t25 = 0;
				goto L2;
			}

0x6df442f0
0x6df442f1
0x6df442f3
0x6df442fc
0x6df44303
0x6df44308
0x6df4430b
0x6df44310
0x6df4431e
0x00000000
0x00000000
0x6df44320
0x6df44328
0x00000000
0x00000000
0x6df4432a
0x6df44333
0x00000000
0x00000000
0x6df44335
0x6df44340
0x6df44345
0x6df4434a
0x00000000
0x00000000
0x6dfa06b7
0x6dfa06bd
0x6dfa06be
0x6dfa06bf
0x6dfa06c4
0x6dfa06cb
0x00000000
0x00000000
0x00000000
0x6dfa06d1
0x6dfa06d3
0x6dfa06dd
0x6dfa06e2
0x6dfa06e5
0x6dfa06e8
0x6dfa06e8
0x6dfa06ed
0x6dfa06fc
0x6dfa06fe
0x6dfa0701
0x6dfa0701
0x6dfa0708
0x6dfa0719
0x6dfa071c
0x6dfa071f
0x00000000
0x00000000
0x6dfa0725
0x00000000
0x6dfa070e
0x6dfa070e
0x6df44314
0x6df4431a
0x6df4431a
0x6dfa0708
0x6dfa06d1
0x6dfa06cb
0x6df44312
0x6df44312
0x00000000

APIs

RtlImageNtHeaderEx.9419(00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6DF44176,00000003,?,00000000,00000000), ref: 6DF44303
_strnicmp.9419(?,secserv.dll,0000000C,00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6DF44176,00000003), ref: 6DF44340
strncmp.9419(?,.txt,00000005), ref: 6DFA06DD
strncmp.9419(?,.txt2,00000006), ref: 6DFA06F7

Strings

.txt, xrefs: 6DFA06D7
secserv.dll, xrefs: 6DF4433A
.txt2, xrefs: 6DFA06F1

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage_strnicmp
String ID: .txt$.txt2$secserv.dll
API String ID: 290936131-436433099
Opcode ID: 861926b5bf4dbd50f33d3a0c6035861be0517e2893829eff8e3e3614c8288cc8
Instruction ID: bd60c974bf30807469f5c4d22a4651c73f9eba0ac5b7b90e39399b4ee58aab23
Opcode Fuzzy Hash: 861926b5bf4dbd50f33d3a0c6035861be0517e2893829eff8e3e3614c8288cc8
Instruction Fuzzy Hash: 9E21E470A0421AB7DB14CE5E9891ABAFB78BF45748F108128E505A7242F3B0E981DA90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF441F7, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DF441F7(intOrPtr __ecx) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _t26;
				int _t31;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				void* _t37;
				intOrPtr _t39;
				void* _t40;
				char* _t42;
				void* _t43;
				int _t49;

				_t33 = __ecx;
				_v12 = __ecx;
				E6DF5E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v8);
				_t40 = 0;
				_t34 = _v8;
				_v16 =  *((intOrPtr*)(_t33 + 0x1c));
				_t42 = _t34 + 0x18 + ( *(_t34 + 0x14) & 0x0000ffff);
				if(0 >=  *(_t34 + 6)) {
					L8:
					return 0;
				} else {
					goto L1;
				}
				do {
					L1:
					if(_t42[0xc] != 0 && _t42[8] != 0) {
						_t26 = strncmp(_t42, ".aspack", 8);
						_t43 = _t43 + 0xc;
						if(_t26 == 0) {
							L11:
							_t39 = _v16;
							_t37 = _t42[0xc] +  *((intOrPtr*)(_v12 + 0x18));
							if(_t39 >= _t37 && _t39 <= _t42[8] + _t37) {
								L6:
								if(_t49 == 0) {
									return 1;
								}
							}
							goto L7;
						}
						_t31 = strncmp(_t42, ".pcle", 6);
						_t43 = _t43 + 0xc;
						if(_t31 == 0) {
							goto L11;
						}
						_t32 = strncmp(_t42, ".sforce", 8);
						_t43 = _t43 + 0xc;
						_t49 = _t32;
						goto L6;
					}
					L7:
					_t40 = _t40 + 1;
					_t42 =  &(_t42[0x28]);
				} while (_t40 < ( *(_t34 + 6) & 0x0000ffff));
				goto L8;
			}

0x6df44205
0x6df4420f
0x6df44214
0x6df4421c
0x6df4421e
0x6df44221
0x6df4422b
0x6df44233
0x6df44291
0x00000000
0x00000000
0x00000000
0x00000000
0x6df44235
0x6df44235
0x6df44239
0x6df44249
0x6df4424e
0x6df44253
0x6dfa064c
0x6dfa0652
0x6dfa0655
0x6dfa065a
0x6df44283
0x6df44283
0x00000000
0x6df4429a
0x6df44283
0x00000000
0x6dfa065a
0x6df44261
0x6df44266
0x6df4426b
0x00000000
0x00000000
0x6df44279
0x6df4427e
0x6df44281
0x00000000
0x6df44281
0x6df44285
0x6df44289
0x6df4428a
0x6df4428d
0x00000000

APIs

RtlImageNtHeaderEx.9419(00000003,?,00000000,00000000,?,?,?,00000000), ref: 6DF44214
strncmp.9419(?,.aspack,00000008,00000003,?,00000000,00000000,?,?,?,00000000), ref: 6DF44249
strncmp.9419(?,.pcle,00000006,?,?,00000000), ref: 6DF44261
strncmp.9419(?,.sforce,00000008,?,?,?,?,?,00000000), ref: 6DF44279

Strings

.sforce, xrefs: 6DF44273
.aspack, xrefs: 6DF44243
.pcle, xrefs: 6DF4425B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage
String ID: .aspack$.pcle$.sforce
API String ID: 3137002299-3067156003
Opcode ID: e8ecb68e1170441fe848c69306e03bc80fc55de4b279dce2c588636d17f41cc4
Instruction ID: 8a2fac54a4193c36e87d3f17609e196c4ab8cbda2e21da3279de3ba5d3dadd8f
Opcode Fuzzy Hash: e8ecb68e1170441fe848c69306e03bc80fc55de4b279dce2c588636d17f41cc4
Instruction Fuzzy Hash: F721DB31B40211A7E710CF9DDC81B6F77A99F58344F00C155ED48B6247E6B1DE91CA91

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5EC7F, Relevance: 12.3, APIs: 8, Instructions: 256
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DF5EC7F(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t65;
				intOrPtr* _t67;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				intOrPtr _t76;
				signed int _t77;
				void* _t78;
				intOrPtr _t80;
				signed int _t81;
				void* _t83;
				void* _t85;
				intOrPtr _t90;
				void* _t91;
				void* _t96;
				void _t99;
				intOrPtr* _t104;
				intOrPtr* _t106;
				unsigned int _t112;
				unsigned int _t114;
				intOrPtr* _t115;
				void* _t118;
				intOrPtr _t120;
				unsigned int _t122;
				unsigned int _t124;
				intOrPtr* _t125;
				intOrPtr* _t129;
				intOrPtr* _t134;
				intOrPtr* _t136;
				void* _t138;
				signed int* _t140;
				void* _t141;
				void* _t143;
				void* _t146;
				intOrPtr _t148;
				void* _t149;
				void* _t151;
				void* _t153;

				_push(_t96);
				_t146 = __ecx;
				_push(_t138);
				_t65 =  *(__ecx + 0x50);
				if( *((intOrPtr*)(_t65 + 0xc)) == 0xffffffff) {
					L3:
					return _t65;
				} else {
					_t65 =  *_t65;
					if(( *(_t65 - 0x20) & 0x00000020) != 0) {
						goto L3;
					} else {
						_t65 = _t65 | 0xffffffff;
						asm("lock xadd [esi+0x9c], eax");
						if(_t65 == 0) {
							E6DF62280(_t65, 0x6e0384d8);
							_t67 = _t146 + 0x54;
							_t120 =  *_t67;
							if( *((intOrPtr*)(_t120 + 4)) != _t67) {
								L15:
								_push(3);
								asm("int 0x29");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0x30);
								_push(0x6e01fb78);
								E6DF9D08C(_t96, _t138, _t146);
								_t148 =  *((intOrPtr*)(_t153 + 8));
								if(_t148 == 0) {
									L59:
									_t69 = 0xc000000d;
								} else {
									_t140 =  *(_t153 + 0x14);
									if(_t140 == 0) {
										goto L59;
									} else {
										 *((intOrPtr*)(_t153 - 4)) = 0;
										if( *((intOrPtr*)(_t153 + 0xc)) >= 0x10000) {
											_t122 =  *(_t148 + 0x58) >> 1;
											 *(_t153 - 0x20) = _t122;
											_t104 =  *((intOrPtr*)(_t148 + 0x54)) + _t148;
											 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
											if(_t104 <= 0x10000) {
												L37:
												if( *_t104 == 0) {
													goto L54;
												} else {
													_t72 = 1;
													if(_t122 <= 0) {
														goto L54;
													}
												}
											} else {
												while(_t122 > 0) {
													if( *_t104 == 0) {
														L54:
														_t72 = 0;
													} else {
														_t78 = E6DF8E490( *((intOrPtr*)(_t153 + 0xc)), _t104);
														_t104 =  *((intOrPtr*)(_t153 - 0x1c));
														if(_t78 != 0) {
															_t129 = _t104;
															_t54 = _t129 + 2; // 0x22
															 *((intOrPtr*)(_t153 - 0x2c)) = _t54;
															do {
																_t80 =  *_t129;
																_t129 = _t129 + 2;
															} while (_t80 != 0);
															_t81 = (_t129 -  *((intOrPtr*)(_t153 - 0x2c)) >> 1) + 1;
															_t104 = _t104 + _t81 * 2;
															 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
															_t122 =  *(_t153 - 0x20) - _t81;
															 *(_t153 - 0x20) = _t122;
															continue;
														} else {
															_t122 =  *(_t153 - 0x20);
															goto L37;
														}
													}
													goto L39;
												}
												goto L37;
											}
											L39:
											if(_t72 == 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t124 =  *(_t148 + 0x68) >> 1;
											 *(_t153 - 0x28) = _t124;
											_t106 =  *((intOrPtr*)(_t148 + 0x64)) + _t148;
											 *((intOrPtr*)(_t153 - 0x24)) = _t106;
											if(_t106 <= 0x10000) {
												L56:
												if( *_t106 == 0 || _t124 <= 0) {
													goto L29;
												} else {
													_t73 = 1;
												}
											} else {
												while(_t124 > 0) {
													if( *_t106 == 0) {
														L29:
														_t73 = 0;
													} else {
														_t75 = E6DF8E490( *((intOrPtr*)(_t153 + 0xc)), _t106);
														_t106 =  *((intOrPtr*)(_t153 - 0x24));
														if(_t75 == 0) {
															_t124 =  *(_t153 - 0x28);
															goto L56;
														} else {
															_t125 = _t106;
															_t47 = _t125 + 2; // 0xc00000e7
															_t149 = _t47;
															do {
																_t76 =  *_t125;
																_t125 = _t125 + 2;
															} while (_t76 != 0);
															_t48 = (_t125 - _t149 >> 1) + 1; // 0xc00000e4
															_t77 = _t48;
															_t106 = _t106 + _t77 * 2;
															 *((intOrPtr*)(_t153 - 0x24)) = _t106;
															_t124 =  *(_t153 - 0x28) - _t77;
															 *(_t153 - 0x28) = _t124;
															continue;
														}
													}
													goto L30;
												}
												goto L56;
											}
											L30:
											if(_t73 != 0) {
												goto L27;
											} else {
												goto L31;
											}
											goto L62;
										} else {
											_t112 =  *(_t148 + 0x60) >> 2;
											 *(_t153 - 0x30) = _t112;
											_t134 =  *((intOrPtr*)(_t148 + 0x5c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x34)) = _t134;
											while(1) {
												_t112 = _t112 - 1;
												 *(_t153 - 0x30) = _t112;
												if(_t112 < 0) {
													break;
												}
												_t85 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t134;
												_t134 = _t134 + 4;
												 *((intOrPtr*)(_t153 - 0x34)) = _t134;
												if(_t85 != 0) {
													continue;
												}
												break;
											}
											if(_t112 < 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t114 =  *(_t148 + 0x70) >> 2;
											 *(_t153 - 0x38) = _t114;
											_t136 =  *((intOrPtr*)(_t148 + 0x6c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
											while(1) {
												_t114 = _t114 - 1;
												 *(_t153 - 0x38) = _t114;
												if(_t114 < 0) {
													break;
												}
												_t83 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t136;
												_t136 = _t136 + 4;
												 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
												if(_t83 != 0) {
													continue;
												}
												break;
											}
											if(_t114 < 0) {
												L31:
												 *_t140 =  *_t140 | 0x00020000;
											}
										}
										L27:
										 *((intOrPtr*)(_t153 - 4)) = 0xfffffffe;
										_t69 = 0;
									}
								}
								return E6DF9D0D1(_t69);
							} else {
								_t115 =  *((intOrPtr*)(_t67 + 4));
								if( *_t115 != _t67) {
									goto L15;
								} else {
									 *_t115 = _t120;
									 *((intOrPtr*)(_t120 + 4)) = _t115;
									_t141 =  *(_t146 + 0x50);
									_t99 =  *_t141;
									E6DF5FFB0(_t99, _t141, 0x6e0384d8);
									if( *((intOrPtr*)(_t146 + 0x3a)) != 0) {
										E6DF837F5(_t146, 0);
									}
									E6DF80413(_t146);
									_t90 =  *((intOrPtr*)(_t146 + 0x48));
									if(_t90 != 0) {
										if(_t90 != 0xffffffff) {
											E6DF79B10(_t90);
										}
									}
									if( *((intOrPtr*)(_t146 + 0x28)) != 0) {
										E6DF702D6(_t146 + 0x24);
									}
									_t65 = RtlFreeHeap( *0x6e037b98, 0, _t146);
									if(_t99 != _t141) {
										goto L3;
									} else {
										_t118 = _t141;
										_pop(_t142);
										_pop(_t150);
										_t143 = _t118;
										_t91 =  *(_t143 + 8);
										if(_t91 != 0) {
											do {
												_t151 =  *_t91;
												RtlFreeHeap( *0x6e037b98, 0, _t91);
												_t91 = _t151;
											} while (_t151 != 0);
										}
										return RtlFreeHeap( *0x6e037b98, 0, _t143);
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L62:
			}

0x6df5ec81
0x6df5ec83
0x6df5ec85
0x6df5ec86
0x6df5ec8d
0x6df5eca4
0x6df5eca7
0x6df5ec8f
0x6df5ec8f
0x6df5ec95
0x00000000
0x6df5ec97
0x6df5ec97
0x6df5ec9a
0x6df5eca2
0x6df5ecad
0x6df5ecb2
0x6df5ecb5
0x6df5ecba
0x6df5ed2f
0x6df5ed2f
0x6df5ed32
0x6df5ed34
0x6df5ed35
0x6df5ed36
0x6df5ed37
0x6df5ed38
0x6df5ed39
0x6df5ed3a
0x6df5ed3b
0x6df5ed3c
0x6df5ed3d
0x6df5ed3e
0x6df5ed3f
0x6df5ed40
0x6df5ed42
0x6df5ed47
0x6df5ed4e
0x6df5ed53
0x6dfabaf2
0x6dfabaf2
0x6df5ed59
0x6df5ed59
0x6df5ed5e
0x00000000
0x6df5ed64
0x6df5ed64
0x6df5ed6f
0x6df5edf1
0x6df5edf3
0x6df5edf9
0x6df5edfb
0x6df5ee00
0x6df5ee28
0x6df5ee2b
0x00000000
0x6df5ee31
0x6df5ee33
0x6df5ee35
0x00000000
0x00000000
0x6df5ee35
0x6df5ee02
0x6df5ee02
0x6df5ee09
0x6dfabaae
0x6dfabaae
0x6df5ee0f
0x6df5ee13
0x6df5ee1a
0x6df5ee1f
0x6df5eea9
0x6df5eeab
0x6df5eeae
0x6df5eeb1
0x6df5eeb1
0x6df5eeb4
0x6df5eeb7
0x6df5eec1
0x6df5eec4
0x6df5eec7
0x6df5eecd
0x6df5eecf
0x00000000
0x6df5ee25
0x6df5ee25
0x00000000
0x6df5ee25
0x6df5ee1f
0x00000000
0x6df5ee09
0x00000000
0x6df5ee02
0x6df5ee3b
0x6df5ee3d
0x6dfabab5
0x6dfabab5
0x6df5ee46
0x6df5ee48
0x6df5ee4e
0x6df5ee50
0x6df5ee59
0x6dfabac0
0x6dfabac3
0x00000000
0x6dfabad1
0x6dfabad3
0x6dfabad3
0x6df5ee5f
0x6df5ee5f
0x6df5ee6a
0x6df5ede0
0x6df5ede0
0x6df5ee70
0x6df5ee74
0x6df5ee7b
0x6df5ee80
0x6df5eed7
0x00000000
0x6df5ee82
0x6df5ee82
0x6df5ee84
0x6df5ee84
0x6df5ee87
0x6df5ee87
0x6df5ee8a
0x6df5ee8d
0x6df5ee96
0x6df5ee96
0x6df5ee99
0x6df5ee9c
0x6df5eea2
0x6df5eea4
0x00000000
0x6df5eea4
0x6df5ee80
0x00000000
0x6df5ee6a
0x00000000
0x6df5ee5f
0x6df5ede2
0x6df5ede4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df5ed71
0x6df5ed74
0x6df5ed77
0x6df5ed7d
0x6df5ed7f
0x6df5ed82
0x6df5ed82
0x6df5ed85
0x6df5ed88
0x00000000
0x00000000
0x6df5ed8d
0x6df5ed8f
0x6df5ed92
0x6df5ed97
0x00000000
0x00000000
0x00000000
0x6df5ed97
0x6df5ed9b
0x6df5ed9d
0x6df5ed9d
0x6df5eda6
0x6df5eda9
0x6df5edaf
0x6df5edb1
0x6df5edb4
0x6df5edb4
0x6df5edb7
0x6df5edba
0x00000000
0x00000000
0x6df5edbf
0x6df5edc1
0x6df5edc4
0x6df5edc9
0x00000000
0x00000000
0x00000000
0x6df5edc9
0x6df5edcd
0x6df5ede6
0x6df5ede6
0x6df5ede6
0x6df5edcd
0x6df5edcf
0x6df5edcf
0x6df5edd6
0x6df5edd6
0x6df5ed5e
0x6df5eddd
0x6df5ecbc
0x6df5ecbc
0x6df5ecc1
0x00000000
0x6df5ecc3
0x6df5ecc3
0x6df5ecc5
0x6df5ecc8
0x6df5ecd0
0x6df5ecd2
0x6df5ecdd
0x6df5ed1b
0x6df5ed1b
0x6df5ece1
0x6df5ece6
0x6df5eceb
0x6df5ed25
0x6df5ed28
0x6df5ed28
0x6df5ed25
0x6df5ecf1
0x6df5ecf6
0x6df5ecf6
0x6df5ed04
0x6df5ed0b
0x00000000
0x6df5ed0d
0x6df5ed0d
0x6df5ed0f
0x6df5ed10
0x6df7c27a
0x6df7c27c
0x6df7c281
0x6dfba692
0x6dfba692
0x6dfba69d
0x6dfba6a2
0x6dfba6a4
0x6dfba6a8
0x6df7c292
0x6df7c292
0x6df5ed0b
0x6df5ecc1
0x00000000
0x00000000
0x00000000
0x6df5eca2
0x6df5ec95
0x00000000

APIs

RtlAcquireSRWLockExclusive.9419(6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001,-00000F38), ref: 6DF5ECAD
RtlReleaseSRWLockExclusive.9419(6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001,-00000F38), ref: 6DF5ECD2
RtlFreeHeap.9419(00000000,?,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001,-00000F38), ref: 6DF5ED04
RtlReleaseActivationContext.9419(-00000F38,6E0384D8,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001,-00000F38), ref: 6DF5ED28
_wcsicmp.9419(6E01FE98,?,6E01FB78,00000030,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001,-00000F38), ref: 6DF5EE13
_wcsicmp.9419(6E01FE98,?,6E01FB78,00000030,6E0384D8,6DF917F0,00000000,?,6DF6F715,6DF6F5C0,?,?,?,00000001,-00000F38), ref: 6DF5EE74
RtlFreeHeap.9419(00000000,?,6DF917F0,6DF6F715,6DF6F5C0,?,?,?,00000001,-00000F38), ref: 6DF7C28C

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: 1f2f45261f99798a25e1032b99d275712328df5c2b391f32398ccc2a727073d6
Instruction ID: 4bce71d950be6ba976a928592648cd238378a40b28c289b52912d6b76ff597fa
Opcode Fuzzy Hash: 1f2f45261f99798a25e1032b99d275712328df5c2b391f32398ccc2a727073d6
Instruction Fuzzy Hash: B581F431A14206CFCB15CF6DD844AAAB7B2FF85318F24852DE955EB690E730E952CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DF47220, Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DF47220(char* _a4, intOrPtr _a8, intOrPtr* _a12, signed int* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				char _v25;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				void* _t60;
				signed int _t64;
				signed int _t65;
				signed short _t67;
				void* _t76;
				void* _t80;
				signed int _t81;
				intOrPtr* _t87;
				void* _t88;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed char _t96;
				signed char _t99;
				intOrPtr _t105;
				void* _t110;
				void* _t111;
				intOrPtr _t112;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				char* _t122;
				intOrPtr* _t123;
				signed int _t124;

				_v8 =  *0x6e03d360 ^ _t124;
				_t87 = _a12;
				_t122 = _a4;
				_v44 = _a16;
				_t119 =  &_v24;
				do {
					_v36 = _v36 & 0x00000000;
					_v25 = 0;
					_t54 = 0xa;
					_v40 = _t54;
					if( *_t122 == 0x30) {
						_t123 = _t122 + 1;
						_t56 = E6DF8CB30( *_t123,  *_t123);
						_pop(_t88);
						if(_t56 == 0 || E6DF8CC80(_t88,  *_t123) == 0) {
							_t57 =  *_t123;
							if(_t57 == 0x78 || _t57 == 0x58) {
								_push(0x10);
								_t123 = _t123 + 1;
								goto L22;
							} else {
								_t54 = _v40;
								_v25 = 1;
								goto L2;
							}
						} else {
							_push(8);
							L22:
							_pop(_t54);
							_v40 = _t54;
							goto L2;
						}
					}
					L2:
					if(_a8 == 0 || _t54 == 0xa) {
						_t58 =  *_t123;
						if(_t58 == 0) {
							_t90 = _v25;
							_t117 = _v36;
							L10:
							if( *_t123 == 0x2e) {
								if(_t119 >=  &_v12) {
									goto L12;
								}
								goto L36;
							}
							if(_t90 != 0) {
								 *_t119 = _t117;
								_t119 = _t119 -  &_v24 + 4 >> 2;
								if(_t90 == 0 || _t119 == 4) {
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t93 = _v24;
										L58:
										asm("bswap ecx");
										 *_t87 = _t123;
										 *_v44 = _t93;
										_t60 = 0;
										goto L13;
									}
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t94 = _v24;
										if(_t94 > 0xff) {
											goto L12;
										}
										_t64 = _v20;
										_t117 = 0xffffff;
										if(_t64 > 0xffffff) {
											goto L12;
										}
										_t95 = _t94 << 0x18;
										_t65 = _t64 & 0x00ffffff;
										L56:
										_t93 = _t95 | _t65;
										goto L58;
									}
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t117 = _v24;
										if(_t117 > 0xff) {
											goto L12;
										}
										_t96 = _v20;
										if(_t96 > 0xff) {
											goto L12;
										}
										_t67 = _v16;
										if(_t67 > 0xffff) {
											goto L12;
										}
										_t117 = _t117 << 8;
										_t65 = _t67 & 0x0000ffff;
										_t95 = (_t96 & 0x000000ff | _t117) << 0x10;
										goto L56;
									}
									if(_t119 != 0) {
										goto L12;
									}
									_t117 = _v24;
									if(_t117 > 0xff) {
										goto L12;
									}
									_t99 = _v20;
									if(_t99 > 0xff || _v16 > 0xff || _v12 > 0xff) {
										goto L12;
									} else {
										_t95 = ((_t99 & 0x000000ff | _t117) << 0x00000008 | _v16 & 0x000000ff) << 8;
										_t65 = _v12 & 0x000000ff;
										goto L56;
									}
								} else {
									goto L12;
								}
							}
							goto L12;
						} else {
							goto L5;
						}
						do {
							L5:
							_t72 = _t58;
							_v32 = _t58;
							_t73 = E6DF8CB30(_t58, _t72);
							_t105 = _v32;
							if(_t73 == 0) {
								L7:
								if(_v40 == 0x10) {
									if(E6DF8CB30(_t73, _t105) == 0 || E6DF8CDD0(_v32, _v32) == 0) {
										goto L8;
									} else {
										_t76 = E6DF8CB30(_t75, _v32);
										_pop(_t110);
										if(_t76 == 0 || E6DF8CCE0(_t110, _v32) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_t117 = _v36;
										_pop(_t111);
										_t112 = _v32;
										_t80 = (_t117 << 4) - _t111 + 0xa;
										L32:
										_t81 = _t80 + _t112;
										if(_t81 < _t117) {
											goto L12;
										}
										goto L33;
									}
								}
								L8:
								_t117 = _v36;
								L9:
								_t90 = _a8;
								goto L10;
							}
							_t73 = E6DF8CC80(_t105, _t105);
							_t105 = _v32;
							if(_t73 != 0) {
								_t118 = _v40;
								_t26 = _t105 - 0x30; // -48
								_t73 = _t26;
								if(_t26 >= _t118) {
									goto L7;
								}
								_t117 = _v36;
								_t80 = _t118 * _t117 + 0xffffffd0;
								goto L32;
							}
							goto L7;
							L33:
							_t123 = _t123 + 1;
							_t117 = _t81;
							_v36 = _t117;
							_v25 = 1;
							_t58 =  *_t123;
						} while (_t58 != 0);
						goto L9;
					} else {
						L12:
						 *_t87 = _t123;
						_t60 = 0xc000000d;
						L13:
						return E6DF8B640(_t60, _t87, _v8 ^ _t124, _t117, _t119, _t123);
					}
					L36:
					 *_t119 = _t117;
					_t119 = _t119 + 4;
					_t122 = _t123 + 1;
				} while (_t90 != 0);
				goto L12;
			}

0x6df4722f
0x6df47236
0x6df4723a
0x6df4723e
0x6df47241
0x6df47244
0x6df47244
0x6df4724f
0x6df47252
0x6df47253
0x6df47256
0x6dfa2462
0x6dfa2467
0x6dfa246c
0x6dfa246f
0x6dfa2483
0x6dfa2487
0x6dfa2499
0x6dfa249b
0x00000000
0x6dfa248d
0x6dfa248d
0x6dfa2490
0x00000000
0x6dfa2490
0x6dfa247f
0x6dfa247f
0x6dfa249c
0x6dfa249c
0x6dfa249d
0x00000000
0x6dfa249d
0x6dfa246f
0x6df4725c
0x6df47261
0x6df47268
0x6df4726c
0x6df472d2
0x6df472d5
0x6df472a7
0x6df472aa
0x6dfa253b
0x00000000
0x00000000
0x00000000
0x6dfa253b
0x6df472b2
0x6dfa2554
0x6dfa255e
0x6dfa2563
0x6dfa256e
0x6dfa2571
0x6dfa263a
0x6dfa263d
0x6dfa2640
0x6dfa2642
0x6dfa2644
0x6dfa2646
0x00000000
0x6dfa2646
0x6dfa2577
0x6dfa257a
0x6dfa2612
0x6dfa261b
0x00000000
0x00000000
0x6dfa2621
0x6dfa2624
0x6dfa262b
0x00000000
0x00000000
0x6dfa2631
0x6dfa2634
0x6dfa2636
0x6dfa2636
0x00000000
0x6dfa2636
0x6dfa2580
0x6dfa2583
0x6dfa25d9
0x6dfa25e3
0x00000000
0x00000000
0x6dfa25e9
0x6dfa25ee
0x00000000
0x00000000
0x6dfa25f4
0x6dfa25fc
0x00000000
0x00000000
0x6dfa2605
0x6dfa260a
0x6dfa260d
0x00000000
0x6dfa260d
0x6dfa2588
0x00000000
0x00000000
0x6dfa258e
0x6dfa2598
0x00000000
0x00000000
0x6dfa259e
0x6dfa25a3
0x00000000
0x6dfa25bb
0x6dfa25d1
0x6dfa25d4
0x00000000
0x6dfa25d4
0x00000000
0x00000000
0x00000000
0x6dfa2563
0x00000000
0x00000000
0x00000000
0x00000000
0x6df4726e
0x6df4726e
0x6df4726e
0x6df47272
0x6df47275
0x6df4727b
0x6df47280
0x6df47294
0x6df47298
0x6dfa24c9
0x00000000
0x6dfa24e1
0x6dfa24e4
0x6dfa24e9
0x6dfa24ec
0x6dfa24ff
0x6dfa24fb
0x6dfa24fb
0x6dfa24fb
0x6dfa2501
0x6dfa2506
0x6dfa250c
0x6dfa250f
0x6dfa2512
0x6dfa2512
0x6dfa2516
0x00000000
0x00000000
0x00000000
0x6dfa2516
0x6dfa24c9
0x6df4729e
0x6df4729e
0x6df472a4
0x6df472a4
0x00000000
0x6df472a4
0x6df47283
0x6df47289
0x6df4728e
0x6dfa24a5
0x6dfa24a8
0x6dfa24a8
0x6dfa24ad
0x00000000
0x00000000
0x6dfa24b5
0x6dfa24bb
0x00000000
0x6dfa24bb
0x00000000
0x6dfa251c
0x6dfa251c
0x6dfa251d
0x6dfa2521
0x6dfa2524
0x6dfa2527
0x6dfa2529
0x00000000
0x6df472b8
0x6df472b8
0x6df472b8
0x6df472ba
0x6df472bf
0x6df472cf
0x6df472cf
0x6dfa2541
0x6dfa2541
0x6dfa2543
0x6dfa2546
0x6dfa2547
0x00000000

APIs

__isascii.9419(0000000A,?), ref: 6DF47275
isdigit.9419(00000000,?), ref: 6DF47283
__isascii.9419(0000000A,?), ref: 6DFA2467
isdigit.9419(00000000,?), ref: 6DFA2475

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit
String ID:
API String ID: 2481201981-0
Opcode ID: db46da06088660a7e34a5f461867cf821247c9a44c6746972332ec2bdb3642b3
Instruction ID: e8f2be4275b18ba260b19eb4e4789f839c6a695b513e786dbdc93991a9067339
Opcode Fuzzy Hash: db46da06088660a7e34a5f461867cf821247c9a44c6746972332ec2bdb3642b3
Instruction Fuzzy Hash: 6771D731F0421B8BDB14CEADD8506BE7BF5AF46310F64866AEC55E7282D635CA418BF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5F820, Relevance: 12.1, APIs: 8, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DF5F820(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int* _a20) {
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* _t37;
				signed int _t55;
				signed int _t56;
				signed int* _t62;
				signed int _t64;
				signed int* _t72;
				signed int _t76;
				void* _t78;
				signed int _t80;
				void* _t82;
				void* _t83;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_t74 = _a4;
				if(_a4 == 0) {
					L22:
					_t78 = 0x57;
					goto L16;
				} else {
					_t62 = _a20;
					if(_t62 == 0) {
						goto L22;
					} else {
						_t37 = E6DF8F380(_t74, 0x6df25138, 0x10);
						_t83 = _t82 + 0xc;
						if(_t37 == 0) {
							if( *0x6e0360d8 == 0) {
								goto L3;
							} else {
								_push(0x57);
								goto L25;
							}
						} else {
							L3:
							_t71 = _a12;
							 *_t62 =  *_t62 & 0x00000000;
							_t78 = 0;
							_t62[1] = _t62[1] & 0x00000000;
							_t76 = E6DF7BC2C(_t74, _a12, _a16, _a8);
							if(_t76 == 0) {
								_push("true");
								L25:
								_pop(_t78);
								goto L23;
							} else {
								_t8 = _t76 + 0x24; // 0x24
								_t63 = _t8;
								E6DF62280(_t38, _t8);
								 *(_t76 + 0x2c) =  *( *[fs:0x18] + 0x24);
								if(_a8 == 0xa) {
									L6:
									_t14 = _t76 + 0xc; // 0xc
									 *((intOrPtr*)(_t83 + 0x18)) = _t14;
									 *((short*)(_t83 + 0x20)) =  *(_t76 + 0x34);
									E6DF62280( *(_t76 + 0x34), 0x6e0386ac);
									_t64 =  *0x6e0386dc;
									_v20 =  *0x6e0386e0 & 1;
									_v24 = 0;
									if(_t64 != 0) {
										L7:
										while(1) {
											if(E6DF5F99D(_t83 + 0x1c, _t64) >= 0) {
												_t55 =  *(_t64 + 4);
												if(_v16 != 0) {
													if(_t55 == 0) {
														goto L13;
													} else {
														_t55 = _t55 ^ _t64;
														goto L12;
													}
													goto L17;
												} else {
													L12:
													if(_t55 != 0) {
														goto L10;
													} else {
														L13:
														_v20 = 1;
													}
												}
											} else {
												_t56 =  *_t64;
												if(_v16 != 0) {
													if(_t56 == 0) {
														goto L14;
													} else {
														_t55 = _t56 ^ _t64;
														goto L9;
													}
													goto L17;
												} else {
													L9:
													if(_t55 == 0) {
														L14:
														_v20 = 0;
													} else {
														L10:
														_t64 = _t55;
														continue;
													}
												}
											}
											goto L15;
										}
									}
									L15:
									E6DF5B090(0x6e0386dc, _t64, _v20, _t76);
									E6DF5FFB0(_t64, _t76, 0x6e0386ac);
									E6DF7F296(_t76, _t71);
									 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
									_t29 = _t76 + 0x24; // 0x24
									E6DF5FFB0(_t64, _t76, _t29);
									asm("cdq");
									_t72 = _a20;
									 *_t72 = _t76;
									_t72[1] =  *(_t76 + 0x34) & 0x0000ffff;
								} else {
									_t71 = _a12;
									_t78 = E6DF74D3B(_t76, _a12, _a8);
									if(_t78 != 0) {
										 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
										E6DF5FFB0(_t63, _t76, _t63);
										E6DF4F871(_t63);
									} else {
										goto L6;
									}
								}
								L16:
								if(_t78 != 0) {
									L23:
									E6DF4CC50(_t78);
								}
							}
						}
					}
				}
				L17:
				return _t78;
			}

0x6df5f828
0x6df5f82e
0x6df5f833
0x6df5f990
0x6df5f992
0x00000000
0x6df5f839
0x6df5f839
0x6df5f83e
0x00000000
0x6df5f844
0x6df5f84c
0x6df5f851
0x6df5f856
0x6df5f97b
0x00000000
0x6df5f981
0x6df5f981
0x00000000
0x6df5f981
0x6df5f85c
0x6df5f85c
0x6df5f85f
0x6df5f867
0x6df5f86a
0x6df5f86c
0x6df5f875
0x6df5f879
0x6dfabd6b
0x6dfabd6d
0x6dfabd6d
0x00000000
0x6df5f87f
0x6df5f87f
0x6df5f87f
0x6df5f883
0x6df5f895
0x6df5f898
0x6df5f8b1
0x6df5f8b1
0x6df5f8b4
0x6df5f8c1
0x6df5f8c6
0x6df5f8d2
0x6df5f8db
0x6df5f8df
0x6df5f8e6
0x00000000
0x6df5f8e8
0x6df5f8f5
0x6df5f911
0x6df5f914
0x6df5f98a
0x00000000
0x6df5f98c
0x6df5f98c
0x00000000
0x6df5f98c
0x00000000
0x6df5f916
0x6df5f916
0x6df5f918
0x00000000
0x6df5f91a
0x6df5f91a
0x6df5f91a
0x6df5f91a
0x6df5f918
0x6df5f8f7
0x6df5f8fc
0x6df5f8fe
0x6dfabd8b
0x00000000
0x6dfabd91
0x6dfabd91
0x00000000
0x6dfabd91
0x00000000
0x6df5f904
0x6df5f904
0x6df5f906
0x6df5f921
0x6df5f921
0x6df5f908
0x6df5f908
0x6df5f908
0x00000000
0x6df5f908
0x6df5f906
0x6df5f8fe
0x00000000
0x6df5f8f5
0x6df5f8e8
0x6df5f926
0x6df5f931
0x6df5f93b
0x6df5f942
0x6df5f947
0x6df5f94b
0x6df5f94f
0x6df5f95a
0x6df5f95d
0x6df5f960
0x6df5f962
0x6df5f89a
0x6df5f89d
0x6df5f8a7
0x6df5f8ab
0x6dfabd73
0x6dfabd78
0x6dfabd7f
0x00000000
0x00000000
0x00000000
0x6df5f8ab
0x6df5f965
0x6df5f967
0x6df5f995
0x6df5f996
0x6df5f996
0x6df5f967
0x6df5f879
0x6df5f856
0x6df5f83e
0x6df5f969
0x6df5f971

APIs

memcmp.9419(00000030,6DF25138,00000010,00000000,00000001,-00000001), ref: 6DF5F84C
RtlAcquireSRWLockExclusive.9419(00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6DF5F883
RtlAcquireSRWLockExclusive.9419(6E0386AC,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6DF5F8C6

Part of subcall function 6DF74D3B: memset.9419(?,00000000,000000A0,00000000,00000000,00000024), ref: 6DF74D77
Part of subcall function 6DF74D3B: RtlRunOnceExecuteOnce.9419(6E0386B0,6DF75690,00000000,00000000,00000000,00000000,00000024), ref: 6DF74D9E
Part of subcall function 6DF74D3B: ZwTraceControl.9419(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6DF74DE9
Part of subcall function 6DF74D3B: memcmp.9419(00000000,6DF25138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6DF74E26

RtlRbInsertNodeEx.9419(6E0386DC,?,00000000,00000000), ref: 6DF5F931
RtlReleaseSRWLockExclusive.9419(6E0386AC,6E0386DC,?,00000000,00000000), ref: 6DF5F93B
RtlReleaseSRWLockExclusive.9419(00000024,6E0386AC,6E0386DC,?,00000000,00000000), ref: 6DF5F94F

Part of subcall function 6DF7BC2C: RtlAcquireSRWLockExclusive.9419(?,00000030,00000000,-00000001,6DF5F875,00000000,00000000,00000000,00000001,-00000001), ref: 6DF7BC79
Part of subcall function 6DF7BC2C: RtlReleaseSRWLockExclusive.9419(?,?,00000030,00000000,-00000001,6DF5F875,00000000,00000000,00000000,00000001,-00000001), ref: 6DF7BC8D
Part of subcall function 6DF7BC2C: RtlAllocateHeap.9419(?,00000008,000000D0,?,?,00000030,00000000,-00000001,6DF5F875,00000000,00000000,00000000,00000001,-00000001), ref: 6DF7BCA6

RtlSetLastWin32Error.9419(00000057,00000000,00000001,-00000001), ref: 6DF5F996
RtlReleaseSRWLockExclusive.9419(00000024,0000000A,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6DFABD78

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$Oncememcmp$AllocateControlErrorExecuteHeapInsertLastNodeTraceWin32memset
String ID:
API String ID: 3014906823-0
Opcode ID: 3e56c0b8ac93860e350e071a46c854b4fdd6fde96f607fb026c6b9be5c6c9c97
Instruction ID: 3f1cdf46edb68efa212bb1ae007565a986ea0a1e5eab7f1adec409128040a244
Opcode Fuzzy Hash: 3e56c0b8ac93860e350e071a46c854b4fdd6fde96f607fb026c6b9be5c6c9c97
Instruction Fuzzy Hash: 2D41F572208B47ABD751CF6CDD80B6BB7E4BF56308F058599E9149B281DB34D824CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF45C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6DF45C07(signed short* __ecx, signed int __edx, signed int* _a4, signed int* _a8, char _a12, char _a16, char* _a20, intOrPtr* _a24) {
				signed short* _v8;
				intOrPtr _v12;
				signed int* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				signed int* _v44;
				signed int _v48;
				signed short* _v52;
				signed short* _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int* _v76;
				void* _t155;
				signed int* _t156;
				intOrPtr* _t159;
				char _t160;
				signed int _t179;
				signed int _t181;
				char* _t182;
				void* _t183;
				signed int _t186;
				void* _t187;
				signed int _t190;
				signed int _t196;
				signed int* _t198;
				signed int _t200;
				intOrPtr _t202;
				intOrPtr _t203;
				signed int _t215;
				intOrPtr _t221;
				signed int _t222;
				signed int _t225;
				void* _t227;
				void* _t228;
				signed int* _t233;
				intOrPtr* _t234;
				signed int* _t236;
				signed short* _t239;
				void* _t249;
				void* _t250;
				signed int _t251;
				signed int _t253;
				void* _t269;
				signed int _t270;
				signed int _t272;
				void* _t273;
				void* _t274;
				signed short* _t277;
				signed short* _t280;
				intOrPtr* _t281;
				intOrPtr* _t282;
				signed int _t284;
				signed int _t287;
				signed int* _t288;
				signed int _t293;
				signed int* _t295;
				signed int* _t297;
				signed int _t299;
				signed int* _t302;
				signed int _t306;
				signed int _t309;
				signed int _t314;
				signed int _t315;
				signed short* _t317;
				void* _t318;

				_t236 = _a8;
				_v72 = __edx;
				_v52 = __ecx;
				_t299 =  *_t236;
				 *_t236 =  *_t236 & 0x00000000;
				 *_a20 = 1;
				if(__edx <= 0) {
					_t155 = 0xc0000716;
					L34:
					return _t155;
				}
				_t277 =  &(__ecx[__edx]);
				_t238 = __ecx;
				_v8 = __ecx;
				_v56 =  &(__ecx[0xffffffffffffffff]);
				_t295 = _a4;
				_t156 = _t295;
				_v16 = _t156;
				_t233 = _t156;
				_v76 = _t233;
				_v12 = _t233 + _t299 * 2;
				 *_a24 = _t233 - 2;
				if(__ecx >= _t277) {
					L35:
					_t155 = 0xc0000716;
					L33:
					goto L34;
				}
				_t302 = _t233;
				_v60 = 0x80;
				while(1) {
					_t159 = E6DF45DDE(_t238, _t277, _a12);
					_t239 = _v8;
					_t234 = _t159;
					if(_t234 == _t239) {
						break;
					}
					if(_a12 != 0) {
						_t306 = _t234 - _t239;
						L7:
						if((_t277 - _t239 & 0xfffffffe) < 8) {
							L11:
							if((_v12 - _t295 & 0xfffffffe) < (_t306 & 0xfffffffe)) {
								goto L35;
							}
							_t280 = _t239;
							if(_t239 >= _t234) {
								L21:
								if(_a12 != 0 || (_t234 - _t239 & 0xfffffffe) <= 0x7e && _t295 != _v16) {
									_t277 = _v52 + _v72 * 2;
									if(_t234 == _t277) {
										L27:
										_t160 = _a12;
										if(_t160 != 0) {
											_a12 = 0;
											_v56 = _t234;
											asm("sbb ecx, ecx");
											 *_a24 = _t295 - ( ~(_t234 - _t277) & 0x00000002);
											if(_t234 == _t277 - 2) {
												goto L35;
											}
											_t160 = _a12;
										}
										_t238 = _t234 + 2;
										_t302 = _t295;
										_v8 = _t234 + 2;
										_v16 = _t302;
										if(_t234 < _t277) {
											continue;
										}
										L29:
										_t297 = _v76;
										if(_t302 == _t297 || _t160 == 0 && _t277 - _v56 >> 1 > (0 | ( *(_t277 - 2) & 0x0000ffff) == 0x0000002e) + 0xff) {
											goto L35;
										} else {
											 *_a8 = _t302 - _t297 >> 1;
											_t155 = 0;
											goto L33;
										}
									}
									if(_t295 >= _v12) {
										goto L35;
									}
									 *_t295 =  *_t234;
									_t295 =  &(_t295[0]);
									_a4 = _t295;
									goto L27;
								} else {
									goto L35;
								}
							} else {
								goto L13;
							}
							do {
								L13:
								if(_a12 != 0) {
									L17:
									_t179 =  *_t280 & 0x0000ffff;
									if(_t179 == 0 || _t179 >= 0x80) {
										goto L35;
									} else {
										goto L19;
									}
								}
								if(_a16 != 0) {
									if(E6DFF7F9F( *_t280) == 0) {
										goto L35;
									}
								}
								_t181 =  *_t280 & 0x0000ffff;
								_t249 = 0x20;
								if(_t181 < _t249) {
									goto L35;
								}
								_t250 = 0x7f;
								if(_t181 == _t250) {
									goto L35;
								}
								goto L17;
								L19:
								 *_t295 = _t179;
								_t280 =  &(_t280[1]);
								_t295 =  &(_t295[0]);
								_a4 = _t295;
							} while (_t280 < _t234);
							L20:
							_t239 = _v8;
							goto L21;
						}
						_t182 = L"xl--";
						if(_a12 == 0) {
							_t182 = L"xn--";
						}
						_t183 = E6DF8E5C0(_t239, _t182, 4);
						_t239 = _v8;
						_t318 = _t318 + 0xc;
						if(_t183 == 0) {
							_t281 = _t234 - 2;
							_t239 =  &(_t239[4]);
							_v8 = _t239;
							 *_a20 = 0;
							if(_t281 < _t239) {
								L46:
								_t281 = 0;
								L47:
								if(_t281 == _t234 - 2) {
									goto L35;
								}
								if(_t281 == 0 || _t281 <= _t239) {
									_t186 = 0;
								} else {
									_t317 = _t239;
									_t186 = _t281 - _t239 >> 1;
									_v48 = _t186;
									if(_t239 == _t281) {
										L68:
										if(_t186 <= 0) {
											_t187 = 0;
										} else {
											_t187 = 2 + _t186 * 2;
										}
										_t309 = 0;
										_v24 = 0x80;
										_v28 = _v28 & 0;
										_t282 = _t187 + _t239;
										_v36 = _t282;
										_v48 = 0x48;
										if(_t282 >= _t234) {
											goto L21;
										} else {
											do {
												_t251 = 0x24;
												_v68 = _t309;
												_v64 = _t309;
												_v20 = 1;
												_v40 = _t251;
												_v44 = _t251 - _v48;
												while(_t282 < _t234) {
													_t190 = E6DFF802C( *_t282);
													_v36 = _v36 + 2;
													_t253 = _t190;
													if(_t253 < 0) {
														goto L35;
													}
													asm("cdq");
													if(_t253 > 0x7ffffff / _v20) {
														goto L35;
													}
													_t284 = _v40;
													_t309 = _t309 + _t253 * _v20;
													_t196 = _v48;
													_v32 = _t309;
													if(_t284 > _t196) {
														if(_t284 < _t196 + 0x1a) {
															_t198 = _v44;
														} else {
															_t198 = 0x1a;
														}
													} else {
														_t198 = 1;
													}
													if(_t253 < _t198) {
														_t314 = (_t295 - _v16 >> 1) - _v28 + 1;
														_v48 = E6DFF7FD5(_v32 - _v68, _t314, (_t253 & 0xffffff00 | _v64 == 0x00000000) & 0x000000ff);
														_t200 = _v32;
														asm("cdq");
														_t315 = _t200 % _t314;
														_t287 = _t200 / _t314;
														_t202 = _v24;
														_v32 = _t315;
														if(_t287 > 0x7ffffff - _t202) {
															goto L35;
														}
														_t203 = _t202 + _t287;
														_v24 = _t203;
														if(_t203 >= 0x80 && _t203 <= 0x10ffff && (_t203 < 0xd800 || _t203 > 0xdfff)) {
															if(_v28 <= 0) {
																_t288 = _v16 + _t315 * 2;
																_v44 = _t288;
																L97:
																if(_t203 >= 0x10000) {
																	if(_t295 >= _v12 + 0xfffffffe || _t288 > _t295) {
																		goto L35;
																	} else {
																		asm("cdq");
																		_t140 = (_v24 + 0xffff0000) / 0x400 - 0x2800; // -4294911872
																		E6DFF7F11((_v24 + 0xffff0000) / 0x400, _t140, _v44,  &_a4);
																		E6DFF7F11( &_a4, (_v24 + 0xffff0000) % 0x400 - 0x2400,  &(_v44[0]),  &_a4);
																		_v28 = _v28 + 1;
																		_t315 = _v32;
																		goto L104;
																	}
																}
																if(_t295 >= _v12 || _t288 > _t295) {
																	goto L35;
																} else {
																	E6DFF7F11(_t203, _t203, _t288,  &_a4);
																	goto L104;
																}
															}
															_t288 = _v16;
															_v40 = _t315;
															_v44 = _t288;
															if(_t315 <= 0) {
																goto L97;
															}
															while(_t288 < _t295) {
																if(E6DFF7F61( *_t288) != 0) {
																	_t288 =  &(_t288[0]);
																}
																_t288 =  &(_t288[0]);
																_t215 = _v40 - 1;
																_v44 = _t288;
																_v40 = _t215;
																if(_t215 > 0) {
																	continue;
																} else {
																	_t203 = _v24;
																	goto L97;
																}
															}
														}
														goto L35;
													} else {
														_t269 = 0x24;
														_t270 = _t269 - _t198;
														asm("cdq");
														_t293 = _v20;
														if(_t293 > 0x7ffffff / _t270) {
															goto L35;
														}
														_v40 = _v40 + 0x24;
														_v44 =  &(_v44[9]);
														_t282 = _v36;
														_v20 = _t270 * _t293;
														continue;
													}
												}
												goto L35;
												L104:
												_t282 = _v36;
												_t309 = _t315 + 1;
												_t295 = _a4;
											} while (_t282 < _t234);
											goto L20;
										}
									}
									while(_t295 < _v12) {
										_t221 = _a12;
										if(_t221 != 0) {
											L58:
											_t272 =  *_t317 & 0x0000ffff;
											if(_t272 == 0 || _t272 >= _v60) {
												goto L35;
											} else {
												if(_t221 != 0) {
													L63:
													_t222 = _t272;
													L64:
													 *_t295 = _t222;
													_t317 =  &(_t317[1]);
													_t295 =  &(_t295[0]);
													_a4 = _t295;
													if(_t317 != _t281) {
														continue;
													}
													break;
												}
												_t59 = _t272 - 0x41; // 0x3f
												if(_t59 > 0x19) {
													goto L63;
												}
												_t60 = _t272 + 0x20; // 0xa0
												_t222 = _t60 & 0x0000ffff;
												goto L64;
											}
										}
										if(_a16 == _t221 || E6DFF7F9F( *_t317) != 0) {
											_t225 =  *_t317 & 0x0000ffff;
											_t273 = 0x20;
											if(_t225 < _t273) {
												goto L35;
											}
											_t274 = 0x7f;
											if(_t225 == _t274) {
												goto L35;
											}
											_t221 = _a12;
											goto L58;
										} else {
											goto L35;
										}
									}
									if(_t317 != _t281) {
										goto L35;
									}
									_t239 = _v8;
									_t186 = _v48;
								}
								goto L68;
							}
							_t227 = 0x2d;
							while( *_t281 != _t227) {
								_t281 = _t281 - 2;
								if(_t281 >= _t239) {
									continue;
								}
								goto L46;
							}
							goto L47;
						} else {
							goto L11;
						}
					}
					if(_a16 != 0) {
						_t228 = 0x2d;
						if( *_t239 == _t228) {
							goto L35;
						}
						if(_t234 <= _v52) {
							goto L6;
						}
						if( *((intOrPtr*)(_t234 - 2)) == _t228) {
							goto L35;
						}
					}
					L6:
					_t306 = _t234 - _t239;
					if((_t306 & 0xfffffffe) > 0x7e) {
						goto L35;
					}
					goto L7;
				}
				_t160 = _a12;
				if(_t160 != 0 || _t234 != _t277) {
					goto L35;
				} else {
					goto L29;
				}
			}

0x6df45c14
0x6df45c18
0x6df45c1b
0x6df45c1e
0x6df45c20
0x6df45c26
0x6df45c2b
0x6dfa12f0
0x6df45dcf
0x6df45dd4
0x6df45dd4
0x6df45c31
0x6df45c34
0x6df45c39
0x6df45c3c
0x6df45c40
0x6df45c43
0x6df45c45
0x6df45c48
0x6df45c4a
0x6df45c53
0x6df45c59
0x6df45c5d
0x6df45dd7
0x6df45dd7
0x6df45dce
0x00000000
0x6df45dce
0x6df45c63
0x6df45c65
0x6df45c6c
0x6df45c6f
0x6df45c74
0x6df45c77
0x6df45c7b
0x00000000
0x00000000
0x6df45c85
0x6dfa1320
0x6df45ca7
0x6df45cb1
0x6df45cda
0x6df45ce7
0x00000000
0x00000000
0x6df45ced
0x6df45cf1
0x6df45d4b
0x6df45d4f
0x6df45d68
0x6df45d6d
0x6df45d80
0x6df45d80
0x6df45d85
0x6dfa163d
0x6dfa1643
0x6dfa164a
0x6dfa1654
0x6dfa165b
0x00000000
0x00000000
0x6dfa1661
0x6dfa1661
0x6df45d8b
0x6df45d8e
0x6df45d90
0x6df45d93
0x6df45d98
0x00000000
0x00000000
0x6df45d9e
0x6df45d9e
0x6df45da3
0x00000000
0x6df45dc3
0x6df45dca
0x6df45dcc
0x00000000
0x6df45dcc
0x6df45da3
0x6df45d72
0x00000000
0x00000000
0x6df45d77
0x6df45d7a
0x6df45d7d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df45cf3
0x6df45cf3
0x6df45cf7
0x6df45d1e
0x6df45d1e
0x6df45d24
0x00000000
0x00000000
0x00000000
0x00000000
0x6df45d24
0x6df45cfd
0x6dfa1630
0x00000000
0x00000000
0x6dfa1636
0x6df45d03
0x6df45d08
0x6df45d0c
0x00000000
0x00000000
0x6df45d14
0x6df45d18
0x00000000
0x00000000
0x00000000
0x6df45d38
0x6df45d38
0x6df45d3b
0x6df45d3e
0x6df45d41
0x6df45d44
0x6df45d48
0x6df45d48
0x00000000
0x6df45d48
0x6df45cb7
0x6df45cbc
0x6df45cbe
0x6df45cbe
0x6df45cc7
0x6df45ccc
0x6df45ccf
0x6df45cd4
0x6dfa132a
0x6dfa132d
0x6dfa1330
0x6dfa1333
0x6dfa1338
0x6dfa1349
0x6dfa1349
0x6dfa134b
0x6dfa1350
0x00000000
0x00000000
0x6dfa1358
0x6dfa1405
0x6dfa1366
0x6dfa1368
0x6dfa136c
0x6dfa136e
0x6dfa1373
0x6dfa1407
0x6dfa1409
0x6dfa1414
0x6dfa140b
0x6dfa140b
0x6dfa140b
0x6dfa1416
0x6dfa1418
0x6dfa141f
0x6dfa1422
0x6dfa1425
0x6dfa1428
0x6dfa1431
0x00000000
0x6dfa1437
0x6dfa1437
0x6dfa1439
0x6dfa143c
0x6dfa1442
0x6dfa1445
0x6dfa144c
0x6dfa144f
0x6dfa1452
0x6dfa145d
0x6dfa1462
0x6dfa1466
0x6dfa146a
0x00000000
0x00000000
0x6dfa1477
0x6dfa147d
0x00000000
0x00000000
0x6dfa1483
0x6dfa148c
0x6dfa148e
0x6dfa1491
0x6dfa1496
0x6dfa14a2
0x6dfa14a9
0x6dfa14a4
0x6dfa14a6
0x6dfa14a6
0x6dfa1498
0x6dfa149a
0x6dfa149a
0x6dfa14ae
0x6dfa14e8
0x6dfa1501
0x6dfa1509
0x6dfa150c
0x6dfa150f
0x6dfa1511
0x6dfa1513
0x6dfa1518
0x6dfa151d
0x00000000
0x00000000
0x6dfa1523
0x6dfa152a
0x6dfa152f
0x6dfa1556
0x6dfa1595
0x6dfa1598
0x6dfa159b
0x6dfa15a0
0x6dfa15c8
0x00000000
0x6dfa15d6
0x6dfa15e3
0x6dfa15ef
0x6dfa15f5
0x6dfa1607
0x6dfa160c
0x6dfa160f
0x00000000
0x6dfa160f
0x6dfa15c8
0x6dfa15a5
0x00000000
0x6dfa15b3
0x6dfa15b9
0x00000000
0x6dfa15b9
0x6dfa15a5
0x6dfa1558
0x6dfa155b
0x6dfa155e
0x6dfa1563
0x00000000
0x00000000
0x6dfa1565
0x6dfa1577
0x6dfa1579
0x6dfa1579
0x6dfa157f
0x6dfa1582
0x6dfa1583
0x6dfa1586
0x6dfa158b
0x00000000
0x6dfa158d
0x6dfa158d
0x00000000
0x6dfa158d
0x6dfa158b
0x6dfa1565
0x00000000
0x6dfa14b0
0x6dfa14b2
0x6dfa14b3
0x6dfa14ba
0x6dfa14bd
0x6dfa14c2
0x00000000
0x00000000
0x6dfa14c8
0x6dfa14cf
0x6dfa14d3
0x6dfa14d6
0x00000000
0x6dfa14d6
0x6dfa14ae
0x00000000
0x6dfa1612
0x6dfa1612
0x6dfa1615
0x6dfa1616
0x6dfa1619
0x00000000
0x6dfa1621
0x6dfa1431
0x6dfa1379
0x6dfa137e
0x6dfa1383
0x6dfa13b8
0x6dfa13b8
0x6dfa13be
0x00000000
0x6dfa13ce
0x6dfa13d0
0x6dfa13e3
0x6dfa13e3
0x6dfa13e5
0x6dfa13e5
0x6dfa13e8
0x6dfa13eb
0x6dfa13ee
0x6dfa13f3
0x00000000
0x00000000
0x00000000
0x6dfa13f3
0x6dfa13d2
0x6dfa13d9
0x00000000
0x00000000
0x6dfa13db
0x6dfa13de
0x00000000
0x6dfa13de
0x6dfa13be
0x6dfa1388
0x6dfa139a
0x6dfa139f
0x6dfa13a3
0x00000000
0x00000000
0x6dfa13ab
0x6dfa13af
0x00000000
0x00000000
0x6dfa13b5
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfa1388
0x6dfa13f7
0x00000000
0x00000000
0x6dfa13fd
0x6dfa1400
0x6dfa1400
0x00000000
0x6dfa1358
0x6dfa133c
0x6dfa133d
0x6dfa1342
0x6dfa1347
0x00000000
0x00000000
0x00000000
0x6dfa1347
0x00000000
0x00000000
0x00000000
0x00000000
0x6df45cd4
0x6df45c8f
0x6dfa12fc
0x6dfa1300
0x00000000
0x00000000
0x6dfa1309
0x00000000
0x00000000
0x6dfa1313
0x00000000
0x00000000
0x6dfa1319
0x6df45c95
0x6df45c97
0x6df45ca1
0x00000000
0x00000000
0x00000000
0x6df45ca1
0x6dfa1669
0x6dfa166e
0x00000000
0x6dfa167c
0x00000000
0x6dfa167c

APIs

_wcsnicmp.9419(?,xl--,00000004,?,?,?,?), ref: 6DF45CC7

Strings

$, xrefs: 6DFA14C8
xl--, xrefs: 6DF45CB7
$, xrefs: 6DFA14CF
xn--, xrefs: 6DF45CBE, 6DF45CC5
H, xrefs: 6DFA1428

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: df33b92a1cec6e4cac390b3b0aa3db5f9bf0edbbae64203c8585d4d681224bff
Instruction ID: 694aa16ef833cc0267a681267c2226c05b0e9ebbbf87ce7cb6cb13248a1dbe4a
Opcode Fuzzy Hash: df33b92a1cec6e4cac390b3b0aa3db5f9bf0edbbae64203c8585d4d681224bff
Instruction Fuzzy Hash: 35F1E471E0828A8BDF14DF6CC8847BDBBB1AF45314F29C169D951EB385E7309985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF674C0, Relevance: 10.8, APIs: 7, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6DF674C0(signed short* __ecx) {
				char _v8;
				signed int _v12;
				signed int* _v16;
				void* _v20;
				signed short _t49;
				signed int _t54;
				signed int _t56;
				signed int _t57;
				signed int _t68;
				signed short* _t71;
				signed int _t74;
				signed int _t80;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				char _t91;
				signed short* _t92;
				unsigned short _t93;
				char _t94;
				signed short* _t95;
				signed int _t100;
				unsigned short _t101;
				signed short* _t104;
				signed int _t105;
				void* _t106;
				signed int* _t107;
				signed short _t108;
				signed int _t109;
				signed int _t112;
				signed int* _t113;

				_t92 = __ecx;
				_t104 = __ecx[2];
				_t112 =  *__ecx & 0x0000ffff;
				_v8 = 0;
				if(_t112 < 2) {
					L3:
					_t49 =  *_t92;
					_t113 = _t104;
					_t108 = _t49;
					_v20 = _t49;
					_t89 = _t108 & 0x0000ffff;
					_t93 = _t89;
					_v16 = _t113;
					_t105 = _t93 >> 0x00000001 & 0x0000ffff;
					if(_t105 == 0) {
						goto L28;
					} else {
						if( *((short*)(_t113 + _t105 * 2 - 2)) == 0x3a) {
							_t43 = _t93 - 2; // 0xfffffe
							_t108 = _t43;
							_t105 = _t105 + 0xffff;
							_t94 = 1;
							_v8 = 1;
						} else {
							_t94 = 0;
						}
						if(_t105 == 0) {
							goto L28;
						} else {
							while(1) {
								_t54 =  *(_t113 + (_t105 & 0x0000ffff) * 2 - 2) & 0x0000ffff;
								if(_t54 != 0x2e && _t54 != 0x20) {
									break;
								}
								_v12 = 0xfffe;
								_t105 = _t105 + 0xffff;
								_t108 = _t108 + _v12;
								_t94 = _t94 + 1;
								if(_t105 != 0) {
									continue;
								} else {
								}
								break;
							}
							_v8 = _t94;
							_v12 = 0;
							if(_t105 == 0) {
								L20:
								_t95 = _t113;
								_t106 = _t113 + (_t105 & 0x0000ffff) * 2;
								if(_t113 < _t106) {
									while(1) {
										_t68 =  *_t95 & 0x0000ffff;
										if(_t68 == 0x2e || _t68 == 0x3a) {
											break;
										}
										_t95 =  &(_t95[1]);
										if(_t95 < _t106) {
											continue;
										}
										break;
									}
									if(_t95 > _t113) {
										while( *((short*)(_t95 - 2)) == 0x20) {
											_t95 =  &(_t95[0xffffffffffffffff]);
											if(_t95 > _t113) {
												continue;
											} else {
											}
											goto L27;
										}
									}
								}
								L27:
								_t56 = _t95 - _t113 >> 0x00000001 & 0x0000ffff;
								_t109 = _t56;
								_v20 = _t56 + _t56;
								if(_t109 != 5) {
									_t26 = _t109 - 3; // 0x37
									_t57 = _t26;
									if(_t57 > 4) {
										goto L28;
									} else {
										switch( *((intOrPtr*)(_t57 * 4 +  &M6DF677C8))) {
											case 0:
												if(RtlEqualUnicodeString( &_v20, 0x6df21040, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6df21050, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6df21048, 1) != 0) {
													goto L46;
												} else {
													_push(1);
													_push(0x6df21058);
													goto L45;
												}
												goto L76;
											case 1:
												_t36 = __esi + 6; // 0xe6df2
												__eax =  *_t36 & 0x0000ffff;
												if(iswdigit( *_t36 & 0x0000ffff) == 0) {
													goto L28;
												} else {
													if( *(__esi + 6) == 0x30) {
														goto L28;
													} else {
														_t46 = __ebx - 2; // -1
														__eax = _t46;
														_v20 = __ax;
														 &_v20 = RtlEqualUnicodeString( &_v20, 0x6df218f8, 1);
														if(__al != 0) {
															goto L46;
														} else {
															_push(1);
															_push(0x6df21910);
															goto L45;
														}
													}
												}
												goto L76;
											case 2:
												goto L28;
											case 3:
												_push(1);
												_push(0x6df21068);
												L45:
												if(RtlEqualUnicodeString( &_v20, ??, ??) == 0) {
													goto L28;
												} else {
													goto L46;
												}
												goto L76;
											case 4:
												_t35 =  &_v20; // 0xffff0
												_t35 = RtlEqualUnicodeString(_t35, 0x6df21060, 1);
												if(__al == 0) {
													goto L28;
												} else {
													L46:
													return _t109 + _t109 | _v12 << 0x00000010;
												}
												goto L76;
										}
									}
								} else {
									goto L28;
								}
							} else {
								_t71 = _t113 + ((_t105 & 0x0000ffff) - 1) * 2;
								if(_t71 < _t113) {
									L19:
									_t74 = ( *_t113 | 0x00000020) & 0x0000ffff;
									if(_t74 != 0x70) {
										if(_t74 == 0x6c || _t74 == 0x6e || _t74 == 0x61 || _t74 == 0x63) {
											goto L20;
										} else {
											goto L28;
										}
									} else {
										goto L20;
									}
								} else {
									while(1) {
										_t100 =  *_t71 & 0x0000ffff;
										if(_t100 == 0x5c || _t100 == 0x2f) {
											break;
										}
										if(_t100 == 0x3a) {
											if(_t71 !=  &(_t113[0])) {
												goto L14;
											} else {
												break;
											}
										} else {
											L14:
											_t71 = _t71 - 2;
											if(_t71 >= _t113) {
												continue;
											} else {
												goto L19;
											}
										}
										goto L76;
									}
									_t15 =  &(_t71[1]); // 0x3b
									_t107 = _t15;
									if(_t107 >= _t113 + (_t89 & 0xfffffffe)) {
										goto L28;
									} else {
										_t80 = ( *_t107 | 0x00000020) & 0x0000ffff;
										if(_t80 != 0x70) {
											if(_t80 == 0x6c || _t80 == 0x6e || _t80 == 0x61) {
												goto L18;
											} else {
												if(_t80 != 0x63) {
													goto L28;
												} else {
													goto L18;
												}
											}
										} else {
											L18:
											_v12 = _t107 - _t113;
											_t91 = _v8;
											_t101 = _t113 - _t107 + _t89 & 0x0000ffff;
											_t113 = _t107;
											_v16 = _t113;
											_t105 = (_t101 >> 0x00000001) - _t91 & 0x0000ffff;
											_v20 = _t101 - _t91 + _t91;
											goto L19;
										}
									}
								}
							}
						}
					}
				} else {
					_t85 =  *_t104 & 0x0000ffff;
					if(_t85 == 0x5c || _t85 == 0x2f) {
						if(_t112 < 4) {
							goto L3;
						} else {
							_t86 = _t104[1] & 0x0000ffff;
							if(_t86 != 0x5c) {
								if(_t86 != 0x2f) {
									goto L3;
								} else {
									goto L54;
								}
							} else {
								L54:
								if(_t112 < 6) {
									L28:
									return 0;
								} else {
									_t87 = _t104[2] & 0x0000ffff;
									if(_t87 != 0x2e) {
										if(_t87 == 0x3f) {
											goto L56;
										} else {
											goto L28;
										}
									} else {
										L56:
										if(_t112 < 8) {
											L69:
											if(_t112 != 6) {
												goto L28;
											} else {
												goto L3;
											}
										} else {
											_t88 = _t104[3] & 0x0000ffff;
											if(_t88 == 0x5c) {
												goto L28;
											} else {
												if(_t88 == 0x2f) {
													goto L28;
												} else {
													goto L69;
												}
											}
										}
									}
								}
							}
						}
					} else {
						goto L3;
					}
				}
				L76:
			}

0x6df674c0
0x6df674c8
0x6df674cd
0x6df674d0
0x6df674db
0x6df674f2
0x6df674f2
0x6df674f4
0x6df674f6
0x6df674f9
0x6df674fc
0x6df674ff
0x6df67501
0x6df6750a
0x6df67510
0x00000000
0x6df67516
0x6df6751c
0x6df677af
0x6df677af
0x6df677b2
0x6df677b8
0x6df677bd
0x6df67522
0x6df67522
0x6df67522
0x6df67527
0x00000000
0x6df6752d
0x6df6752d
0x6df67530
0x6df67539
0x00000000
0x00000000
0x6df6778f
0x6df67796
0x6df6779c
0x6df677a0
0x6df677a4
0x00000000
0x00000000
0x6df677aa
0x00000000
0x6df677a4
0x6df67549
0x6df6754c
0x6df67556
0x6df675e5
0x6df675e8
0x6df675ea
0x6df675ef
0x6df675f1
0x6df675f1
0x6df675f7
0x00000000
0x00000000
0x6df675fe
0x6df67603
0x00000000
0x00000000
0x00000000
0x6df67603
0x6df67607
0x6df67610
0x6dfaf983
0x6dfaf988
0x00000000
0x00000000
0x6dfaf98e
0x00000000
0x6dfaf988
0x6df67610
0x6df67607
0x6df6761b
0x6df6761f
0x6df67622
0x6df67627
0x6df6762e
0x6df67680
0x6df67680
0x6df67686
0x00000000
0x6df67688
0x6df67688
0x00000000
0x6df676a1
0x00000000
0x6df676cb
0x6df676cb
0x6df676cd
0x00000000
0x6df676cd
0x00000000
0x00000000
0x6df67718
0x6df67718
0x6df67727
0x00000000
0x6df6772d
0x6dfaf998
0x00000000
0x6dfaf99e
0x6dfaf99e
0x6dfaf99e
0x6dfaf9a3
0x6dfaf9b0
0x6dfaf9b7
0x00000000
0x6dfaf9bd
0x6dfaf9bd
0x6dfaf9bf
0x00000000
0x6dfaf9bf
0x6dfaf9b7
0x6dfaf998
0x00000000
0x00000000
0x00000000
0x00000000
0x6df6770f
0x6df67711
0x6df676d2
0x6df676dd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df676fc
0x6df67700
0x6df67707
0x00000000
0x6df6770d
0x6df676e3
0x6df676f4
0x6df676f4
0x00000000
0x00000000
0x6df67688
0x00000000
0x00000000
0x00000000
0x6df6755c
0x6df67560
0x6df67565
0x6df675d6
0x6df675dd
0x6df675e3
0x6df67661
0x00000000
0x6df6767e
0x00000000
0x6df6767e
0x00000000
0x00000000
0x00000000
0x6df67567
0x6df67567
0x6df67567
0x6df6756d
0x00000000
0x00000000
0x6df67577
0x6df6777a
0x00000000
0x6df67780
0x00000000
0x6df67780
0x6df6757d
0x6df6757d
0x6df6757d
0x6df67582
0x00000000
0x6df67584
0x00000000
0x6df67584
0x6df67582
0x00000000
0x6df67577
0x6df67586
0x6df67586
0x6df67592
0x00000000
0x6df67598
0x6df6759f
0x6df675a5
0x6df6763c
0x00000000
0x6df67654
0x6df67657
0x00000000
0x6df67659
0x00000000
0x6df67659
0x6df67657
0x6df675ab
0x6df675ab
0x6df675b3
0x6df675b6
0x6df675b9
0x6df675bc
0x6df675c1
0x6df675ca
0x6df675d2
0x00000000
0x6df675d2
0x6df675a5
0x6df67592
0x6df67565
0x6df67556
0x6df67527
0x6df674dd
0x6df674dd
0x6df674e3
0x6df67735
0x00000000
0x6df6773b
0x6df6773b
0x6df67742
0x6dfaf961
0x00000000
0x6dfaf967
0x00000000
0x6dfaf967
0x6df67748
0x6df67748
0x6df6774b
0x6df67630
0x6df67638
0x6df67751
0x6df67751
0x6df67758
0x6df67788
0x00000000
0x6df6778a
0x00000000
0x6df6778a
0x6df6775a
0x6df6775a
0x6df6775d
0x6dfaf975
0x6dfaf978
0x00000000
0x6dfaf97e
0x00000000
0x6dfaf97e
0x6df67763
0x6df67763
0x6df6776a
0x00000000
0x6df67770
0x6dfaf96f
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfaf96f
0x6df6776a
0x6df6775d
0x6df67758
0x6df6774b
0x6df67742
0x00000000
0x00000000
0x00000000
0x6df674e3
0x00000000

APIs

RtlEqualUnicodeString.9419(?,6DF21040,00000001,?,00000024,01000000), ref: 6DF6769A
RtlEqualUnicodeString.9419(?,6DF21050,00000001,?,6DF21040,00000001,?,00000024,01000000), ref: 6DF676AE
RtlEqualUnicodeString.9419(?,6DF21048,00000001,?,6DF21050,00000001,?,6DF21040,00000001,?,00000024,01000000), ref: 6DF676C2
RtlEqualUnicodeString.9419(?,6DF21058,00000001,?,6DF21048,00000001,?,6DF21050,00000001,?,6DF21040,00000001,?,00000024,01000000), ref: 6DF676D6
RtlEqualUnicodeString.9419(000FFFF0,6DF21060,00000001,6DF21068,00000001,6DF218F8,00000001), ref: 6DF67700
iswdigit.9419(000E6DF2,6DF21048,00000001,?,6DF21050,00000001,?,6DF21040,00000001,?,00000024,01000000), ref: 6DF6771D
RtlEqualUnicodeString.9419(00100000,6DF218F8,00000001), ref: 6DFAF9B0

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: 2d458e36b0132d71813d0c96445bd4f058c6416d9ccb1825a321d9958dfdfe63
Instruction ID: 2c8b5efa9e61358c877803bae73f3fb62510fb259328a76fa6d90c66bcec2ac0
Opcode Fuzzy Hash: 2d458e36b0132d71813d0c96445bd4f058c6416d9ccb1825a321d9958dfdfe63
Instruction Fuzzy Hash: A3811471C242E696CB20CA5CC8807BDB3B6EF06314F504966E6A4DBD90E777898682B1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF40B60, Relevance: 10.7, APIs: 7, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DF40B60(signed short* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _t39;
				signed int _t41;
				void* _t45;
				void* _t50;
				long _t51;
				signed int _t52;
				signed int _t53;
				signed int _t60;
				signed int _t64;
				signed int _t75;
				signed int _t76;
				signed int _t78;
				signed int _t80;
				signed int _t87;
				signed short* _t90;
				void* _t93;
				signed int _t105;
				signed short* _t106;
				signed int _t111;
				void* _t115;
				signed int _t116;
				signed int _t117;
				signed int _t121;
				signed int _t122;
				long _t123;
				long _t125;
				void* _t128;
				signed short* _t131;

				_t90 = _a4;
				if(_t90 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t39 = 0xc000000d;
				} else {
					_t87 = 0;
					_v16 = 0;
					_t41 =  *_t90 & 0x0000ffff;
					_t115 = 0x5b;
					_t121 = _t41;
					_v20 = _t121;
					if(_t41 == _t115) {
						_t90 =  &(_t90[1]);
					}
					_v5 = _t121 == _t115;
					if(E6DF40BD0(_t90,  &_v24, _a8) >= 0) {
						_t131 = _v24;
						_v12 = 0xa;
						__eflags =  *_t131 - 0x25;
						if( *_t131 != 0x25) {
							L22:
							_t45 = 0x5d;
							goto L23;
						} else {
							_t131 =  &(_t131[1]);
							_t125 =  *_t131 & 0x0000ffff;
							__eflags = _t125 - 0x80;
							if(_t125 >= 0x80) {
								goto L6;
							} else {
								_t76 = iswctype(_t125, 4);
								__eflags = _t76;
								if(_t76 == 0) {
									goto L6;
								} else {
									while(1) {
										__eflags = _t125;
										if(_t125 == 0) {
											break;
										}
										_t45 = 0x5d;
										__eflags = _t125 - _t45;
										if(_t125 == _t45) {
											_t121 = _v20;
											L23:
											__eflags =  *_t131 - _t45;
											if( *_t131 != _t45) {
												L45:
												_t116 = _v5;
												goto L46;
											} else {
												_t50 = 0x5b;
												__eflags = _t121 - _t50;
												if(_t121 != _t50) {
													goto L6;
												} else {
													_t131 =  &(_t131[1]);
													_t116 = 0;
													_v5 = 0;
													__eflags =  *_t131 - 0x3a;
													if( *_t131 != 0x3a) {
														L46:
														__eflags =  *_t131;
														if( *_t131 != 0) {
															goto L6;
														} else {
															__eflags = _t116;
															if(_t116 != 0) {
																goto L6;
															} else {
																 *_a16 = _t87;
																 *_a12 = _v16;
																_t39 = 0;
															}
														}
													} else {
														_t131 =  &(_t131[1]);
														_t122 = 0x10;
														__eflags =  *_t131 - 0x30;
														if( *_t131 != 0x30) {
															_t117 = 0xa;
														} else {
															_t24 =  &(_t131[1]); // -4
															_t106 = _t24;
															_t131 = _t106;
															_t117 = 8;
															_v12 = _t117;
															_t75 =  *_t131 & 0x0000ffff;
															__eflags = _t75 - 0x78;
															if(_t75 == 0x78) {
																L29:
																_t117 = _t122;
																_t26 =  &(_t106[1]); // 0x0
																_t131 = _t26;
																_v12 = _t117;
															} else {
																__eflags = _t75 - 0x58;
																if(_t75 != 0x58) {
																	goto L32;
																} else {
																	goto L29;
																}
																while(1) {
																	L32:
																	_t123 =  *_t131 & 0x0000ffff;
																	__eflags = _t123;
																	if(_t123 == 0) {
																		goto L45;
																	}
																	_t51 = 0x80;
																	__eflags = _t123 - 0x80;
																	if(_t123 >= 0x80) {
																		L39:
																		_t93 = 0x10;
																		__eflags = _t117 - _t93;
																		if(_t117 != _t93) {
																			goto L6;
																		} else {
																			__eflags = _t123 - _t51;
																			if(_t123 >= _t51) {
																				goto L6;
																			} else {
																				_t52 = iswctype(_t123, _t51);
																				__eflags = _t52;
																				if(_t52 == 0) {
																					goto L6;
																				} else {
																					_t53 = iswctype(_t123, 2);
																					asm("sbb eax, eax");
																					__eflags = (_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 - 0xffff;
																					if((_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 > 0xffff) {
																						goto L6;
																					} else {
																						_t60 = iswctype(_t123, 2);
																						_t117 = _v12;
																						asm("sbb eax, eax");
																						_t87 = (_t87 << 4) + 0xa + _t123 - ( ~_t60 & 0x00000020) + 0x41;
																						__eflags = _t87;
																						goto L44;
																					}
																				}
																			}
																		}
																	} else {
																		_t64 = iswctype(_t123, 4);
																		_t117 = _v12;
																		__eflags = _t64;
																		if(_t64 == 0) {
																			L38:
																			_t51 = 0x80;
																			goto L39;
																		} else {
																			_t105 = _t123 & 0x0000ffff;
																			_v24 = _t117 & 0x0000ffff;
																			_t31 = _t105 - 0x30; // -44
																			__eflags = _t31 - _v24;
																			if(_t31 >= _v24) {
																				goto L38;
																			} else {
																				__eflags = (_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 - 0xffff;
																				if((_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 > 0xffff) {
																					goto L6;
																				} else {
																					_t87 = _t117 * _t87 + 0xffffffd0 + _t123 & 0x0000ffff;
																					L44:
																					_t131 =  &(_t131[1]);
																					continue;
																				}
																			}
																		}
																	}
																	goto L7;
																}
																goto L45;
															}
														}
														goto L32;
													}
												}
											}
										} else {
											__eflags = _t125 - _t45 + 0x23;
											if(_t125 >= _t45 + 0x23) {
												goto L6;
											} else {
												_t78 = iswctype(_t125, 4);
												__eflags = _t78;
												if(_t78 == 0) {
													goto L6;
												} else {
													_v24 = _t125 & 0x0000ffff;
													_t80 = _v16;
													_t111 = 0xa;
													asm("cdq");
													asm("adc ecx, edx");
													_t128 = _t80 * _t111 + _v24 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t80 * _t111 >> 0x20;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L19:
															_t131 =  &(_t131[1]);
															__eflags = _t131;
															_v16 = _v16 * 0xa + _v24 + 0xffffffd0;
															_t125 =  *_t131 & 0x0000ffff;
															continue;
														} else {
															__eflags = _t128 - 0xffffffff;
															if(_t128 > 0xffffffff) {
																goto L6;
															} else {
																goto L19;
															}
														}
													}
												}
											}
										}
										goto L7;
									}
									_t121 = _v20;
									goto L22;
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t39;
			}

0x6df40b65
0x6df40b70
0x6df40bb7
0x6df40bb7
0x6df40b84
0x6df40b86
0x6df40b88
0x6df40b8b
0x6df40b90
0x6df40b91
0x6df40b93
0x6df40b99
0x6df40bc5
0x6df40bc5
0x6df40ba6
0x6df40bb1
0x6df9e578
0x6df9e580
0x6df9e587
0x6df9e58b
0x6df9e62e
0x6df9e630
0x00000000
0x6df9e591
0x6df9e591
0x6df9e594
0x6df9e597
0x6df9e59a
0x00000000
0x6df9e5a0
0x6df9e5a3
0x6df9e5aa
0x6df9e5ac
0x00000000
0x6df9e5b2
0x6df9e626
0x6df9e626
0x6df9e629
0x00000000
0x00000000
0x6df9e5b6
0x6df9e5b7
0x6df9e5ba
0x6df9e686
0x6df9e631
0x6df9e631
0x6df9e634
0x6df9e76f
0x6df9e76f
0x00000000
0x6df9e63a
0x6df9e63c
0x6df9e63d
0x6df9e640
0x00000000
0x6df9e646
0x6df9e646
0x6df9e649
0x6df9e64b
0x6df9e64e
0x6df9e652
0x6df9e772
0x6df9e774
0x6df9e777
0x00000000
0x6df9e77d
0x6df9e77d
0x6df9e77f
0x00000000
0x6df9e785
0x6df9e78c
0x6df9e795
0x6df9e797
0x6df9e797
0x6df9e77f
0x6df9e658
0x6df9e658
0x6df9e65d
0x6df9e65e
0x6df9e662
0x6df9e68d
0x6df9e664
0x6df9e664
0x6df9e664
0x6df9e667
0x6df9e66b
0x6df9e66c
0x6df9e66f
0x6df9e672
0x6df9e675
0x6df9e67c
0x6df9e67c
0x6df9e67e
0x6df9e67e
0x6df9e681
0x6df9e677
0x6df9e677
0x6df9e67a
0x00000000
0x00000000
0x00000000
0x00000000
0x6df9e68e
0x6df9e68e
0x6df9e68e
0x6df9e691
0x6df9e694
0x00000000
0x00000000
0x6df9e69a
0x6df9e69f
0x6df9e6a2
0x6df9e6f1
0x6df9e6f3
0x6df9e6f4
0x6df9e6f7
0x00000000
0x6df9e6fd
0x6df9e6fd
0x6df9e700
0x00000000
0x6df9e706
0x6df9e708
0x6df9e70f
0x6df9e711
0x00000000
0x6df9e717
0x6df9e71a
0x6df9e722
0x6df9e73b
0x6df9e740
0x00000000
0x6df9e746
0x6df9e74c
0x6df9e751
0x6df9e757
0x6df9e765
0x6df9e765
0x00000000
0x6df9e765
0x6df9e740
0x6df9e711
0x6df9e700
0x6df9e6a4
0x6df9e6a7
0x6df9e6ac
0x6df9e6b1
0x6df9e6b3
0x6df9e6ec
0x6df9e6ec
0x00000000
0x6df9e6b5
0x6df9e6b5
0x6df9e6bb
0x6df9e6be
0x6df9e6c1
0x6df9e6c4
0x00000000
0x6df9e6c6
0x6df9e6d2
0x6df9e6d7
0x00000000
0x6df9e6dd
0x6df9e6e7
0x6df9e767
0x6df9e767
0x00000000
0x6df9e767
0x6df9e6d7
0x6df9e6c4
0x6df9e6b3
0x00000000
0x6df9e6a2
0x00000000
0x6df9e68e
0x6df9e675
0x00000000
0x6df9e662
0x6df9e652
0x6df9e640
0x6df9e5c0
0x6df9e5c3
0x6df9e5c6
0x00000000
0x6df9e5cc
0x6df9e5cf
0x6df9e5d6
0x6df9e5d8
0x00000000
0x6df9e5de
0x6df9e5e1
0x6df9e5e4
0x6df9e5e9
0x6df9e5f3
0x6df9e5f6
0x6df9e5f8
0x6df9e5fb
0x6df9e5fe
0x6df9e600
0x00000000
0x6df9e606
0x6df9e606
0x6df9e611
0x6df9e61d
0x6df9e61d
0x6df9e620
0x6df9e623
0x00000000
0x6df9e608
0x6df9e608
0x6df9e60b
0x00000000
0x00000000
0x00000000
0x00000000
0x6df9e60b
0x6df9e606
0x6df9e600
0x6df9e5d8
0x6df9e5c6
0x00000000
0x6df9e5ba
0x6df9e62b
0x00000000
0x6df9e62b
0x6df9e5ac
0x6df9e59a
0x00000000
0x00000000
0x00000000
0x6df40bb1
0x6df40bbc
0x6df40bc2

APIs

RtlIpv6StringToAddressW.9419(?,?,00000000,00000000), ref: 6DF40BAA

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID:
API String ID: 27538981-0
Opcode ID: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction ID: 1331f5f4052a181c7a992c80bac47a56c6dbf02190c5c36efb789095963038bb
Opcode Fuzzy Hash: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction Fuzzy Hash: 32617E72D442029BEB28CA6DDC41BBE77F1BF25728F11852AEC94DB2C0EB749980C755

Uniqueness

Uniqueness Score: -1.00%

Function 6DF48D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6DF48D29(intOrPtr __ecx, intOrPtr* _a4, intOrPtr _a8, signed int* _a12) {
				char _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				void* _t104;
				signed int _t106;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				signed char* _t147;
				signed int _t149;
				intOrPtr _t152;
				void* _t156;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t165;
				intOrPtr* _t166;
				signed int* _t167;
				intOrPtr* _t168;
				signed int* _t169;
				signed int _t170;
				signed int _t172;
				void* _t174;
				short* _t175;
				short* _t176;
				void* _t177;
				void* _t178;
				void* _t187;

				_t152 = __ecx;
				_v12 = _v12 & 0x00000000;
				_t167 = _a12;
				_v28 = __ecx;
				_v20 = 0xc00000e5;
				if(_t167 != 0) {
					 *_t167 =  *_t167 & 0x00000000;
				}
				_push( &_v24);
				_t172 = 1;
				_push( &_v16);
				_push(1);
				_push(_t152);
				_push(_t152);
				_t149 = 0x30;
				_push(_t149);
				_push(_t167);
				_push(_a8);
				_push(_a4);
				E6DF71D47( &_v20);
				if(_v12 == 0) {
					return _v20;
				} else {
					_push( &_v8);
					_push( &_v20);
					_t178 = _t177 - 0x14;
					_push( &_v12);
					_push( &_v12);
					_t104 = E6DF48EE6(_v16, _v24);
					if(_t104 < 0) {
						return _t104;
					}
					_t163 = _v28;
					_t106 =  *((intOrPtr*)(_t163 + 0x18)) + _t163;
					_v12 = _t106;
					_t156 =  *((intOrPtr*)(_t106 + 0xc)) + _t163;
					if(1 >=  *((intOrPtr*)(_t106 + 8))) {
						L8:
						if(_t187 == 0) {
							_push(_t163);
							E6DFD5720(0x33, 0, "SXS: %s() found activation context data at %p with assembly roster that has no root\n", "RtlpQueryInformationActivationContextDetailedInformation");
							return 0xc0150003;
						}
						_t158 =  *((intOrPtr*)(_t172 * 0x18 + _t156 + 0x10)) + _t163;
						_v20 = _t158;
						_t33 = _t158 + 0x14; // 0x0
						_t110 =  *_t33;
						if(_t110 != 0) {
							_t34 = _t110 + 0x32; // 0x6df91822
							_t149 = _t34;
						}
						_t35 = _t158 + 0x28; // 0xffffffc4
						_t111 =  *_t35;
						if(_t111 != 0) {
							_t149 = _t149 + 2 + _t111;
						}
						_t113 =  *((intOrPtr*)(_v8 + 0x2c));
						if(_t113 != 0) {
							_t149 = _t149 + 2 + _t113;
						}
						if(_t149 <= _a8) {
							_t168 = _a4;
							_t174 = _a4 + 0x30;
							 *_t168 =  *((intOrPtr*)(_t163 + 0x1c));
							_t164 = _t168;
							 *((intOrPtr*)(_t164 + 4)) =  *((intOrPtr*)(_t163 + 8));
							 *((intOrPtr*)(_t164 + 8)) =  *((intOrPtr*)(_v12 + 8)) - 1;
							_t47 = _t158 + 0x10; // 0xfffffffe
							 *((intOrPtr*)(_t164 + 0xc)) =  *_t47;
							_t49 = _t158 + 0x14; // 0x0
							 *(_t164 + 0x24) =  *(_t164 + 0x24) & 0x00000000;
							 *(_t164 + 0x10) =  *_t49 >> 1;
							_t53 = _t158 + 0x24; // 0x0
							 *((intOrPtr*)(_t164 + 0x14)) =  *_t53;
							_t55 = _t158 + 0x28; // 0xffffffc4
							 *(_t164 + 0x28) =  *(_t164 + 0x28) & 0x00000000;
							 *(_t164 + 0x18) =  *_t55 >> 1;
							_t165 = _v8;
							 *((intOrPtr*)(_t168 + 0x1c)) =  *((intOrPtr*)(_t165 + 0x28));
							_t166 = _t168;
							_t169 = _a12;
							 *(_t166 + 0x2c) =  *(_t166 + 0x2c) & 0x00000000;
							 *(_t166 + 0x20) =  *(_t165 + 0x2c) >> 1;
							if( *(_t158 + 0x14) != 0) {
								_t68 = _t158 + 0x14; // 0x0
								_t69 = _t158 + 0x18; // 0x6dfb4765
								memcpy(_t174,  *_t69 + _v16,  *_t68);
								_t178 = _t178 + 0xc;
								_t158 = _v20;
								 *(_a4 + 0x24) = _t174;
								_t176 = _t174 +  *(_t158 + 0x14);
								 *_t176 = 0;
								_t174 = _t176 + 2;
							}
							if( *(_t158 + 0x28) != 0) {
								_t86 = _t158 + 0x28; // 0xffffffc4
								_t87 = _t158 + 0x2c; // 0x0
								memcpy(_t174,  *_t87 + _v16,  *_t86);
								_t178 = _t178 + 0xc;
								 *(_a4 + 0x28) = _t174;
								_t175 = _t174 +  *((intOrPtr*)(_v20 + 0x28));
								 *_t175 = 0;
								_t174 = _t175 + 2;
							}
							_t159 = _v8;
							if( *(_t159 + 0x2c) != 0) {
								memcpy(_t174,  *((intOrPtr*)(_t159 + 0x30)) + _t159,  *(_t159 + 0x2c));
								 *(_a4 + 0x2c) = _t174;
								 *((short*)(_t174 +  *((intOrPtr*)(_v8 + 0x2c)))) = 0;
							}
							if(_t169 != 0) {
								 *_t169 = _t149;
							}
							return 0;
						} else {
							if(_t167 != 0) {
								 *_t167 = _t149;
							}
							return 0xc0000023;
						}
					}
					_t170 = _v12;
					_t24 = _t156 + 0x18; // 0x116
					_t147 = _t24;
					while(( *_t147 & 0x00000002) == 0) {
						_t172 = _t172 + 1;
						_t147 =  &(_t147[0x18]);
						if(_t172 <  *((intOrPtr*)(_t170 + 8))) {
							continue;
						}
						break;
					}
					_t167 = _a12;
					_t187 = _t172 -  *((intOrPtr*)(_v12 + 8));
					goto L8;
				}
			}

0x6df48d29
0x6df48d31
0x6df48d38
0x6df48d3b
0x6df48d3e
0x6df48d47
0x6df48d49
0x6df48d49
0x6df48d51
0x6df48d55
0x6df48d56
0x6df48d57
0x6df48d58
0x6df48d59
0x6df48d5c
0x6df48d5d
0x6df48d5e
0x6df48d5f
0x6df48d65
0x6df48d6b
0x6df48d76
0x00000000
0x6df48d7c
0x6df48d82
0x6df48d86
0x6df48d87
0x6df48d8d
0x6df48d8e
0x6df48d92
0x6df48d99
0x6df48e14
0x6df48e14
0x6df48d9b
0x6df48da1
0x6df48da3
0x6df48da9
0x6df48dae
0x6df48dc8
0x6df48dc8
0x6dfa348b
0x6dfa349a
0x00000000
0x6dfa34a2
0x6df48dd5
0x6df48dd7
0x6df48dda
0x6df48dda
0x6df48ddf
0x6df48de1
0x6df48de1
0x6df48de1
0x6df48de4
0x6df48de4
0x6df48de9
0x6dfa34af
0x6dfa34af
0x6df48df2
0x6df48df7
0x6df48dfc
0x6df48dfc
0x6df48e01
0x6df48e1a
0x6df48e20
0x6df48e23
0x6df48e28
0x6df48e2a
0x6df48e34
0x6df48e37
0x6df48e3a
0x6df48e3d
0x6df48e40
0x6df48e46
0x6df48e49
0x6df48e4c
0x6df48e4f
0x6df48e52
0x6df48e58
0x6df48e5b
0x6df48e61
0x6df48e67
0x6df48e69
0x6df48e6e
0x6df48e72
0x6df48e79
0x6df48e7b
0x6df48e7e
0x6df48e86
0x6df48e8e
0x6df48e91
0x6df48e94
0x6df48e99
0x6df48e9c
0x6df48e9f
0x6df48e9f
0x6df48ea6
0x6dfa34b6
0x6dfa34b9
0x6dfa34c1
0x6dfa34c9
0x6dfa34cc
0x6dfa34d2
0x6dfa34d7
0x6dfa34da
0x6dfa34da
0x6df48eac
0x6df48eb3
0x6df48ebf
0x6df48ecc
0x6df48ed5
0x6df48ed5
0x6df48edb
0x6df48edd
0x6df48edd
0x00000000
0x6df48e03
0x6df48e05
0x6df48e07
0x6df48e07
0x00000000
0x6df48e09
0x6df48e01
0x6df48db0
0x6df48db3
0x6df48db3
0x6df48db6
0x6dfa3479
0x6dfa347a
0x6dfa3480
0x00000000
0x00000000
0x00000000
0x6dfa3486
0x6df48dc2
0x6df48dc5
0x00000000
0x6df48dc5

APIs

memcpy.9419(-00000030,?,00000000,?,00000000,?,?,6DF917F0,00000000,?,00000000,?), ref: 6DF48E86
memcpy.9419(-00000030,?,?,?,00000000,?,?,6DF917F0,00000000,?,00000000,?), ref: 6DF48EBF

Strings

RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6DFA348C
SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6DFA3491

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: 0ca4cb9f6a3a58a064327eec64b51f33eed77ca037d7b7d4e6dcb25d324f69d3
Instruction ID: bbaf647825552fb0064626ddcaaf0167173dfd71dfd6b4f21e90e263a281e4b3
Opcode Fuzzy Hash: 0ca4cb9f6a3a58a064327eec64b51f33eed77ca037d7b7d4e6dcb25d324f69d3
Instruction Fuzzy Hash: 94710DB5A0011ADFDB05CF5CC880AAABBF5FF58314F258599E8189B352D331E991CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 6DF620A0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6DF620A0(intOrPtr* __ecx) {
				signed int _v0;
				signed int _v8;
				signed char _v60;
				signed int* _v64;
				signed char _v68;
				signed int* _v72;
				intOrPtr _v76;
				signed int* _v84;
				signed int* _v88;
				char _v92;
				signed int _v96;
				signed char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t111;
				void* _t133;
				signed char _t134;
				signed int* _t135;
				signed int* _t136;
				signed char _t138;
				signed int* _t142;
				signed int* _t144;
				void* _t145;
				intOrPtr* _t147;
				void* _t149;
				signed int _t152;
				signed int _t154;

				_t154 = (_t152 & 0xfffffff8) - 0x64;
				_v8 =  *0x6e03d360 ^ _t154;
				_t144 =  *( *[fs:0x18] + 0x1a8);
				_t147 = __ecx;
				if(_t144 == 0) {
					_t142 = 0;
				} else {
					_t142 =  *_t144;
				}
				_t138 =  *(_t147 + 0x10);
				if((_t138 & 0x00000040) != 0) {
					_v84 = 0;
					_v76 = 3;
					_v72 = 0;
					_v68 = _t147 + 8;
					_v64 =  *_t144;
					_push( &_v92);
					_v92 = 0xc0150011;
					_v88 = 0;
					_t104 = E6DF9DEF0(_t138, _t142);
					goto L12;
				} else {
					if((_t138 & 0x00000020) == 0) {
						_v84 = 0;
						_v76 = 3;
						_v72 = 0;
						_v68 = _t147 + 8;
						_v64 =  *_t144;
						_v92 = 0xc0150010;
						L25:
						_v88 = 1;
						_push( &_v92);
						_t104 = E6DF9DEF0(_t138, _t142);
						L12:
						_pop(_t145);
						_pop(_t149);
						_pop(_t133);
						return E6DF8B640(_t104, _t133, _v0 ^ _t154, _t142, _t145, _t149);
					}
					_t104 = _t138 & 0x00000060;
					if((_t138 & 0x00000060) != 0x20) {
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t147 + 8;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					if( *_t147 < 0x24) {
						L8:
						if(_t142 != 0) {
							_t134 = _t142[2];
							_t104 = _t134 & 0x00000070;
							if((_t134 & 0x00000070) != 0x20) {
								L28:
								_v84 = 0;
								_v76 = 4;
								_v72 = _t144;
								_v68 = _t142;
								_v64 = _t142;
								_v60 = _t142[2];
								_v92 = 0xc0150014;
								goto L25;
							}
							if((_t134 & 0x00000008) != 0 ||  *((intOrPtr*)(_t142 - 8)) < 0x24) {
								goto L9;
							} else {
								if(_t142[3] !=  !( *_t142)) {
									goto L28;
								}
								_t104 =  !(_t142[1]);
								if(_t142[4] ==  !(_t142[1])) {
									goto L9;
								}
								goto L28;
							}
						}
						L9:
						if((_t138 & 0x00000010) == 0) {
							_t27 = _t147 + 8; // 0x2c
							_t135 = _t27;
							if(_t142 != _t135) {
								_t111 =  *_t144;
								_push(_t135);
								_push(_t111);
								_v100 = _t111;
								_v96 =  *_t135;
								E6DFD5720(0x33, 2, "SXS: %s() Active frame is not the frame being deactivated %p != %p\n", "RtlDeactivateActivationContextUnsafeFast");
								_t138 = _v100;
								_t154 = _t154 + 0x18;
								_t142 = 0;
								if(_t138 == 0) {
									L36:
									_v84 = 0;
									_v76 = 3;
									_v72 = _t142;
									_v68 = _t135;
									_v64 =  *_t144;
									if(_t138 == 0) {
										_v92 = 0xc0150010;
										_v88 = 1;
									} else {
										_v88 = 0;
										_v92 = (0 | _t142 == 0x00000000) * 2 - 0x3feafff1;
									}
									_push( &_v92);
									E6DF9DEF0(_t138, _t142);
									goto L20;
								}
								while(_t138 != _v96) {
									if(( *(_t138 + 8) & 0x00000070) != 0x20 || ( *(_t138 + 8) & 0x00000008) == 0 && ( *((intOrPtr*)(_t138 + 0xc)) !=  !( *_t138) ||  *((intOrPtr*)(_t138 + 0x10)) !=  !( *(_t138 + 4)))) {
										_v84 = 0;
										_v76 = 4;
										_v72 = _t144;
										_v68 = _t138;
										_v64 = _t135;
										_v60 =  *(_t138 + 8);
										_v92 = 0xc0150014;
										goto L25;
									} else {
										_t138 =  *_t138;
										_t142 =  &(_t142[0]);
										if(_t138 != 0) {
											continue;
										}
										goto L36;
									}
								}
								goto L36;
							}
							L20:
							_t104 =  *_t135;
							 *_t144 =  *_t135;
						}
						 *(_t147 + 0x10) =  *(_t147 + 0x10) | 0x00000040;
						if( *_t147 >= 0x24) {
							_t104 = _v0;
							 *(_t147 + 0x20) = _v0;
						}
						goto L12;
					}
					_t9 = _t147 + 8; // 0x2c
					_t136 = _t9;
					if( *((intOrPtr*)(_t147 + 0x14)) !=  !( *(_t147 + 8))) {
						L27:
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t136;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					_t104 =  !( *(_t147 + 0xc));
					if( *((intOrPtr*)(_t147 + 0x18)) !=  !( *(_t147 + 0xc))) {
						goto L27;
					}
					goto L8;
				}
			}

0x6df620a8
0x6df620b2
0x6df620bf
0x6df620c5
0x6df620c9
0x6dfacfc8
0x6df620cf
0x6df620cf
0x6df620cf
0x6df620d1
0x6df620d7
0x6dfacfd2
0x6dfacfda
0x6dfacfe2
0x6dfacfea
0x6dfacff0
0x6dfacff8
0x6dfacff9
0x6dfad001
0x6dfad009
0x00000000
0x6df620dd
0x6df620e0
0x6dfad016
0x6dfad01e
0x6dfad026
0x6dfad02e
0x6dfad034
0x6dfad038
0x6dfad06d
0x6dfad071
0x6dfad079
0x6dfad07a
0x6df6212e
0x6df62132
0x6df62133
0x6df62134
0x6df6213f
0x6df6213f
0x6df620e8
0x6df620ec
0x6dfad087
0x6dfad08f
0x6dfad097
0x6dfad09b
0x6dfad09f
0x6dfad0a3
0x6dfad0a7
0x00000000
0x6dfad0a7
0x6df620f5
0x6df62116
0x6df62118
0x6df62140
0x6df62145
0x6df62149
0x6dfad0db
0x6dfad0db
0x6dfad0e3
0x6dfad0eb
0x6dfad0ef
0x6dfad0f3
0x6dfad0fa
0x6dfad0fe
0x00000000
0x6dfad0fe
0x6df62152
0x00000000
0x6df6215a
0x6df62161
0x00000000
0x00000000
0x6df6216a
0x6df6216f
0x00000000
0x00000000
0x00000000
0x6df62171
0x6df62152
0x6df6211a
0x6df6211d
0x6df62176
0x6df62176
0x6df6217b
0x6dfad10b
0x6dfad10f
0x6dfad110
0x6dfad11f
0x6dfad123
0x6dfad127
0x6dfad12c
0x6dfad130
0x6dfad133
0x6dfad137
0x6dfad174
0x6dfad174
0x6dfad17c
0x6dfad184
0x6dfad188
0x6dfad18e
0x6dfad194
0x6dfad1b2
0x6dfad1ba
0x6dfad196
0x6dfad198
0x6dfad1ac
0x6dfad1ac
0x6dfad1c6
0x6dfad1c7
0x00000000
0x6dfad1c7
0x6dfad139
0x6dfad146
0x6dfad042
0x6dfad04a
0x6dfad052
0x6dfad056
0x6dfad05a
0x6dfad061
0x6dfad065
0x00000000
0x6dfad16d
0x6dfad16d
0x6dfad16f
0x6dfad172
0x00000000
0x00000000
0x00000000
0x6dfad172
0x6dfad146
0x00000000
0x6dfad139
0x6df62181
0x6df62181
0x6df62183
0x6df62183
0x6df6211f
0x6df62126
0x6df62128
0x6df6212b
0x6df6212b
0x00000000
0x6df62126
0x6df620fa
0x6df620fa
0x6df62102
0x6dfad0b1
0x6dfad0b1
0x6dfad0b9
0x6dfad0c1
0x6dfad0c5
0x6dfad0c9
0x6dfad0cd
0x6dfad0d1
0x00000000
0x6dfad0d1
0x6df6210b
0x6df62110
0x00000000
0x00000000
0x00000000
0x6df62110

APIs

RtlRaiseException.9419(?), ref: 6DFAD009
RtlRaiseException.9419(C0150010), ref: 6DFAD07A
DbgPrintEx.9419(00000033,00000002,SXS: %s() Active frame is not the frame being deactivated %p != %p,RtlDeactivateActivationContextUnsafeFast,?,0000002C,?,00000000,000000FF), ref: 6DFAD127
RtlRaiseException.9419(C0150010), ref: 6DFAD1C7

Strings

RtlDeactivateActivationContextUnsafeFast, xrefs: 6DFAD111
SXS: %s() Active frame is not the frame being deactivated %p != %p, xrefs: 6DFAD116

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise$Print
String ID: RtlDeactivateActivationContextUnsafeFast$SXS: %s() Active frame is not the frame being deactivated %p != %p
API String ID: 3901562751-4142264681
Opcode ID: 9ed643c57e9608c8ba2315dcda48bb77603e466b48b113585211fc16451ef85b
Instruction ID: 126a1cf02e4973d3e41438019648b942d51904e974f62024fdbf9b4dc842c511
Opcode Fuzzy Hash: 9ed643c57e9608c8ba2315dcda48bb77603e466b48b113585211fc16451ef85b
Instruction Fuzzy Hash: FB8127B1508346DFE310CF19C48471AFBE0BB89348F188A1EF9999B251E376D585CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DF5A500(void* __ebx, void* __esi, void* __eflags, intOrPtr _a4, void* _a8, char _a12) {
				signed int _v8;
				char _v10;
				char _v12;
				char _v508;
				char _v512;
				void _v520;
				struct _EXCEPTION_RECORD _v524;
				intOrPtr _v528;
				char _v532;
				void* __edi;
				void* __ebp;
				void* _t49;
				WCHAR* _t62;
				int _t65;
				void* _t80;
				signed char _t81;
				struct _EXCEPTION_RECORD _t82;
				int _t95;
				short _t98;
				void* _t112;
				short* _t114;
				signed short _t116;
				int _t117;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t113 = __esi;
				_t80 = __ebx;
				_v8 =  *0x6e03d360 ^ _t119;
				_t112 = _a8;
				_push(_t112);
				_v524 = _a4;
				_t49 = E6DF5A860(__eflags);
				if(_t49 != 1 ||  *_t112 != _t49) {
					_t50 = 0xc0000078;
					goto L25;
				} else {
					_push(__esi);
					E6DF971A0( &_v520, 0x100, L"S-1-");
					_t121 = _t120 + 0xc;
					_t114 =  &_v512;
					if( *(_t112 + 2) != 0 ||  *(_t112 + 3) != 0) {
						E6DF97110( &_v520, 0x100, 0x6df3292c);
						_t114 =  &_v508;
						_t121 = _t121 + 0xc;
						_v528 = ( *(_t112 + 3) & 0x000000ff) + (( *(_t112 + 2) & 0x000000ff) << 8);
						_push(_t114);
						_v532 = (((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff);
						_push(0xfa);
						_t50 = E6DFE5BFD(_t80,  &_v532, _t112, _t114, __eflags);
					} else {
						_t111 = 0xa;
						_t50 = E6DF5A6C0((((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff), 0xa, 0xfc, _t114);
					}
					if(_t50 < 0) {
						L24:
						_pop(_t113);
						L25:
						return E6DF8B640(_t50, _t80, _v8 ^ _t119, _t111, _t112, _t113);
					} else {
						_push(_t80);
						_t81 = 0;
						if( *((intOrPtr*)(_t112 + 1)) <= 0) {
							L14:
							if(_a12 != 0) {
								_t62 =  &_v520;
								RtlCreateUnicodeString(_v524, _t62);
								__eflags = _t62;
								if(_t62 != 0) {
									L22:
									_t50 = 0;
									L23:
									_pop(_t80);
									goto L24;
								}
								_t50 = 0xc0000017;
								goto L23;
							}
							if(_t114 >=  &_v10) {
								L18:
								_t82 = _v524;
								_t116 = _t114 -  &_v520 & 0xfffffffe;
								_t65 =  *(_t82 + 2) & 0x0000ffff;
								_t95 = _t65;
								if(_t116 >= _t95) {
									_t50 = 0x80000005;
									goto L23;
								}
								_t112 =  *(_t82 + 4);
								_t117 = _t116 & 0x0000ffff;
								if(_t117 > _t65) {
									_t117 = _t95;
								}
								 *_t82 = _t117;
								memcpy(_t112,  &_v520, _t117);
								if(( *_t82 & 0x0000ffff) + 2 <= ( *(_t82 + 2) & 0x0000ffff)) {
									 *((short*)(_t112 + (_t117 >> 1) * 2)) = 0;
								}
								goto L22;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v10) {
									continue;
								}
								goto L18;
							}
							goto L18;
						}
						_t98 = 0x2d;
						do {
							if(_t114 >=  &_v12) {
								L12:
								 *_t114 = _t98;
								_t114 = _t114 + 2;
								_t111 = 0xa;
								if(E6DF5A6C0( *((intOrPtr*)(_t112 + 8 + (_t81 & 0x000000ff) * 4)), 0xa, 0x100 - (_t114 -  &_v520 >> 1), _t114) < 0) {
									goto L23;
								}
								goto L13;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v12) {
									continue;
								}
								goto L12;
							}
							goto L12;
							L13:
							_t81 = _t81 + 1;
							_t98 = 0x2d;
						} while (_t81 <  *((intOrPtr*)(_t112 + 1)));
						goto L14;
					}
				}
			}

0x6df5a500
0x6df5a500
0x6df5a512
0x6df5a519
0x6df5a51c
0x6df5a51d
0x6df5a523
0x6df5a52a
0x6dfaa2c0
0x00000000
0x6df5a538
0x6df5a538
0x6df5a54a
0x6df5a54f
0x6df5a552
0x6df5a55c
0x6dfaa2db
0x6dfaa2e4
0x6dfaa2ee
0x6dfaa2fa
0x6dfaa31d
0x6dfaa31e
0x6dfaa32a
0x6dfaa32f
0x6df5a56c
0x6df5a570
0x6df5a598
0x6df5a598
0x6df5a59f
0x6df5a684
0x6df5a684
0x6df5a685
0x6df5a693
0x6df5a5a5
0x6df5a5a5
0x6df5a5a6
0x6df5a5ab
0x6df5a610
0x6df5a614
0x6df5a696
0x6df5a6a3
0x6df5a6a8
0x6df5a6aa
0x6df5a681
0x6df5a681
0x6df5a683
0x6df5a683
0x00000000
0x6df5a683
0x6df5a6ac
0x00000000
0x6df5a6ac
0x6df5a61f
0x6df5a631
0x6df5a631
0x6df5a63f
0x6df5a642
0x6df5a646
0x6df5a64a
0x6df5a6b7
0x00000000
0x6df5a6b7
0x6df5a64c
0x6df5a64f
0x6df5a655
0x6df5a6b3
0x6df5a6b3
0x6df5a65e
0x6df5a663
0x6df5a677
0x6df5a67d
0x6df5a67d
0x00000000
0x6df5a677
0x6df5a621
0x6df5a627
0x6df5a62f
0x00000000
0x00000000
0x00000000
0x6df5a62f
0x00000000
0x6df5a621
0x6df5a5ad
0x6df5a5b2
0x6df5a5b7
0x6df5a5d0
0x6df5a5d0
0x6df5a5d9
0x6df5a5dc
0x6df5a5fe
0x00000000
0x00000000
0x00000000
0x6df5a5fe
0x6df5a5c0
0x6df5a5c6
0x6df5a5ce
0x00000000
0x00000000
0x00000000
0x6df5a5ce
0x00000000
0x6df5a604
0x6df5a604
0x6df5a606
0x6df5a60b
0x00000000
0x6df5a5b2
0x6df5a59f

APIs

RtlValidSid.9419(00000050,?), ref: 6DF5A523
wcscpy_s.9419(?,00000100,S-1-,?,00000050,?), ref: 6DF5A54A

Part of subcall function 6DF5A6C0: memcpy.9419(00000000,?,?,?,00000050,?,00000000), ref: 6DF5A781

memcpy.9419(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6DF5A663
RtlCreateUnicodeString.9419(?,?,00000000,000000FC,?,?,00000050,?), ref: 6DF5A6A3
wcscat_s.9419(?,00000100,6DF3292C,?,00000050,?), ref: 6DFAA2DB

Strings

S-1-, xrefs: 6DF5A539

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: e445b7a9148708967496e2c02c7539db73cc7c3787315fb123d0f2a1a3200148
Instruction ID: 753a4bd023c01d06f0b3f234a4fa06c523ebbb70e795e05d159ede1f9031e3dc
Opcode Fuzzy Hash: e445b7a9148708967496e2c02c7539db73cc7c3787315fb123d0f2a1a3200148
Instruction Fuzzy Hash: 99510BB1D0416A5ADB24CB2CCC54FB9F7F4AF15300F0641A6D969D7181E334AEB4CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF4CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6DF4CCC0(signed short _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _t36;
				signed short _t39;
				signed int _t46;
				signed int _t55;
				intOrPtr _t57;
				unsigned int _t67;
				intOrPtr _t70;
				signed int _t79;
				void* _t84;
				void* _t90;
				signed int _t92;
				void* _t93;

				_push(0xfffffffe);
				_push(0x6e01f828);
				_push(0x6df917f0);
				_push( *[fs:0x0]);
				_t36 =  *0x6e03d360;
				_v12 = _v12 ^ _t36;
				_push(_t36 ^ _t92);
				 *[fs:0x0] =  &_v20;
				_v28 = _t93 - 0xc;
				_t57 =  *[fs:0x18];
				if(_t57 == 0) {
					_t39 = _a4;
				} else {
					_v8 = 0;
					_t39 = _a4;
					 *(_t57 + 0xbf4) = _t39;
					_v8 = 0xfffffffe;
				}
				if(_t39 == 0) {
					 *[fs:0x0] = _v20;
					return 0;
				} else {
					if(_t39 == 0x103) {
						 *[fs:0x0] = _v20;
						return 0x3e5;
					} else {
						if((_t39 & 0x20000000) != 0) {
							L16:
							 *[fs:0x0] = _v20;
							return _t39;
						} else {
							if((_t39 & 0x00ff0000) == 0x70000) {
								_t67 = _t39 >> 0x18;
								if(_t67 != 0xc0) {
									if(_t67 != 0x80) {
										goto L6;
									} else {
										goto L21;
									}
								} else {
									goto L21;
								}
							} else {
								L6:
								if((_t39 & 0xf0000000) == 0xd0000000) {
									_t39 = _t39 & 0xcfffffff;
								}
								_t90 = 0;
								_t84 = 0x11e;
								do {
									_t79 = _t84 + _t90 >> 1;
									_t70 =  *((intOrPtr*)(0x6df2a300 + _t79 * 8));
									_t55 = _t39 - _t70;
									if(_t39 < _t70) {
										_t84 = _t79 - 1;
										goto L11;
									} else {
										if(_t55 < ( *(0x6df2a304 + _t79 * 8) & 0x000000ff)) {
											_t46 =  *(0x6df2a306 + _t79 * 8) & 0x0000ffff;
											if( *((char*)(0x6df2a305 + _t79 * 8)) != 1) {
												_t39 = ( *(0x6df28692 + (_t46 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6df28690 + (_t46 + _t55 * 2) * 2) & 0x0000ffff;
											} else {
												_t39 =  *(0x6df28690 + (_t46 + _t55) * 2) & 0x0000ffff;
											}
											goto L16;
										} else {
											_t90 = _t79 + 1;
											goto L11;
										}
									}
									goto L28;
									L11:
								} while (_t90 <= _t84);
								if((_t39 & 0xffff0000) == 0xc0010000) {
									L21:
									 *[fs:0x0] = _v20;
									return _t39 & 0x0000ffff;
								} else {
									E6DF4B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t39);
									E6DF4B150();
									E6DF4B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
									_t39 = 0x13d;
									goto L16;
								}
							}
						}
					}
				}
				L28:
			}

0x6df4ccc5
0x6df4ccc7
0x6df4cccc
0x6df4ccd7
0x6df4ccde
0x6df4cce3
0x6df4cce8
0x6df4ccec
0x6df4ccf2
0x6df4ccf5
0x6df4ccfe
0x6dfa4dc8
0x6df4cd04
0x6df4cd04
0x6df4cd0b
0x6df4cd0e
0x6df4cd14
0x6df4cd14
0x6df4cd1d
0x6df4cdca
0x6df4cdd8
0x6df4cd23
0x6df4cd28
0x6df4cde3
0x6df4cdf1
0x6df4cd2e
0x6df4cd33
0x6df4cdb1
0x6df4cdb4
0x6df4cdc2
0x6df4cd35
0x6df4cd43
0x6df4ce10
0x6df4ce19
0x6dfa4dd6
0x00000000
0x6dfa4ddc
0x00000000
0x6dfa4ddc
0x00000000
0x00000000
0x00000000
0x6df4cd49
0x6df4cd49
0x6df4cd57
0x6dfa4de1
0x6dfa4de1
0x6df4cd5d
0x6df4cd5f
0x6df4cd64
0x6df4cd67
0x6df4cd69
0x6df4cd72
0x6df4cd76
0x6df4cd90
0x00000000
0x6df4cd78
0x6df4cd82
0x6df4cd95
0x6df4cda5
0x6df4ce0a
0x6df4cda7
0x6df4cda9
0x6df4cda9
0x00000000
0x6df4cd84
0x6df4cd84
0x00000000
0x6df4cd84
0x6df4cd82
0x00000000
0x6df4cd87
0x6df4cd87
0x6dfa4df9
0x6df4ce1f
0x6df4ce25
0x6df4ce33
0x6dfa4dff
0x6dfa4e05
0x6dfa4e0f
0x6dfa4e1c
0x6dfa4e24
0x00000000
0x6dfa4e24
0x6dfa4df9
0x6df4cd43
0x6df4cd33
0x6df4cd28
0x00000000

APIs

DbgPrint.9419(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6DFA4E05
DbgPrint.9419(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6DFA4E0F
DbgPrint.9419(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6DFA4E1C

Strings

RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6DFA4E0A
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6DFA4E17
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6DFA4E00

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: b02af922860fa8a7c9deb87157f91036eb64e63a9f323939d812fd05775b2990
Instruction ID: e14143c4166ca0f34d76592306763781b9592941d6d6ccf2ce2b0869f50184c1
Opcode Fuzzy Hash: b02af922860fa8a7c9deb87157f91036eb64e63a9f323939d812fd05775b2990
Instruction Fuzzy Hash: 3F415977A182058ADB14CF9EE8507BABFB5F745710F10823EE625C7781EB3A5894C291

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E6DF7645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				int _t56;
				void* _t69;
				int _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6e03d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				memset( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E6DF62280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E6DF5FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x6e03b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E6DF8B640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x6df7645b
0x6df76463
0x6df7646d
0x6df76475
0x6df7647a
0x6df7647e
0x6df76480
0x6df7648c
0x6df76490
0x6df76495
0x6df76498
0x6df7649b
0x6df7649f
0x6df764a1
0x6dfb7c07
0x6dfb7c09
0x6dfb7c0c
0x00000000
0x6df764a7
0x6df764a7
0x6df764aa
0x6dfb7bf7
0x6dfb7c00
0x00000000
0x6dfb7bf9
0x6dfb7bf9
0x6dfb7bf9
0x6df764b0
0x6df764b0
0x6df764b2
0x6df764b2
0x6df764b3
0x6df764ba
0x6df76553
0x6df7655e
0x6df76566
0x6df7656c
0x6df76575
0x6df7657f
0x6df76585
0x6df76588
0x6df76588
0x6df764c7
0x6df764cb
0x6df764ce
0x6df764d3
0x6df764da
0x6df764e5
0x6df764ed
0x6df764f1
0x6df764f5
0x6df764f6
0x6df764fa
0x6df76502
0x6df76503
0x6df76504
0x6df76507
0x6df7651a
0x6df76524
0x6df76524
0x6df76526
0x6df76526
0x6df764aa
0x6df7652c
0x6df7652d
0x6df7652e
0x6df76539

APIs

memset.9419(?,00000000,00000030,?,00000000,00000000), ref: 6DF76490
RtlDebugPrintTimes.9419(?,00000030,00000030,00000030), ref: 6DF7651A
RtlAcquireSRWLockExclusive.9419(?,?,00000000,00000000), ref: 6DF76553
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,00000000), ref: 6DF76588

Strings

0, xrefs: 6DF764FA
0, xrefs: 6DF764E5

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 1b622c924a8a1b285daf9be79e2718bfe3199f97e8d04dab4b14fc3311e0ee4c
Instruction ID: 057b28e6c25c3949f24b66a34d7b93b1b203bd513ae495221c76b0a91d80b148
Opcode Fuzzy Hash: 1b622c924a8a1b285daf9be79e2718bfe3199f97e8d04dab4b14fc3311e0ee4c
Instruction Fuzzy Hash: 69414CB26087469FC351CF2CD484A56BBE4BB89718F00866EF988DB301D731EA05CF96

Uniqueness

Uniqueness Score: -1.00%

Function 6DF44510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DF44510(signed int _a4) {
				signed int _t25;
				unsigned int _t28;
				intOrPtr _t32;
				signed int _t40;
				void* _t46;
				signed int _t47;
				signed int _t52;
				void* _t53;
				signed int _t55;

				_t47 = _a4;
				if(_t47 == 0) {
					return 0;
				}
				if(_t47 == 0x103) {
					return 0x3e5;
				}
				_t25 = _t47;
				if((_t47 & 0x20000000) == 0) {
					if((_t25 & 0x00ff0000) == 0x70000) {
						_t28 = _t47 >> 0x18;
						if(_t28 == 0xc0 || _t28 == 0x80) {
							L20:
							return _t47 & 0x0000ffff;
						} else {
							goto L4;
						}
					}
					L4:
					if((_t47 & 0xf0000000) == 0xd0000000) {
						_t47 = _t47 & 0xcfffffff;
					}
					_t53 = 0;
					_t46 = 0x11e;
					do {
						_t52 = _t46 + _t53 >> 1;
						_t32 =  *((intOrPtr*)(0x6df2a300 + _t52 * 8));
						_t55 = _t47 - _t32;
						if(_t47 < _t32) {
							_t10 = _t52 - 1; // -1
							_t46 = _t10;
							goto L10;
						}
						if(_t55 < ( *(0x6df2a304 + _t52 * 8) & 0x000000ff)) {
							_t40 =  *(0x6df2a306 + _t52 * 8) & 0x0000ffff;
							if( *((char*)(0x6df2a305 + _t52 * 8)) != 1) {
								return ( *(0x6df28692 + (_t40 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6df28690 + (_t40 + _t55 * 2) * 2) & 0x0000ffff;
							}
							return  *(0x6df28690 + (_t40 + _t55) * 2) & 0x0000ffff;
						}
						_t9 = _t52 + 1; // 0x1
						_t53 = _t9;
						L10:
					} while (_t53 <= _t46);
					if((_t47 & 0xffff0000) == 0xc0010000) {
						goto L20;
					}
					E6DF4B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t47);
					E6DF4B150();
					E6DF4B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
					return 0x13d;
				}
				return _t25;
			}

0x6df44515
0x6df4451d
0x00000000
0x6df445b6
0x6df44529
0x00000000
0x6dfa08b5
0x6df4452f
0x6df44537
0x6df44543
0x6dfa08c1
0x6dfa08c9
0x6dfa08d6
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfa08c9
0x6df44549
0x6df44555
0x6df445ba
0x6df445ba
0x6df44557
0x6df44559
0x6df4455e
0x6df44563
0x6df44565
0x6df4456c
0x6df44570
0x6df44583
0x6df44583
0x00000000
0x6df44583
0x6df4457c
0x6df44597
0x6df4459f
0x00000000
0x6dfa092f
0x00000000
0x6df445a7
0x6df4457e
0x6df4457e
0x6df44586
0x6df44586
0x6dfa08ea
0x00000000
0x00000000
0x6dfa08f2
0x6dfa08fc
0x6dfa0909
0x00000000
0x6dfa090f
0x6df445b3

APIs

DbgPrint.9419(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6DFB3AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6DFA08F2
DbgPrint.9419(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6DFB3AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6DFA08FC
DbgPrint.9419(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6DFA0909

Strings

RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6DFA08F7
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6DFA0904
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6DFA08ED

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 66ef4193b7a07d68d5ccf6851bac75fdefe0a4ed304176e5b54db6255f66dde1
Instruction ID: 94a334cf544bfca6c67a869d9168fb65fa382c3d81c86d4c1d1ab2b732bea35e
Opcode Fuzzy Hash: 66ef4193b7a07d68d5ccf6851bac75fdefe0a4ed304176e5b54db6255f66dde1
Instruction Fuzzy Hash: 2B216A3363801686FF149EADE8407793B61EB49350F01C226F610FA297DBD9CDA0C2E5

Uniqueness

Uniqueness Score: -1.00%

Function 6DF5A8C0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6DF5A8C0(struct _EXCEPTION_RECORD _a4) {
				signed int _v12;
				char _v552;
				char* _v556;
				intOrPtr _v558;
				void* _v560;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t41;
				struct _EXCEPTION_RECORD _t42;
				unsigned int _t43;
				signed int _t44;

				_v12 =  *0x6e03d360 ^ _t44;
				_v560 = 0x2140000;
				_t42 = _a4;
				_v556 =  &_v552;
				RtlAppendUnicodeToString( &_v560, E6DF5AAB0());
				_t43 = _v560 & 0x0000ffff;
				RtlAppendUnicodeToString( &_v560, L"\\SysWOW64");
				if(RtlPrefixUnicodeString( &_v560, _t42, 1) != 0) {
					_v560 =  *_t42;
					_v560 = _v560 - _t43;
					_v558 = _v558 - _t43;
					_v556 =  *((intOrPtr*)(_t42 + 4)) + (_t43 >> 1) * 2;
					_t30 = E6DF819A0( &_v560, 0x14c, 1, 0);
				}
				return E6DF8B640(_t30, _t37, _v12 ^ _t44, _t41, _t42, _t43);
			}

0x6df5a8d2
0x6df5a8dc
0x6df5a8e7
0x6df5a8ea
0x6df5a8fd
0x6df5a902
0x6df5a915
0x6df5a92b
0x6df5a944
0x6df5a94c
0x6df5a953
0x6df5a968
0x6df5a975
0x6df5a975
0x6df5a93c

APIs

RtlGetNtSystemRoot.9419(?,?), ref: 6DF5A8F0
RtlAppendUnicodeToString.9419(02140000,00000000,?,?), ref: 6DF5A8FD

Part of subcall function 6DF5A990: memmove.9419(00000000,00000050,00000052,?,?,00000000,?,?,6DF5A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6DF5A9E2

RtlAppendUnicodeToString.9419(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6DF5A915
RtlPrefixUnicodeString.9419(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6DF5A924
RtlReplaceSystemDirectoryInPath.9419(02140000,0000014C,00000001,00000000,02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6DF5A975

Strings

\SysWOW64, xrefs: 6DF5A90F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$DirectoryPathPrefixReplaceRootmemmove
String ID: \SysWOW64
API String ID: 1880611629-3584015931
Opcode ID: a746bb14062656c5c693c31f4346fdf2d5119f92919c4b41e7c0de6a42d2fdaa
Instruction ID: d2ec56b58641d7f81cfebc1b2e9edcd9a9ed82ff3ee9c5f3f086e2321d9b7206
Opcode Fuzzy Hash: a746bb14062656c5c693c31f4346fdf2d5119f92919c4b41e7c0de6a42d2fdaa
Instruction Fuzzy Hash: 96112E71905228BACB20DFA8AC48FDEB3F8AF49314F1141D6E609A7140DB31AE658E94

Uniqueness

Uniqueness Score: -1.00%

Function 6E00D8DF, Relevance: 9.2, APIs: 6, Instructions: 160
timeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6E00D8DF(signed int __ecx, signed int __edx, signed int _a4, intOrPtr _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				signed int _t65;
				signed int _t79;
				signed char _t86;
				unsigned int _t96;
				intOrPtr _t99;
				unsigned int _t101;
				unsigned int _t105;
				signed int _t106;

				_t94 = __edx;
				_v8 =  *0x6e03d360 ^ _t106;
				_v24 = _v24 & 0x00000000;
				_t57 = __ecx;
				_t79 = _a4;
				_v12 = __ecx;
				_t96 = _t79 >> 0x1f;
				_t101 = __edx;
				_v16 = __edx;
				_v36 = _t79;
				_v32 = _t79;
				_v20 = _t96;
				if(_t96 == 0) {
					if(_t79 == 0) {
						goto L34;
					}
					goto L3;
				} else {
					_t79 = 1;
					L3:
					if(( *0x6e03610c & 0x00000020) == 0 || _t96 != 0) {
						L14:
						_t57 =  *(_t101 + 0x1d) & 0x000000ff;
						if(_t79 >= ( *(_t101 + 0x1d) & 0x000000ff)) {
							goto L34;
						} else {
							goto L15;
						}
						while(1) {
							L15:
							_t94 = _t79;
							_t85 = _t101;
							_t79 = E6E00DA9B(_t101, _t79,  &_v28);
							_a4 = _t79;
							if(_t79 == 0xffffffff) {
								break;
							}
							_t63 = _v28;
							if(_t63 >= _a8) {
								if(_v24 != 0) {
									_t86 =  *(_t101 + 0x1c) & 0x000000ff;
									_t79 = _t79 << _t86;
									_t65 = _v12;
									 *0x6e03b1e0( *_t65, _t79 + _t101, _t63 << _t86);
									 *( *(_t65 + 0x10) ^  *0x6e036110 ^ _t65)();
									asm("lock xadd [eax], ecx");
									_t101 = _v16;
									_t94 = _t79;
									_t85 = _t101;
									E6E00D864(_t101, _t79, _t63 << _t86, 1, 0);
									_t96 = _v20;
									if(_t96 == 0) {
										break;
									}
									_t79 = _a4 + _v28;
									L26:
									if(_t79 < ( *(_t101 + 0x1d) & 0x000000ff)) {
										continue;
									}
									break;
								}
								if((_a12 & 0x00000001) == 0) {
									E6DF6FAD0(_v12 + 0x34);
								}
								_v24 = 2;
								if(_v32 != 0xfffffffe) {
									E6DF62280(_t101 + 0xc, _t101 + 0xc);
								}
								goto L26;
							}
							if(_t96 == 0) {
								break;
							}
							_t79 = _t79 + _t63;
							goto L26;
						}
						_t57 = _v24;
						if(_t57 != 0) {
							if(_v36 != 0xfffffffe) {
								_push(_t101);
								if(_t57 != 2) {
									_t57 = E6DF6FA00(_t79, _t85, _t96);
								} else {
									_t57 = E6DF5FFB0(_t79, _t96);
								}
							}
							if((_a12 & 0x00000001) == 0) {
								_t57 = E6DF6FA00(_t79, _t85, _t96, _v12 + 0x34);
							}
						}
						goto L34;
					} else {
						_t94 =  *_t57;
						if(( *(_t94 + 9) & 0x00000001) != 0) {
							goto L14;
						} else {
							_t99 =  *((intOrPtr*)(_t94 + 0x28));
							_t105 =  *(_t99 + 4);
							_t57 = _t105 >>  *(_t94 + 7);
							if(_t57 <= 8) {
								_t57 = 8;
							}
							_t101 = _t105 >>  *(_t94 + 8);
							if(_t101 <= 8) {
								_t101 = 8;
							}
							_t96 =  *((intOrPtr*)(_t99 + 8)) +  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0x28)) + 0xc));
							if(_t96 <= _t57 || E6DFEDA47(_t79, _t96) >= 0) {
								if(_t96 <= _t101) {
									L34:
									return E6DF8B640(_t57, _t79, _v8 ^ _t106, _t94, _t96, _t101);
								}
								goto L13;
							} else {
								L13:
								_t96 = _v20;
								_t101 = _v16;
								goto L14;
							}
						}
					}
				}
			}

0x6e00d8df
0x6e00d8ee
0x6e00d8f1
0x6e00d8f5
0x6e00d8f8
0x6e00d8ff
0x6e00d902
0x6e00d905
0x6e00d907
0x6e00d90a
0x6e00d90d
0x6e00d910
0x6e00d915
0x6e00d91e
0x00000000
0x00000000
0x00000000
0x6e00d917
0x6e00d919
0x6e00d924
0x6e00d92b
0x6e00d97f
0x6e00d97f
0x6e00d985
0x00000000
0x00000000
0x00000000
0x00000000
0x6e00d98b
0x6e00d98b
0x6e00d98e
0x6e00d991
0x6e00d998
0x6e00d99a
0x6e00d9a0
0x00000000
0x00000000
0x6e00d9a6
0x6e00d9ac
0x6e00d9c1
0x6e00d9ed
0x6e00d9f3
0x6e00d9fc
0x6e00da0e
0x6e00da14
0x6e00da26
0x6e00da2a
0x6e00da2d
0x6e00da34
0x6e00da36
0x6e00da3b
0x6e00da40
0x00000000
0x00000000
0x6e00da45
0x6e00da48
0x6e00da4e
0x00000000
0x00000000
0x00000000
0x6e00da4e
0x6e00d9c7
0x6e00d9d0
0x6e00d9d0
0x6e00d9d9
0x6e00d9e0
0x6e00d9e6
0x6e00d9e6
0x00000000
0x6e00d9e0
0x6e00d9b0
0x00000000
0x00000000
0x6e00d9b6
0x00000000
0x6e00d9b6
0x6e00da54
0x6e00da59
0x6e00da5f
0x6e00da64
0x6e00da68
0x6e00da71
0x6e00da6a
0x6e00da6a
0x6e00da6a
0x6e00da68
0x6e00da7a
0x6e00da83
0x6e00da83
0x6e00da7a
0x00000000
0x6e00d931
0x6e00d931
0x6e00d937
0x00000000
0x6e00d939
0x6e00d939
0x6e00d93f
0x6e00d944
0x6e00d949
0x6e00d94d
0x6e00d94d
0x6e00d951
0x6e00d956
0x6e00d95a
0x6e00d95a
0x6e00d961
0x6e00d966
0x6e00d973
0x6e00da88
0x6e00da98
0x6e00da98
0x00000000
0x6e00d979
0x6e00d979
0x6e00d979
0x6e00d97c
0x00000000
0x6e00d97c
0x6e00d966
0x6e00d937
0x6e00d92b

APIs

RtlAcquireSRWLockShared.9419(?,000000FE,?,?,?,?,6E00C9F8,000000FE), ref: 6E00D9D0
RtlAcquireSRWLockExclusive.9419(?,000000FE,?,?,?), ref: 6E00D9E6
RtlDebugPrintTimes.9419(?,?,?,000000FE,?,?,?,?,6E00C9F8,000000FE), ref: 6E00DA0E
RtlReleaseSRWLockExclusive.9419(?,000000FE,?,?,?), ref: 6E00DA6A
RtlReleaseSRWLockShared.9419(?,000000FE,?,?,?), ref: 6E00DA71
RtlReleaseSRWLockShared.9419(?,000000FE,?,?,?), ref: 6E00DA83

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$DebugPrintTimes
String ID:
API String ID: 675604559-0
Opcode ID: e50e2274380c39e79af83b7e83f3d60cbd52977d608ec4d3dd1c1ee5f465159f
Instruction ID: 8b147f849ec6f4204a6142b951e47f61c970503a2519812e987983053be59b04
Opcode Fuzzy Hash: e50e2274380c39e79af83b7e83f3d60cbd52977d608ec4d3dd1c1ee5f465159f
Instruction Fuzzy Hash: 6F511631A0871A9BEB50CFE8C88079EB7F5AF86368F154659D815A7281C774DD41CFB0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD3F4D, Relevance: 9.1, APIs: 6, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6DFD3F4D(void* __ebx, signed short* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t37;
				void* _t38;
				signed short _t39;
				void* _t45;
				signed short _t46;
				signed short _t56;
				signed short* _t59;
				void* _t60;
				signed short _t62;
				signed int _t63;
				signed short* _t69;
				signed short _t71;
				signed short* _t73;
				signed short* _t74;
				void* _t75;

				_push(0x1c);
				_push(0x6e020890);
				E6DF9D08C(__ebx, __edi, __esi);
				_t59 = __edx;
				 *(_t75 - 0x1c) = 0xc00000e5;
				if(__edx != 0) {
					_t69 =  *(_t75 + 8);
					__eflags = _t69;
					if(_t69 == 0) {
						goto L1;
					} else {
						__eflags = __edx - _t69;
						if(__edx == _t69) {
							goto L1;
						} else {
							__eflags =  *__edx;
							if( *__edx != 0) {
								 *((intOrPtr*)(_t75 - 0x28)) = 0;
								 *((intOrPtr*)(_t75 - 0x24)) = 0;
								L6DF5EEF0(0x6e0379a0);
								 *((intOrPtr*)(_t75 - 4)) = 0;
								_t71 = E6DF862C0(_t60, __eflags, 0, _t59, _t75 - 0x28, _t75 - 0x20);
								 *(_t75 - 0x1c) = _t71;
								__eflags = _t71;
								if(_t71 >= 0) {
									L15:
									_t37 =  *((intOrPtr*)(_t75 - 0x20));
									__eflags = _t37 - 0xfffe;
									if(_t37 <= 0xfffe) {
										_t38 = _t37 + 4;
										__eflags = _t38 - 0xfffe;
										if(_t38 <= 0xfffe) {
											_t73 =  &(_t69[4]);
											__eflags = _t73;
											if(_t73 == 0) {
												L21:
												_t39 = E6DF7D690(0, _t73, _t38);
												__eflags = _t39;
												if(_t39 >= 0) {
													goto L23;
												} else {
													_t71 = 0xc0000017;
												}
											} else {
												__eflags = _t38 - _t69[8];
												if(_t38 <= _t69[8]) {
													L23:
													_t69[2] =  *_t73;
													_t69[1] = _t69[8];
													_t71 = 0;
													__eflags = 0;
												} else {
													goto L21;
												}
											}
										} else {
											_t71 = 0xc0000106;
										}
										 *(_t75 - 0x1c) = _t71;
										__eflags = _t71;
										if(__eflags >= 0) {
											_t71 = E6DF862C0(0xfffe, __eflags, 0, _t59, _t69, 0);
											 *(_t75 - 0x1c) = _t71;
											__eflags = _t71;
											if(_t71 >= 0) {
												_t71 = 0;
												__eflags = 0;
												goto L27;
											}
										}
									} else {
										_t71 = 0xc0000106;
										L27:
										 *(_t75 - 0x1c) = _t71;
									}
								} else {
									__eflags = _t71 - 0xc0000023;
									if(_t71 == 0xc0000023) {
										goto L15;
									}
								}
								 *((intOrPtr*)(_t75 - 4)) = 0xfffffffe;
								E6DFD40C7();
							} else {
								 *_t69 = 0;
								_t45 = ( *__edx & 0x0000ffff) + 2;
								__eflags = _t45 - 0xfffe;
								if(_t45 <= 0xfffe) {
									_t74 =  &(_t69[4]);
									__eflags = _t74;
									if(_t74 == 0) {
										L10:
										_t46 = E6DF7D690(0, _t74, _t45);
										__eflags = _t46;
										if(_t46 >= 0) {
											goto L12;
										} else {
											_t71 = 0xc0000017;
										}
									} else {
										__eflags = _t45 - _t69[8];
										if(_t45 <= _t69[8]) {
											L12:
											_t62 =  *_t74;
											_t69[2] = _t62;
											memmove(_t62 + (( *_t69 & 0x0000ffff) >> 1) * 2, _t59[2],  *_t59 & 0x0000ffff);
											_t63 =  *_t69 & 0x0000ffff;
											_t69[1] =  *_t59 + 2 + _t63;
											_t56 =  *_t59 + _t63;
											 *_t69 = _t56;
											 *((short*)(_t69[2] + ((_t56 & 0x0000ffff) >> 1) * 2)) = 0;
											_t71 = 0;
										} else {
											goto L10;
										}
									}
								} else {
									_t71 = 0xc0000106;
								}
							}
						}
					}
				} else {
					L1:
					_t71 = 0xc000000d;
				}
				return E6DF9D0D1(_t71);
			}

0x6dfd3f4d
0x6dfd3f4f
0x6dfd3f54
0x6dfd3f59
0x6dfd3f5b
0x6dfd3f64
0x6dfd3f75
0x6dfd3f78
0x6dfd3f7a
0x00000000
0x6dfd3f7c
0x6dfd3f7c
0x6dfd3f7e
0x00000000
0x6dfd3f80
0x6dfd3f84
0x6dfd3f87
0x6dfd4010
0x6dfd4013
0x6dfd401b
0x6dfd4020
0x6dfd4032
0x6dfd4034
0x6dfd4037
0x6dfd4039
0x6dfd4043
0x6dfd4043
0x6dfd404b
0x6dfd404d
0x6dfd4056
0x6dfd4059
0x6dfd405b
0x6dfd4064
0x6dfd4067
0x6dfd4069
0x6dfd4070
0x6dfd4074
0x6dfd4079
0x6dfd407b
0x00000000
0x6dfd407d
0x6dfd407d
0x6dfd407d
0x6dfd406b
0x6dfd406b
0x6dfd406e
0x6dfd4084
0x6dfd4086
0x6dfd408d
0x6dfd4091
0x6dfd4091
0x00000000
0x00000000
0x00000000
0x6dfd406e
0x6dfd405d
0x6dfd405d
0x6dfd405d
0x6dfd4093
0x6dfd4096
0x6dfd4098
0x6dfd40a5
0x6dfd40a7
0x6dfd40aa
0x6dfd40ac
0x6dfd40ae
0x6dfd40ae
0x00000000
0x6dfd40ae
0x6dfd40ac
0x6dfd404f
0x6dfd404f
0x6dfd40b0
0x6dfd40b0
0x6dfd40b0
0x6dfd403b
0x6dfd403b
0x6dfd4041
0x00000000
0x00000000
0x6dfd4041
0x6dfd40b3
0x6dfd40ba
0x6dfd3f8d
0x6dfd3f8d
0x6dfd3f93
0x6dfd3f96
0x6dfd3f9b
0x6dfd3fa4
0x6dfd3fa7
0x6dfd3fa9
0x6dfd3fb0
0x6dfd3fb4
0x6dfd3fb9
0x6dfd3fbb
0x00000000
0x6dfd3fbd
0x6dfd3fbd
0x6dfd3fbd
0x6dfd3fab
0x6dfd3fab
0x6dfd3fae
0x6dfd3fc4
0x6dfd3fc4
0x6dfd3fc6
0x6dfd3fd9
0x6dfd3fe1
0x6dfd3fee
0x6dfd3ff5
0x6dfd3ff8
0x6dfd4005
0x6dfd4009
0x00000000
0x00000000
0x00000000
0x6dfd3fae
0x6dfd3f9d
0x6dfd3f9d
0x6dfd3f9d
0x6dfd3f9b
0x6dfd3f87
0x6dfd3f7e
0x6dfd3f66
0x6dfd3f66
0x6dfd3f66
0x6dfd3f66
0x6dfd3f72

APIs

RtlpEnsureBufferSize.9419(00000000,?,-00000002,6E020890,0000001C,6DFAD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?), ref: 6DFD3FB4
memmove.9419(00000000,00000000,00000000,00000000,?,-00000002,6E020890,0000001C,6DFAD659,00020000,00000000,?,?,00000003,00000000,00000002), ref: 6DFD3FD9
RtlEnterCriticalSection.9419(6E0379A0,6E020890,0000001C,6DFAD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6DFD401B
RtlExpandEnvironmentStrings_U.9419(00000000,?,00000000,?,6E020890,0000001C,6DFAD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040), ref: 6DFD402D
RtlpEnsureBufferSize.9419(00000000,?,?,00000000,?,00000000,?,6E020890,0000001C,6DFAD659,00020000,00000000,?,?,00000003,00000000), ref: 6DFD4074
RtlExpandEnvironmentStrings_U.9419(00000000,?,?,00000000,00000000,?,?,00000000,?,00000000,?,6E020890,0000001C,6DFAD659,00020000,00000000), ref: 6DFD40A0

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureEnvironmentExpandRtlpSizeStrings_$CriticalEnterSectionmemmove
String ID:
API String ID: 1067925741-0
Opcode ID: 28e073c99c292bb1e1fedfcd5a1fbe7dc04cd86ba3f8395ae4abce892c9e4973
Instruction ID: 445f9fa0333c013863de930dbe54d860bae52fe691269956276729f720b8b389
Opcode Fuzzy Hash: 28e073c99c292bb1e1fedfcd5a1fbe7dc04cd86ba3f8395ae4abce892c9e4973
Instruction Fuzzy Hash: D341B472D046269AD761DF5CC884BAEB7B4BF08B04F1E4526EA14EB240E3749C51CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DF45320, Relevance: 9.1, APIs: 6, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6DF45320(void* __ecx, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v20;
				signed int _v21;
				signed int _v25;
				signed int _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t42;
				signed int _t48;
				signed int _t59;
				void* _t63;
				intOrPtr _t64;
				signed int _t65;
				intOrPtr* _t66;
				intOrPtr* _t70;
				signed int _t72;
				void* _t74;
				intOrPtr* _t75;
				void* _t76;
				signed int _t78;
				void* _t79;
				signed int _t80;
				void* _t85;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_v8 =  *0x6e03d360 ^ (_t80 & 0xfffffff8) - 0x00000014;
				_t78 = _a4;
				_push(_t75);
				if(_t78 == 0 || _t78 >= 0x80) {
					L17:
					_t42 = 0xc000000d;
					goto L13;
				} else {
					_t64 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
					_v12 = _t64;
					E6DF62280( *[fs:0x18], 0x6e0385f0);
					_t70 =  *((intOrPtr*)(_t64 + 0x218));
					_t85 = _t78 -  *_t70;
					if(_t85 >= 0) {
						_t65 = 0;
						L11:
						E6DF5FFB0(_t65, _t75, 0x6e0385f0);
						if(_t65 == 0) {
							goto L17;
						}
						_t42 = 0;
						L13:
						_pop(_t76);
						_pop(_t79);
						_pop(_t63);
						return E6DF8B640(_t42, _t63, _v8 ^ _t82, _t74, _t76, _t79);
					}
					asm("bt [eax], esi");
					_t48 =  *(_t70 + 4) & 0xffffff00 | _t85 > 0x00000000;
					_v21 = _t48;
					if(_t48 == 0) {
						_t65 = _t48;
						goto L11;
					}
					E6DF7A990(_t70, _t78, 1);
					_v32 =  *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8);
					E6DF62280( &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]),  &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]));
					_t72 = _t64 + 0x210;
					_t75 =  *_t72;
					_v32 = _t72;
					if(_t75 == _t72) {
						L10:
						 *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8) =  *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8) & 0x00000000;
						E6DF5FFB0(_t64, _t75,  &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]));
						_t65 = _v25;
						goto L11;
					}
					_t66 = _v20;
					do {
						if(_t66 != 0) {
							_t59 =  *(_t75 + 8 + _t78 * 4);
							if(_t59 != 0) {
								 *0x6e03b1e0(_t59);
								 *_t66();
								_t72 = _v20;
							}
						}
						 *(_t75 + 8 + _t78 * 4) =  *(_t75 + 8 + _t78 * 4) & 0x00000000;
						_t75 =  *_t75;
					} while (_t75 != _t72);
					_t64 = _v12;
					goto L10;
				}
			}

0x6df45328
0x6df45332
0x6df45338
0x6df4533b
0x6df4533e
0x6df45438
0x6df45438
0x00000000
0x6df45350
0x6df4535b
0x6df4535e
0x6df45362
0x6df45367
0x6df4536d
0x6df4536f
0x6df45430
0x6df453fb
0x6df45400
0x6df45407
0x00000000
0x00000000
0x6df45409
0x6df4540b
0x6df4540f
0x6df45410
0x6df45411
0x6df4541c
0x6df4541c
0x6df45378
0x6df4537b
0x6df4537e
0x6df45384
0x6df45434
0x00000000
0x6df45434
0x6df4538e
0x6df453a2
0x6df453a7
0x6df453ac
0x6df453b2
0x6df453b4
0x6df453ba
0x6df453db
0x6df453e1
0x6df453f2
0x6df453f7
0x00000000
0x6df453f7
0x6df453bc
0x6df453c0
0x6df453c2
0x6df453c4
0x6df453ca
0x6df45422
0x6df45428
0x6df4542a
0x6df4542a
0x6df453ca
0x6df453cc
0x6df453d1
0x6df453d3
0x6df453d7
0x00000000
0x6df453d7

APIs

RtlAcquireSRWLockExclusive.9419(6E0385F0), ref: 6DF45362
RtlClearBits.9419(?,?,00000001,6E0385F0), ref: 6DF4538E
RtlAcquireSRWLockExclusive.9419(?,?,?,00000001,6E0385F0), ref: 6DF453A7

Part of subcall function 6DF62280: RtlDllShutdownInProgress.9419(00000000), ref: 6DF622BA
Part of subcall function 6DF62280: ZwWaitForAlertByThreadId.9419(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6DF623A3

RtlReleaseSRWLockExclusive.9419(?,?,?,?,00000001,6E0385F0), ref: 6DF453F2
RtlReleaseSRWLockExclusive.9419(6E0385F0,6E0385F0), ref: 6DF45400
RtlDebugPrintTimes.9419(?,?,?,?,00000001,6E0385F0), ref: 6DF45422

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$AlertBitsClearDebugPrintProgressShutdownThreadTimesWait
String ID:
API String ID: 3225401293-0
Opcode ID: 34206983c871282d796e2c764c9ea4d81a891761f25505ad0374a0f6f817d287
Instruction ID: 6c07c95f3d37bc568fb5d7315232345f8672f27889c7d6e61bac9d5ed860295b
Opcode Fuzzy Hash: 34206983c871282d796e2c764c9ea4d81a891761f25505ad0374a0f6f817d287
Instruction Fuzzy Hash: 9331F3722093429FC710DF6CC4D0ABABBA4BF41314F8689ADE9558F353CB30E9058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7FE34, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
libraryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DF7FE34(intOrPtr __ecx, WCHAR* __edx, void* __eflags, unsigned int* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				unsigned int _v728;
				short* _v732;
				void* _v736;
				char _v740;
				unsigned int _v744;
				intOrPtr _v748;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t44;
				char* _t46;
				unsigned int _t49;
				unsigned int* _t53;
				void* _t54;
				void* _t59;
				intOrPtr _t61;
				intOrPtr _t66;
				void* _t67;
				char* _t68;
				WCHAR* _t70;
				void* _t71;
				intOrPtr* _t72;
				signed int _t74;
				unsigned int _t77;
				signed int _t78;
				signed int _t80;

				_t62 = __edx;
				_t80 = (_t78 & 0xfffffff8) - 0x2dc;
				_v8 =  *0x6e03d360 ^ _t80;
				_t53 = _a4;
				_v724 = _a8;
				_t66 = __ecx;
				_v720 = __ecx;
				_t70 = __edx;
				_v728 = 0;
				if(E6DF7FF9C() != 0) {
					_t37 = 0xc0000361;
					L11:
					_pop(_t67);
					_pop(_t71);
					_pop(_t54);
					return E6DF8B640(_t37, _t54, _v8 ^ _t80, _t62, _t67, _t71);
				}
				if(_t66 == 0 || _t70 == 0 || _t53 == 0) {
					_t37 = 0xc000000d;
					goto L11;
				} else {
					_v736 = 0x2be0000;
					_v732 =  &_v716;
					if(RtlAppendUnicodeToString( &_v736, _t70) < 0) {
						goto L11;
					}
					E6DF5A8C0( &_v744);
					_t62 =  &_v740;
					_t68 = E6DF7FF2F(_v744,  &_v740);
					if(_t68 < 0) {
						L10:
						_t37 = _t68;
						goto L11;
					}
					_t72 = _v736;
					_t15 = _t72 + 2; // 0x2be0002
					_t59 = _t15;
					do {
						_t44 =  *_t72;
						_t72 = _t72 + 2;
					} while (_t44 != 0);
					_v744 =  *_t53;
					_t74 = _t72 - _t59 >> 1;
					_t46 = E6DF576FE(_v728,  &_v744, _v732);
					_t61 = _v748;
					_t68 = _t46;
					_t62 = 0xc0000023;
					if(_t68 == 0xc0000023) {
						_t22 = _t61 + 0x10; // 0x2be0010
						 *_t53 = _t22 + _t74 * 2;
					}
					if(_t68 >= 0) {
						_t49 = _t61 + (_t74 + 8) * 2;
						_v728 = _t49;
						_t77 = _t49 >> 1;
						if(_t49 <=  *_t53) {
							E6DF97110(_v732, _t77, L"\\Windows");
							E6DF97110(_v732, _t77, _v736);
							_t49 = _v728;
							_t80 = _t80 + 0x18;
						} else {
							_t68 = _t62;
						}
						 *_t53 = _t49;
					}
					goto L10;
				}
			}

0x6df7fe34
0x6df7fe3c
0x6df7fe49
0x6df7fe54
0x6df7fe59
0x6df7fe5d
0x6df7fe61
0x6df7fe65
0x6df7fe67
0x6df7fe72
0x6dfbc0f0
0x6df7ff18
0x6df7ff1f
0x6df7ff20
0x6df7ff21
0x6df7ff2c
0x6df7ff2c
0x6df7fe7a
0x6dfbc14b
0x00000000
0x6df7fe90
0x6df7fe94
0x6df7fe9c
0x6df7fead
0x00000000
0x00000000
0x6df7feb4
0x6df7febd
0x6df7fec6
0x6df7feca
0x6df7ff16
0x6df7ff16
0x00000000
0x6df7ff16
0x6df7fecc
0x6df7fed2
0x6df7fed2
0x6df7fed5
0x6df7fed5
0x6df7fed8
0x6df7fedb
0x6df7feec
0x6df7fef4
0x6df7fef6
0x6df7fefb
0x6df7feff
0x6df7ff01
0x6df7ff08
0x6dfbc0fa
0x6dfbc100
0x6dfbc100
0x6df7ff10
0x6dfbc10a
0x6dfbc10f
0x6dfbc113
0x6dfbc117
0x6dfbc127
0x6dfbc138
0x6dfbc13d
0x6dfbc141
0x6dfbc119
0x6dfbc119
0x6dfbc119
0x6dfbc144
0x6dfbc144
0x00000000
0x6df7ff10

APIs

RtlAppendUnicodeToString.9419(02BE0000,?), ref: 6DF7FEA6

Part of subcall function 6DF5A990: memmove.9419(00000000,00000050,00000052,?,?,00000000,?,?,6DF5A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6DF5A9E2

LdrStandardizeSystemPath.9419(02BE0000,02BE0000,?), ref: 6DF7FEB4

Part of subcall function 6DF5A8C0: RtlGetNtSystemRoot.9419(?,?), ref: 6DF5A8F0
Part of subcall function 6DF5A8C0: RtlAppendUnicodeToString.9419(02140000,00000000,?,?), ref: 6DF5A8FD
Part of subcall function 6DF5A8C0: RtlAppendUnicodeToString.9419(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6DF5A915
Part of subcall function 6DF5A8C0: RtlPrefixUnicodeString.9419(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6DF5A924

Part of subcall function 6DF7FF2F: RtlGetNtSystemRoot.9419(?,?,?,?,?,6DF7FEC6,02BE0000,02BE0000,?), ref: 6DF7FF3C
Part of subcall function 6DF7FF2F: _wcsnicmp.9419(?,00000000,-00000002,?,?,?,?,?,6DF7FEC6,02BE0000,02BE0000,?), ref: 6DF7FF6E

Strings

\Windows, xrefs: 6DFBC11D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$Root$PathPrefixStandardize_wcsnicmpmemmove
String ID: \Windows
API String ID: 1616562977-3600636569
Opcode ID: 7478a441210c34a96fae95848e8539cab74551f09273834f4e9969f63652ce26
Instruction ID: c6da3337e88eb19416c504571f8d1ec9c386b8bf97fe97ecc4b8f3ab6508d78e
Opcode Fuzzy Hash: 7478a441210c34a96fae95848e8539cab74551f09273834f4e9969f63652ce26
Instruction Fuzzy Hash: A131A4329083469FC721CF2DD48099BB7E5BFC9314F02892AE9A8D7240EB30D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DF50225, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6DF50225(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v4;
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				unsigned int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				char _v36;
				char _v64;
				intOrPtr _v68;
				char _v72;
				intOrPtr* _t94;
				intOrPtr* _t97;
				char _t98;
				signed int _t108;
				signed short _t112;
				int _t113;
				void* _t116;
				void* _t123;
				void* _t126;
				signed int _t129;
				void* _t137;
				intOrPtr _t145;
				signed short _t146;
				intOrPtr _t150;
				signed int _t151;
				void* _t156;
				signed int _t158;
				unsigned int _t160;
				signed int _t165;
				intOrPtr* _t176;
				signed int _t178;
				void* _t185;
				void* _t186;
				void* _t188;
				signed int _t191;
				signed int _t192;
				void* _t197;

				_t185 = __edi;
				_push(0x38);
				_push(0x6e01f868);
				E6DF9D08C(__ebx, __edi, __esi);
				_v32 = __ecx;
				_t94 =  *((intOrPtr*)(__ecx));
				while(1) {
					_v28 = _t94;
					_t145 = _t94;
					if(_t145 == _v32) {
						break;
					}
					 *((short*)(_t145 - 0x1c)) = 0;
					L15();
					_t6 = _t145 - 0x44; // 0xbb
					_t97 = _t6;
					_t150 =  *_t97;
					if(_t150 == 0) {
						L6:
						_t98 =  *((intOrPtr*)(_t145 - 0x38));
						_v36 = _t98;
						if(_t98 != 0 && ( *(_t145 - 0x20) & 0x00080000) != 0) {
							if(( *0x6e035780 & 0x00000005) != 0) {
								_push(_t98);
								_t92 = _t145 - 0x30; // 0xcf
								E6DFC5510("minkernel\\ntdll\\ldrsnap.c", 0x7bb, "LdrpProcessDetachNode", 2, "Uninitializing DLL \"%wZ\" (Init routine: %p)\n", _t92);
								_t197 = _t197 + 0x1c;
							}
							_v72 = 0x24;
							_v68 = 1;
							_t151 = 7;
							_t188 =  &_v64;
							memset(_t188, 0, _t151 << 2);
							_t197 = _t197 + 0xc;
							_t185 = _t188 + _t151;
							E6DF5F540( &_v72,  *((intOrPtr*)(_t145 - 0xc)));
							_v4 = 0;
							_t211 =  *((intOrPtr*)(_t145 - 0x1a));
							if( *((intOrPtr*)(_t145 - 0x1a)) != 0) {
								_t31 = _t145 - 0x54; // 0xab
								E6DF50C30(0, _t31);
							}
							_v4 = 1;
							_push(0);
							_push(0);
							E6DF5FC01(_t145, _v36,  *((intOrPtr*)(_t145 - 0x3c)), _t185, 0, _t211);
							_v4 = 0;
							_v4 = 0xfffffffe;
							E6DF50307();
						}
						_t94 =  *_v28;
						continue;
					} else {
						_t176 =  *((intOrPtr*)(_t97 + 4));
						if( *((intOrPtr*)(_t150 + 4)) != _t97 ||  *_t176 != _t97) {
							_t156 = 3;
							asm("int 0x29");
							_t108 =  *0x6e038458;
							_push(_t145);
							_push(0);
							_push(_t185);
							_t186 = _t156;
							_t158 = _t108 & 0x0000000f;
							_t191 = _t158 * 0x5c;
							_v16 = _t158;
							 *(_t191 + 0x6e037c48) = _t108;
							 *0x6e038458 = _t108 + 1;
							 *((intOrPtr*)(_t191 + 0x6e037c40)) =  *((intOrPtr*)(_t186 + 0x18));
							 *((intOrPtr*)(_t191 + 0x6e037c44)) =  *((intOrPtr*)(_t186 + 0x20));
							_t146 =  *(_t186 + 0x2c) & 0x0000ffff;
							_t112 = 0x40;
							__eflags = _t146 - _t112;
							if(_t146 > _t112) {
								_t146 = _t112;
							}
							_t113 = _t146 & 0x0000ffff;
							_v12 = _t113;
							_t41 = _t191 + 0x6e037c54; // 0x6e037c54
							memcpy(_t41,  *(_t186 + 0x30), _t113);
							_t160 = _v12 >> 1;
							_v20 = _t160;
							_t116 = 0x40;
							__eflags = _t146 - _t116;
							if(__eflags < 0) {
								__eflags = 0;
								 *((short*)(0x6e037c54 + (_v8 * 0x2e + _t160) * 2)) = 0;
							}
							_push( &_v36);
							E6DF504D0(_t146,  *((intOrPtr*)(_t186 + 0x18)),  *((intOrPtr*)(_t186 + 0x20)), _t186, _t191, __eflags);
							 *((intOrPtr*)(_t191 + 0x6e037c4c)) = _v36;
							 *((intOrPtr*)(_t191 + 0x6e037c50)) = _v32;
							 *((intOrPtr*)(_t191 + 0x6e037c94)) = _v28;
							 *((intOrPtr*)(_t191 + 0x6e037c98)) = _v24;
							_t123 =  *0x6e038454;
							_v8 = _t123;
							__eflags = _t123;
							if(_t123 == 0) {
								_t178 =  *0x6e035ca8; // 0x40
								__eflags = _t178 - 0xffff;
								if(_t178 > 0xffff) {
									_t178 = 0xffff;
									 *0x6e035ca8 = 0xffff;
								}
								_t126 = RtlAllocateHeap( *0x6e037b98,  *0x6e037b9c + 0x00040000 | 0x00000008, _t178 * 0x5c);
								_v8 = _t126;
								 *0x6e038454 = _t126;
								__eflags = _t126;
								if(_t126 != 0) {
									goto L19;
								} else {
								}
							} else {
								L19:
								_t165 =  *0x6e03845c;
								_t129 = _t165 %  *0x6e035ca8 & 0x0000ffff;
								_t192 = _t129 * 0x5c;
								_v16 = _t129;
								 *(_t192 + _v8 + 8) = _t165;
								 *0x6e03845c = _t165 + 1;
								 *((intOrPtr*)( *0x6e038454 + _t192)) =  *((intOrPtr*)(_t186 + 0x18));
								 *((intOrPtr*)(_t192 +  *0x6e038454 + 4)) =  *((intOrPtr*)(_t186 + 0x20));
								memcpy( *0x6e038454 + 0x14 + _t192,  *(_t186 + 0x30), _v12);
								_t137 = 0x40;
								__eflags = _t146 - _t137;
								if(_t146 < _t137) {
									__eflags = 0;
									 *((short*)( *0x6e038454 + 0x14 + (_v16 * 0x2e + _v20) * 2)) = 0;
								}
								 *((intOrPtr*)(_t192 +  *0x6e038454 + 0xc)) = _v36;
								 *((intOrPtr*)(_t192 +  *0x6e038454 + 0x10)) = _v32;
								 *((intOrPtr*)(_t192 +  *0x6e038454 + 0x54)) = _v28;
								_t126 =  *0x6e038454;
								 *((intOrPtr*)(_t192 + _t126 + 0x58)) = _v24;
							}
							return _t126;
						} else {
							 *_t176 = _t150;
							 *((intOrPtr*)(_t150 + 4)) = _t176;
							 *_t97 = 1;
							goto L6;
						}
					}
					L29:
				}
				return E6DF9D0D1(_t94);
				goto L29;
			}

0x6df50225
0x6df50225
0x6df50227
0x6df5022c
0x6df50231
0x6df50234
0x6df50238
0x6df50238
0x6df5023b
0x6df50240
0x00000000
0x00000000
0x6df50248
0x6df5024f
0x6df50254
0x6df50254
0x6df50257
0x6df5025b
0x6df5027c
0x6df5027c
0x6df5027f
0x6df50284
0x6df50296
0x6dfa61cb
0x6dfa61cc
0x6dfa61e6
0x6dfa61eb
0x6dfa61eb
0x6df5029c
0x6df502a3
0x6df502ac
0x6df502af
0x6df502b2
0x6df502b2
0x6df502b2
0x6df502ba
0x6df502bf
0x6df502c2
0x6df502c6
0x6df502fb
0x6df50300
0x6df50300
0x6df502c8
0x6df502cf
0x6df502d0
0x6df502d7
0x6df502dc
0x6df502df
0x6df502e6
0x6df502e6
0x6df502ee
0x00000000
0x6df5025d
0x6df5025d
0x6df50263
0x6df50312
0x6df50313
0x6df5031d
0x6df50322
0x6df50323
0x6df50324
0x6df50325
0x6df50329
0x6df5032c
0x6df50331
0x6df50334
0x6df5033b
0x6df50343
0x6df5034c
0x6df50352
0x6df50356
0x6df50357
0x6df5035a
0x6df504c9
0x6df504c9
0x6df50360
0x6df50367
0x6df5036a
0x6df50371
0x6df5037c
0x6df5037e
0x6df50383
0x6df50384
0x6df50387
0x6df5038f
0x6df50391
0x6df50391
0x6df503a2
0x6df503a3
0x6df503ab
0x6df503b4
0x6df503bd
0x6df503c6
0x6df503cc
0x6df503d1
0x6df503d4
0x6df503d6
0x6df50485
0x6df50490
0x6df50492
0x6dfa620d
0x6dfa620f
0x6dfa620f
0x6df504b2
0x6df504b7
0x6df504ba
0x6df504bf
0x6df504c1
0x00000000
0x00000000
0x6df504c7
0x6df503dc
0x6df503dc
0x6df503dc
0x6df503ef
0x6df503f2
0x6df503f5
0x6df503fb
0x6df50405
0x6df5040e
0x6df50419
0x6df5042b
0x6df50435
0x6df50436
0x6df50439
0x6df50447
0x6df50449
0x6df50449
0x6df50456
0x6df50462
0x6df5046e
0x6df50472
0x6df5047a
0x6df5047a
0x6df50484
0x6df50271
0x6df50271
0x6df50273
0x6df50276
0x00000000
0x6df50276
0x6df50263
0x00000000
0x6df5025b
0x6df502fa
0x00000000

APIs

Part of subcall function 6DF50315: memcpy.9419(6E037C54,?,00000040,00000000,00000000,000000FF,?,?,6DF50254,6E01F868,00000038,6DF4F563), ref: 6DF50371
Part of subcall function 6DF50315: memcpy.9419(?,?,?,?,0000FFFF,?,00000000,00000000,000000FF,?,?,6DF50254,6E01F868,00000038,6DF4F563), ref: 6DF5042B

RtlActivateActivationContextUnsafeFast.9419 ref: 6DF502BA

Strings

Uninitializing DLL "%wZ" (Init routine: %p), xrefs: 6DFA61D0
$, xrefs: 6DF5029C
minkernel\ntdll\ldrsnap.c, xrefs: 6DFA61E1
LdrpProcessDetachNode, xrefs: 6DFA61D7

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$ActivateActivationContextFastUnsafe
String ID: $$LdrpProcessDetachNode$Uninitializing DLL "%wZ" (Init routine: %p)$minkernel\ntdll\ldrsnap.c
API String ID: 2422247448-1066784428
Opcode ID: 7a3f0a220d5a84dc0cd668cc5aa39ec90b3ce67178a89f15c0ef4e38bf166a37
Instruction ID: ad88c16d808bc90f714f91a474fec1bb93140108f3fc6ef3dc79e168e26e078c
Opcode Fuzzy Hash: 7a3f0a220d5a84dc0cd668cc5aa39ec90b3ce67178a89f15c0ef4e38bf166a37
Instruction Fuzzy Hash: EA31D070D15205DBDF11CFADC888BAEBBB4BF1930CF208099D900AF294D7B19A56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF50C30, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6DF50C30(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t20;
				void* _t24;
				void* _t27;
				intOrPtr _t29;
				void* _t37;
				intOrPtr* _t40;
				intOrPtr* _t42;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;

				_t30 = __ecx;
				_push(0xfffffffe);
				_push(0x6e01f8f8);
				_push(0x6df917f0);
				_push( *[fs:0x0]);
				_t45 = _t44 - 0x18;
				_push(_t27);
				_t20 =  *0x6e03d360;
				_v12 = _v12 ^ _t20;
				_push(_t20 ^ _t43);
				 *[fs:0x0] =  &_v20;
				_v28 = _t45;
				_t37 = __edx;
				_v32 = __ecx;
				E6DF6FAD0(0x6e038550);
				_t40 =  *0x6e035368; // 0x6e035368
				if(_t40 == 0x6e035368) {
					L3:
					_t40 = 0;
					L4:
					_t24 = E6DF6FA00(_t27, _t30, _t37, 0x6e038550);
					if(_t40 == 0) {
						L9:
						 *[fs:0x0] = _v20;
						return _t24;
					}
					_t42 =  *((intOrPtr*)(_t40 + 0x14));
					if(_t42 == 0) {
						goto L9;
					}
					_v8 = 0;
					while(1) {
						_t29 =  *_t42;
						if(_t29 == 0) {
							break;
						}
						_v36 = _t29;
						_t42 = _t42 + 4;
						_v40 = _t42;
						__eflags =  *0x6e035780 & 0x00000005;
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t37 + 0x18)));
							_t18 = _t37 + 0x24; // 0xcf
							E6DFC5510("minkernel\\ntdll\\ldrtls.c", 0x425, "LdrpCallTlsInitializers", 2, "Calling TLS callback %p for DLL \"%wZ\" at %p\n", _t29);
							_t45 = _t45 + 0x20;
						}
						_push(0);
						_push(_v32);
						_t24 = E6DF5FC01(_t29, _t29,  *((intOrPtr*)(_t37 + 0x18)), _t37, _t42, __eflags);
					}
					_v8 = 0xfffffffe;
					goto L9;
				}
				while( *((intOrPtr*)(_t40 + 0x20)) != _t37) {
					_t40 =  *_t40;
					if(_t40 != 0x6e035368) {
						continue;
					}
					goto L3;
				}
				goto L4;
			}

0x6df50c30
0x6df50c35
0x6df50c37
0x6df50c3c
0x6df50c47
0x6df50c48
0x6df50c4b
0x6df50c4e
0x6df50c53
0x6df50c58
0x6df50c5c
0x6df50c62
0x6df50c65
0x6df50c67
0x6df50c6f
0x6df50c74
0x6df50c80
0x6df50c91
0x6df50c91
0x6df50c93
0x6df50c98
0x6df50c9f
0x6df50cbd
0x6df50cc0
0x6df50cce
0x6df50cce
0x6df50ca1
0x6df50ca6
0x00000000
0x00000000
0x6df50ca8
0x6df50cb0
0x6df50cb0
0x6df50cb4
0x00000000
0x00000000
0x6df50ccf
0x6df50cd2
0x6df50cd5
0x6df50cd8
0x6df50cdf
0x6dfa6424
0x6dfa6427
0x6dfa6442
0x6dfa6447
0x6dfa6447
0x6df50ce5
0x6df50ce7
0x6df50cef
0x6df50cef
0x6df50cb6
0x00000000
0x6df50cb6
0x6df50c82
0x6df50c87
0x6df50c8f
0x00000000
0x00000000
0x00000000
0x6df50c8f
0x00000000

APIs

RtlAcquireSRWLockShared.9419(6E038550,?,?,00000000,000000FF,6E01F868,00000038,6DF4F563), ref: 6DF50C6F
RtlReleaseSRWLockShared.9419(6E038550,6E038550,?,?,00000000,000000FF,6E01F868,00000038,6DF4F563), ref: 6DF50C98

Strings

LdrpCallTlsInitializers, xrefs: 6DFA6433
Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6DFA642C
minkernel\ntdll\ldrtls.c, xrefs: 6DFA643D

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-70613900
Opcode ID: 6a1392a8e371d88460c61945db3b665aeb47fc440ed6e62e03dacd687bbff38c
Instruction ID: 56b1a89897e87b435dd18d584a0661cd6549d095042d4b4091b2e4666fb55312
Opcode Fuzzy Hash: 6a1392a8e371d88460c61945db3b665aeb47fc440ed6e62e03dacd687bbff38c
Instruction Fuzzy Hash: 8321FB72D04B16ABCB20CF9DC845F6AFBB4FB16718F214629EC2567781D371AC1086D1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF6243, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6DFF6243(void* __ebx, WCHAR* __ecx, void* __edi) {
				signed int _v8;
				short _v188;
				char _v192;
				void* _v196;
				void* _v204;
				void* __esi;
				char _t19;
				intOrPtr _t21;
				void* _t22;
				void* _t28;
				void* _t35;
				void* _t36;
				WCHAR* _t37;
				signed int _t38;

				_t36 = __edi;
				_t28 = __ebx;
				_v8 =  *0x6e03d360 ^ _t38;
				_v192 = 0x55;
				_t37 = __ecx;
				if(E6DFFCF70(__ecx, 1,  &_v188,  &_v192) < 0) {
					L6:
					_t19 = 0;
				} else {
					_t21 = _v192;
					if(_t21 >= 0x55) {
						goto L6;
					} else {
						_t22 = _t21 + _t21;
						if(_t22 >= 0xaa) {
							E6DF8B75A();
							goto L6;
						} else {
							 *((short*)(_t38 + _t22 - 0xb8)) = 0;
							RtlInitUnicodeString( &_v204, _t37);
							RtlInitUnicodeString( &_v196,  &_v188);
							if(RtlCompareUnicodeString( &_v204,  &_v196, 1) != 0) {
								goto L6;
							} else {
								_t19 = 1;
							}
						}
					}
				}
				return E6DF8B640(_t19, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x6dff6243
0x6dff6243
0x6dff6255
0x6dff625f
0x6dff6270
0x6dff627c
0x6dff62de
0x6dff62de
0x6dff627e
0x6dff627e
0x6dff6287
0x00000000
0x6dff6289
0x6dff6289
0x6dff6290
0x6dff62d9
0x00000000
0x6dff6292
0x6dff6294
0x6dff62a4
0x6dff62b7
0x6dff62d3
0x00000000
0x6dff62d5
0x6dff62d5
0x6dff62d5
0x6dff62d3
0x6dff6290
0x6dff6287
0x6dff62ee

APIs

RtlpGetUserOrMachineUILanguage4NLS.9419(00000001,?,?,?), ref: 6DFF6275

Part of subcall function 6DFFCF70: RtlInitUnicodeString.9419(?,Control Panel\Desktop,?,?,?), ref: 6DFFCFC1
Part of subcall function 6DFFCF70: ZwOpenKey.9419(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6DFFD0B8
Part of subcall function 6DFFCF70: RtlInitUnicodeString.9419(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6DFFD0CD
Part of subcall function 6DFFCF70: ZwClose.9419(?,?,?,?), ref: 6DFFD139
Part of subcall function 6DFFCF70: ZwClose.9419(00000000,?,?,?), ref: 6DFFD14E

RtlInitUnicodeString.9419(?,?,00000001,?,?,?), ref: 6DFF62A4
RtlInitUnicodeString.9419(?,?,?,?,00000001,?,?,?), ref: 6DFF62B7
RtlCompareUnicodeString.9419(?,?,00000001,?,?,?,?,00000001,?,?,?), ref: 6DFF62CC

Part of subcall function 6DF59660: RtlCompareUnicodeStrings.9419(?,?,00000001,?,?,?,6DFA3065,?,?,00000001,?,?,00000000,?,00000002,?), ref: 6DF59680

Strings

U, xrefs: 6DFF625F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$String$Init$CloseCompare$Language4MachineOpenRtlpStringsUser
String ID: U
API String ID: 3637150059-3372436214
Opcode ID: 4b9a6406a5442b3566384ffddc658e8416ad35f9d3a4cd075e1fefc945febe2b
Instruction ID: 8b4b0359afb876169a799796a0af6c4cb22c90d35e437be1642bada8de4afdf9
Opcode Fuzzy Hash: 4b9a6406a5442b3566384ffddc658e8416ad35f9d3a4cd075e1fefc945febe2b
Instruction Fuzzy Hash: BC11307190522C9AEB60DB69CC44FDAB3BCAF05304F4045E9E909D7150EF309E498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DFDFDDA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6DFDFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E6DF8CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E6DFD5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E6DFD5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x6dfdfdda
0x6dfdfde2
0x6dfdfde5
0x6dfdfdec
0x6dfdfdfa
0x6dfdfdff
0x6dfdfe0a
0x6dfdfe0f
0x6dfdfe17
0x6dfdfe1e
0x6dfdfe19
0x6dfdfe19
0x6dfdfe19
0x6dfdfe20
0x6dfdfe21
0x6dfdfe22
0x6dfdfe25
0x6dfdfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6DF9FA1C,00000000,00000004,?,00000000,?,00000000), ref: 6DFDFDFA
DbgPrintEx.9419(00000065,00000001,RTL: Enter CriticalSection Timeout (%I64u secs) %d,00000000,?,?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6DF9FA1C,00000000), ref: 6DFDFE0A
DbgPrintEx.9419(00000065,00000000,RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u,?,?,00000002,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 6DFDFE34

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 6DFDFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 6DFDFE01

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 545360701-3903918235
Opcode ID: 3922409d68aac3059f1f4e361286dfb3ad4bcbd684ff35158cfff6fbab80a3e2
Instruction ID: 846b607bc62cd969779667f3c601c7e7b4a9e84cfcfb0dc43b009fa3ca4b1194
Opcode Fuzzy Hash: 3922409d68aac3059f1f4e361286dfb3ad4bcbd684ff35158cfff6fbab80a3e2
Instruction Fuzzy Hash: 33F0C232504141BFDB600B4DDC01F33BB6AEB45730F2A4314F628561D1DA63EC6086E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF63690, Relevance: 7.9, APIs: 5, Instructions: 359
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6DF63690(signed int _a4, signed short* _a8, unsigned int* _a12, signed int _a16) {
				signed int _v8;
				char _v72;
				signed short _v76;
				signed short _v80;
				signed int _v84;
				signed short* _v88;
				signed int _v92;
				signed short* _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				unsigned short _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t154;
				signed short _t156;
				signed short _t157;
				unsigned short _t158;
				signed short _t162;
				signed short _t166;
				signed short _t168;
				signed int _t171;
				signed short _t180;
				signed int _t191;
				signed char _t194;
				signed char _t196;
				signed short _t199;
				signed short _t200;
				signed short _t201;
				signed short _t202;
				void* _t204;
				signed short _t205;
				signed short _t206;
				unsigned int* _t207;
				signed int _t212;
				signed short _t215;
				signed short _t217;
				signed short _t219;
				signed short _t220;
				signed int _t224;
				signed int _t225;
				void* _t226;
				signed int _t227;
				void* _t228;
				signed short _t229;
				signed short* _t230;
				signed short* _t231;
				signed int _t232;
				signed short* _t233;
				signed short* _t234;
				signed int _t235;
				signed int _t236;
				signed short* _t237;
				signed short _t238;
				signed short _t239;
				short* _t240;
				signed int _t242;

				_v8 =  *0x6e03d360 ^ _t242;
				_t207 = _a12;
				_t198 = _a16;
				_v84 = _t198;
				_t237 = _a8;
				if(_t198 != 0) {
					 *_t198 = 0;
				}
				_t221 = _a4;
				if((_t221 & 0xfffffff8) != 0 || _t198 == 0) {
					_t154 = 0xc000000d;
					goto L35;
				} else {
					_t156 = 0;
					_v88 = 0xfffe;
					_v76 = 0;
					_push(_t226);
					if(_t237 != 0) {
						if(( *_t237 & 1) != 0) {
							L39:
							_t156 = 0xc000000d;
							_v76 = 0xc000000d;
						} else {
							_t13 =  &(_t237[1]); // 0xe9d07589
							_t196 =  *_t13 & 0x0000ffff;
							if((_t196 & 0x00000001) != 0) {
								goto L39;
							} else {
								_t236 =  *_t237 & 0x0000ffff;
								if(_t236 > _t196 || _t196 > _v88) {
									goto L39;
								} else {
									if(_t237[2] == 0) {
										if(_t236 != 0 || _t196 != 0) {
											goto L39;
										} else {
											goto L10;
										}
									} else {
										L10:
										_t156 = 0;
									}
								}
							}
						}
					}
					if(_t156 < 0) {
						L36:
						_t154 = _v76;
						goto L34;
					} else {
						_t157 = 0;
						_v76 = 0;
						if(_t207 != 0) {
							if(( *_t207 & 1) != 0) {
								L42:
								_t157 = 0xc000000d;
								_v76 = 0xc000000d;
							} else {
								_t194 = _t207[0] & 0x0000ffff;
								if((_t194 & 0x00000001) != 0) {
									goto L42;
								} else {
									_t235 =  *_t207 & 0x0000ffff;
									if(_t235 > _t194 || _t194 > _v88) {
										goto L42;
									} else {
										if(_t207[1] == 0) {
											if(_t235 != 0 || _t194 != 0) {
												goto L42;
											} else {
												goto L18;
											}
										} else {
											L18:
											_t157 = 0;
										}
									}
								}
							}
						}
						if(_t157 < 0) {
							goto L36;
						} else {
							_t158 =  *_t237 & 0x0000ffff;
							_t26 =  &(_t237[2]); // 0xcd3be9d0
							_t237 =  *_t26;
							_v112 = _t158;
							_t227 = _t158 >> 0x00000001 & 0x0000ffff;
							_v96 = _t207[1];
							_t212 = _t221 & 0x00000001;
							_t162 =  *_t207 >> 0x00000001 & 0x0000ffff;
							_v92 = _t227;
							_v80 = _t162;
							_v104 = _t212;
							_v88 = _t237;
							if(_t212 == 0) {
								_v100 = 1;
							} else {
								_v100 = 0xffffffff;
								_t162 = _v80;
								_t237 =  &(( &(_t237[_t227 & 0x0000ffff]))[0xffffffffffffffff]);
								_v88 = _t237;
							}
							if((_t221 & 0x00000004) != 0) {
								if(_t162 > 0x20) {
									if(_t227 != 0) {
										_a4 = _t221 & 0x00000002;
										do {
											_t166 = E6DFE2EF0( *_t237 & 0x0000ffff);
											_t215 = 0;
											_t221 = 0;
											_v108 = _t166 & 0x0000ffff;
											_t168 = _v80;
											_v76 = 0;
											if(_a4 == 0) {
												if(0 < _t168) {
													_t200 = _v80;
													_t230 = _v96;
													_t238 = _v76;
													while(_v108 != E6DFE2EF0( *(_t230 + (_t238 & 0x0000ffff) * 2) & 0x0000ffff)) {
														_t238 = _t238 + 1;
														if(_t238 < _t200) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t198 = _v84;
													_t168 = _v80;
													_v76 = _t238;
													_t237 = _v88;
													_t215 = _v76;
												}
												if(_t215 != _t168) {
													goto L58;
												} else {
													goto L83;
												}
											} else {
												if(0 < _t168) {
													_t231 = _v96;
													_t199 = _t168;
													_t239 = 0;
													while(_v108 != E6DFE2EF0( *(_t231 + (_t239 & 0x0000ffff) * 2) & 0x0000ffff)) {
														_t239 = _t239 + 1;
														if(_t239 < _t199) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t198 = _v84;
													_t168 = _v80;
													_v76 = _t239;
													_t237 = _v88;
													_t215 = _v76;
												}
												if(_t215 != _t168) {
													goto L83;
												} else {
													goto L58;
												}
											}
											goto L110;
											L83:
											_t227 = _t227 + 0xffff;
											_v92 = _t227;
											_t237 =  &(_t237[_v100]);
											_v88 = _t237;
										} while (_t227 != 0);
									}
								} else {
									if(0 < _t162) {
										_t240 =  &_v72;
										_t232 = _t162 & 0x0000ffff;
										_t204 = _v96 - _t240;
										do {
											 *_t240 = E6DFE2EF0( *(_t204 + _t240) & 0x0000ffff);
											_t240 = _t240 + 2;
											_t232 = _t232 - 1;
										} while (_t232 != 0);
										_t237 = _v88;
										_t227 = _v92;
										_t198 = _v84;
										_t221 = _a4;
									}
									if(_t227 != 0) {
										_a4 = _t221 & 0x00000002;
										do {
											_t180 = E6DFE2EF0( *_t237 & 0x0000ffff);
											_t217 = _v80;
											_t221 = 0;
											_v76 = _t180 & 0x0000ffff;
											if(_a4 == 0) {
												if(0 < _t217) {
													_t202 = _v76;
													while(_t202 !=  *((intOrPtr*)(_t242 + (_t221 & 0x0000ffff) * 2 - 0x44))) {
														_t221 = _t221 + 1;
														if(_t221 < _t217) {
															continue;
														}
														break;
													}
													_t198 = _v84;
												}
												if(_t221 != _t217) {
													goto L58;
												} else {
													goto L65;
												}
											} else {
												if(0 < _t217) {
													_t201 = _v76;
													while(_t201 !=  *((intOrPtr*)(_t242 + (_t221 & 0x0000ffff) * 2 - 0x44))) {
														_t221 = _t221 + 1;
														if(_t221 < _t217) {
															continue;
														}
														break;
													}
													_t198 = _v84;
												}
												if(_t221 != _t217) {
													goto L65;
												} else {
													L58:
													_t212 = _v104;
													goto L30;
												}
											}
											goto L110;
											L65:
											_t227 = _t227 + 0xffff;
											_t237 =  &(_t237[_v100]);
										} while (_t227 != 0);
									}
								}
								goto L29;
							} else {
								if(_t162 != 1) {
									if(_t227 != 0) {
										_t221 = _t221 & 0x00000002;
										_a4 = _t221;
										do {
											_t198 = _v84;
											_v76 = 0;
											if(_t221 == 0) {
												_v108 = 0;
												if(_v108 < _t162) {
													_t220 = _v80;
													_t233 = _v96;
													_t205 = _v76;
													_t224 =  *_t237 & 0x0000ffff;
													while(_t224 !=  *((intOrPtr*)(_t233 + (_t205 & 0x0000ffff) * 2))) {
														_t205 = _t205 + 1;
														if(_t205 < _t220) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t221 = _a4;
													_t212 = _v104;
													_t162 = _v80;
													_v76 = _t205;
													_t198 = _v84;
												}
												if(_v76 != _t162) {
													goto L30;
												} else {
													goto L106;
												}
											} else {
												_v108 = 0;
												if(_v108 < _t162) {
													_t219 = _v80;
													_t234 = _v96;
													_t206 = _v76;
													_t225 =  *_t237 & 0x0000ffff;
													while(_t225 !=  *((intOrPtr*)(_t234 + (_t206 & 0x0000ffff) * 2))) {
														_t206 = _t206 + 1;
														if(_t206 < _t219) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t221 = _a4;
													_t212 = _v104;
													_t162 = _v80;
													_v76 = _t206;
													_t198 = _v84;
												}
												if(_v76 == _t162) {
													goto L30;
												} else {
													goto L106;
												}
											}
											goto L110;
											L106:
											_t198 = _v100;
											_t227 = _t227 + 0xffff;
											_v92 = _t227;
											_t237 =  &(_t237[_v100]);
										} while (_t227 != 0);
									}
									goto L29;
								} else {
									_t191 =  *_v96 & 0x0000ffff;
									if((_t221 & 0x00000002) != 0) {
										if(_t227 == 0) {
											goto L29;
										} else {
											_t221 = _v100;
											while( *_t237 == _t191) {
												_t227 = _t227 + 0xffff;
												_t237 =  &(_t237[_t221]);
												if(_t227 != 0) {
													continue;
												} else {
													goto L29;
												}
												goto L110;
											}
											goto L30;
										}
									} else {
										if(_t227 == 0) {
											L29:
											_pop(_t228);
											return E6DF8B640(0xc0000225, _t198, _v8 ^ _t242, _t221, _t228, _t237);
										} else {
											while( *_t237 != _t191) {
												_t221 = _v100;
												_t227 = _t227 + 0xffff;
												_t237 =  &(_t237[_v100]);
												if(_t227 != 0) {
													continue;
												} else {
													goto L29;
												}
												goto L110;
											}
											L30:
											if(_t227 == 0) {
												goto L29;
											} else {
												_t229 = _t227 * 2 - 2;
												if(_t212 == 0) {
													_t171 = _v112 - _t229 & 0x0000ffff;
												} else {
													_t171 = _t229 & 0x0000ffff;
												}
												 *_t198 = _t171;
												_t154 = 0;
												L34:
												_pop(_t226);
												L35:
												return E6DF8B640(_t154, _t198, _v8 ^ _t242, _t221, _t226, _t237);
											}
										}
									}
								}
							}
						}
					}
				}
				L110:
			}

0x6df6369f
0x6df636a2
0x6df636a6
0x6df636a9
0x6df636ad
0x6df636b2
0x6df636b6
0x6df636b6
0x6df636b9
0x6df636c2
0x6dfaddac
0x00000000
0x6df636d0
0x6df636d0
0x6df636d2
0x6df636d9
0x6df636dc
0x6df636df
0x6df636e6
0x6dfadae8
0x6dfadae8
0x6dfadaed
0x6df636ec
0x6df636ec
0x6df636ec
0x6df636f2
0x00000000
0x6df636f8
0x6df636f8
0x6df636fe
0x00000000
0x6df6370e
0x6df63712
0x6dfadadd
0x00000000
0x00000000
0x00000000
0x00000000
0x6df63718
0x6df63718
0x6df63718
0x6df63718
0x6df63712
0x6df636fe
0x6df636f2
0x6df636e6
0x6df6371c
0x6df6383d
0x6df6383d
0x00000000
0x6df63722
0x6df63722
0x6df63724
0x6df63729
0x6df63730
0x6dfadb03
0x6dfadb03
0x6dfadb08
0x6df63736
0x6df63736
0x6df6373c
0x00000000
0x6df63742
0x6df63742
0x6df63748
0x00000000
0x6df63758
0x6df6375c
0x6dfadaf8
0x00000000
0x00000000
0x00000000
0x00000000
0x6df63762
0x6df63762
0x6df63762
0x6df63762
0x6df6375c
0x6df63748
0x6df6373c
0x6df63730
0x6df63766
0x00000000
0x6df6376c
0x6df6376c
0x6df6376f
0x6df6376f
0x6df63772
0x6df63778
0x6df63781
0x6df63789
0x6df6378c
0x6df6378f
0x6df63792
0x6df63795
0x6df63798
0x6df6379b
0x6dfadb10
0x6df637a1
0x6df637a4
0x6df637ae
0x6df637b1
0x6df637b4
0x6df637b4
0x6df637ba
0x6dfadb20
0x6dfadbe6
0x6dfadbef
0x6dfadbf2
0x6dfadbf6
0x6dfadbfe
0x6dfadc00
0x6dfadc02
0x6dfadc05
0x6dfadc08
0x6dfadc0e
0x6dfadc54
0x6dfadc56
0x6dfadc59
0x6dfadc5c
0x6dfadc5f
0x6dfadc72
0x6dfadc76
0x00000000
0x00000000
0x00000000
0x6dfadc76
0x6dfadc78
0x6dfadc7b
0x6dfadc7e
0x6dfadc81
0x6dfadc84
0x6dfadc87
0x6dfadc87
0x6dfadc8d
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfadc10
0x6dfadc13
0x6dfadc15
0x6dfadc18
0x6dfadc1a
0x6dfadc1c
0x6dfadc2f
0x6dfadc33
0x00000000
0x00000000
0x00000000
0x6dfadc33
0x6dfadc35
0x6dfadc38
0x6dfadc3b
0x6dfadc3e
0x6dfadc41
0x6dfadc44
0x6dfadc44
0x6dfadc4a
0x00000000
0x6dfadc4c
0x00000000
0x6dfadc4c
0x6dfadc4a
0x00000000
0x6dfadc93
0x6dfadc96
0x6dfadc9c
0x6dfadc9f
0x6dfadca2
0x6dfadca5
0x6dfadcae
0x6dfadb26
0x6dfadb2b
0x6dfadb30
0x6dfadb35
0x6dfadb38
0x6dfadb3a
0x6dfadb44
0x6dfadb47
0x6dfadb4a
0x6dfadb4a
0x6dfadb4f
0x6dfadb52
0x6dfadb55
0x6dfadb58
0x6dfadb58
0x6dfadb5e
0x6dfadb67
0x6dfadb6a
0x6dfadb6e
0x6dfadb73
0x6dfadb76
0x6dfadb7b
0x6dfadb83
0x6dfadbb0
0x6dfadbb2
0x6dfadbb5
0x6dfadbbf
0x6dfadbc3
0x00000000
0x00000000
0x00000000
0x6dfadbc3
0x6dfadbc5
0x6dfadbc5
0x6dfadbcb
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfadb85
0x6dfadb88
0x6dfadb8a
0x6dfadb8d
0x6dfadb97
0x6dfadb9b
0x00000000
0x00000000
0x00000000
0x6dfadb9b
0x6dfadb9d
0x6dfadb9d
0x6dfadba3
0x00000000
0x6dfadba5
0x6dfadba5
0x6dfadba5
0x00000000
0x6dfadba5
0x6dfadba3
0x00000000
0x6dfadbcd
0x6dfadbd0
0x6dfadbd6
0x6dfadbd9
0x6dfadbde
0x6dfadb5e
0x00000000
0x6df637c0
0x6df637c4
0x6dfadcde
0x6dfadce4
0x6dfadce7
0x6dfadcea
0x6dfadcea
0x6dfadced
0x6dfadcf6
0x6dfadd3e
0x6dfadd49
0x6dfadd4b
0x6dfadd4e
0x6dfadd51
0x6dfadd54
0x6dfadd57
0x6dfadd60
0x6dfadd64
0x00000000
0x00000000
0x00000000
0x6dfadd64
0x6dfadd66
0x6dfadd69
0x6dfadd6c
0x6dfadd6f
0x6dfadd72
0x6dfadd75
0x6dfadd75
0x6dfadd7c
0x00000000
0x00000000
0x00000000
0x00000000
0x6dfadcf8
0x6dfadcf8
0x6dfadd03
0x6dfadd05
0x6dfadd08
0x6dfadd0b
0x6dfadd0e
0x6dfadd11
0x6dfadd1a
0x6dfadd1e
0x00000000
0x00000000
0x00000000
0x6dfadd1e
0x6dfadd20
0x6dfadd23
0x6dfadd26
0x6dfadd29
0x6dfadd2c
0x6dfadd2f
0x6dfadd2f
0x6dfadd36
0x00000000
0x6dfadd3c
0x00000000
0x6dfadd3c
0x6dfadd36
0x00000000
0x6dfadd82
0x6dfadd82
0x6dfadd85
0x6dfadd8b
0x6dfadd8e
0x6dfadd91
0x6dfadd9a
0x00000000
0x6df637ca
0x6df637cd
0x6df637d3
0x6dfadcb6
0x00000000
0x6dfadcbc
0x6dfadcbc
0x6dfadcbf
0x6dfadcc8
0x6dfadcce
0x6dfadcd4
0x00000000
0x6dfadcd6
0x00000000
0x6dfadcd6
0x00000000
0x6dfadcd4
0x00000000
0x6dfadcbf
0x6df637d9
0x6df637dc
0x6df637f6
0x6df637f6
0x6df6380b
0x6df637e0
0x6df637e0
0x6df637e5
0x6df637e8
0x6df637ee
0x6df637f4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6df637f4
0x6df6380e
0x6df63811
0x00000000
0x6df63813
0x6df63813
0x6df6381c
0x6dfadda4
0x6df63822
0x6df63822
0x6df63822
0x6df63825
0x6df63828
0x6df6382a
0x6df6382a
0x6df6382b
0x6df6383a
0x6df6383a
0x6df63811
0x6df637dc
0x6df637d3
0x6df637c4
0x6df637ba
0x6df63766
0x6df6371c
0x00000000

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8537f93060c69fc28fc67795d1ee71196796a790256d1801bb634945f4a988
Instruction ID: 2795a2166765dd880828b2c2c9d0bb06372bfea2b7894b2f43dc22ccb19cd829
Opcode Fuzzy Hash: 5c8537f93060c69fc28fc67795d1ee71196796a790256d1801bb634945f4a988
Instruction Fuzzy Hash: 9ED15075D0466ACBDB10DF9CC9402FEB7B1FF84750F99801ADC95AB684E731A982C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF41190, Relevance: 7.7, APIs: 5, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DF41190(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short* _a16) {
				signed int _v8;
				long _v12;
				void* _t21;
				signed int _t24;
				long _t27;
				long _t28;
				signed int _t30;
				signed int _t37;
				int _t41;
				signed int _t51;
				signed int _t54;
				long _t59;
				void* _t60;
				signed short* _t74;
				signed int _t75;
				signed short* _t78;
				signed short* _t79;
				signed int _t82;
				long _t83;

				if(_a4 == 0 || _a12 == 0 || _a16 == 0 || E6DF411E0(_a4, _a8,  &_v8, _a12) < 0) {
					L4:
					_t21 = 0xc000000d;
					goto L5;
				} else {
					_t78 = _v8;
					_t24 =  *_t78 & 0x0000ffff;
					if(_t24 != 0x3a) {
						if(_t24 != 0) {
							goto L4;
						}
						_t54 = 0;
						L29:
						 *_a16 = _t54;
						_t21 = 0;
						L5:
						return _t21;
					}
					_t79 =  &(_t78[1]);
					_t54 = 0;
					_t75 = 0xa;
					_v8 = _t75;
					_t82 = 0x10;
					if( *_t79 == 0x30) {
						_t74 =  &(_t79[1]);
						_t79 = _t74;
						_t75 = 8;
						_v8 = _t75;
						_t51 =  *_t79 & 0x0000ffff;
						if(_t51 == 0x78 || _t51 == 0x58) {
							_t75 = _t82;
							_t79 =  &(_t74[1]);
							_v8 = _t75;
						}
					}
					_t27 =  *_t79 & 0x0000ffff;
					_t83 = _t27;
					_t59 = _t27;
					_v12 = _t59;
					if(_t83 == 0) {
						L25:
						if(_t59 != 0) {
							goto L29;
						}
						goto L4;
					} else {
						do {
							_t28 = 0x80;
							_t79 =  &(_t79[1]);
							if(_t83 >= 0x80) {
								L18:
								_t60 = 0x10;
								if(_t75 != _t60 || _t83 >= _t28 || iswctype(_t83, _t28) == 0) {
									goto L4;
								} else {
									_t30 = iswctype(_t83, 2);
									asm("sbb eax, eax");
									if((_t83 & 0x0000ffff) + 0xa + ((_t54 & 0x0000ffff) << 4) - ( ~_t30 & 0x00000020) + 0x41 > 0xffff) {
										goto L4;
									}
									_t37 = iswctype(_t83, 2);
									_t75 = _v8;
									asm("sbb eax, eax");
									_t54 = (_t54 << 4) + 0xa + _t83 - ( ~_t37 & 0x00000020) + 0x41;
									goto L23;
								}
							}
							_t41 = iswctype(_t83, 4);
							_t75 = _v8;
							if(_t41 == 0) {
								L17:
								_t28 = 0x80;
								goto L18;
							}
							_t17 = _t83 - 0x30; // -48
							if(_t17 >= _t75) {
								goto L17;
							}
							if((_t83 & 0x0000ffff) + 0xffffffd0 + (_t75 & 0x0000ffff) * (_t54 & 0x0000ffff) > 0xffff) {
								goto L4;
							}
							_t54 = _t75 * _t54 + 0xffffffd0 + _t83 & 0x0000ffff;
							L23:
							_t83 =  *_t79 & 0x0000ffff;
						} while (_t83 != 0);
						_t59 = _v12;
						goto L25;
					}
				}
			}

0x6df4119e
0x6df411c6
0x6df411c6
0x00000000
0x6df9eb05
0x6df9eb05
0x6df9eb08
0x6df9eb0e
0x6df9ec43
0x00000000
0x00000000
0x6df9ec49
0x6df9ec4b
0x6df9ec52
0x6df9ec55
0x6df411cb
0x6df411d1
0x6df411d1
0x6df9eb16
0x6df9eb19
0x6df9eb1b
0x6df9eb1e
0x6df9eb25
0x6df9eb26
0x6df9eb28
0x6df9eb2b
0x6df9eb2f
0x6df9eb30
0x6df9eb33
0x6df9eb39
0x6df9eb40
0x6df9eb42
0x6df9eb45
0x6df9eb45
0x6df9eb39
0x6df9eb48
0x6df9eb4b
0x6df9eb4d
0x6df9eb4f
0x6df9eb55
0x6df9ec36
0x6df9ec39
0x00000000
0x00000000
0x00000000
0x6df9eb5b
0x6df9eb5b
0x6df9eb5b
0x6df9eb60
0x6df9eb66
0x6df9ebb1
0x6df9ebb3
0x6df9ebb7
0x00000000
0x6df9ebd7
0x6df9ebda
0x6df9ebe2
0x6df9ec00
0x00000000
0x00000000
0x6df9ec0c
0x6df9ec11
0x6df9ec17
0x6df9ec25
0x00000000
0x6df9ec25
0x6df9ebb7
0x6df9eb6b
0x6df9eb70
0x6df9eb77
0x6df9ebac
0x6df9ebac
0x00000000
0x6df9ebac
0x6df9eb79
0x6df9eb7f
0x00000000
0x00000000
0x6df9eb97
0x00000000
0x00000000
0x6df9eba7
0x6df9ec27
0x6df9ec27
0x6df9ec2a
0x6df9ec33
0x00000000
0x6df9ec33
0x6df9eb55

APIs

RtlIpv4StringToAddressW.9419(00000000,?,?,00000000), ref: 6DF411B9

Part of subcall function 6DF411E0: iswctype.9419(0000000A,00000004), ref: 6DF41244

iswctype.9419(00000000,00000004,00000000,?,?,00000000), ref: 6DF9EB6B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$AddressIpv4String
String ID:
API String ID: 1627499474-0
Opcode ID: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction ID: c4feb3fb7f9c93b0355e095d80a94de98873e27c0122ddbfc90f925b4be9045f
Opcode Fuzzy Hash: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction Fuzzy Hash: EC41E476A05116AAE7288E5CDC41BBA77B8BF80764F608526E845DB2C0F738DA51D350

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD40D2, Relevance: 7.6, APIs: 5, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DFD40D2(signed short* __ecx, signed short* __edx, signed int* _a4) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				void* _v20;
				signed int _t34;
				void* _t37;
				signed int _t38;
				signed int* _t46;
				signed int _t47;
				signed int _t48;
				signed short _t51;
				signed short _t53;
				signed short* _t61;
				signed int _t62;
				signed short* _t63;

				_t61 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(__edx != 0) {
					_t62 = E6DFCAE60(__ecx,  &_v12,  &_v20);
					__eflags = _t62;
					if(_t62 < 0) {
						L18:
						RtlFreeUnicodeString( &_v12);
						RtlFreeUnicodeString( &_v20);
						return _t62;
					}
					__eflags = _v16;
					if(__eflags == 0) {
						L6:
						__eflags = _v8;
						if(__eflags == 0) {
							L17:
							_t62 = 0;
							__eflags = 0;
							goto L18;
						}
						_t34 = E6DF7D294( &_v12, 1, __eflags);
						__eflags = _t34;
						if(_t34 == 0) {
							goto L17;
						}
						_t63 =  &_v12;
						L9:
						 *_t61 = 0;
						_t37 = ( *_t63 & 0x0000ffff) + 2;
						__eflags = _t37 - 0xfffe;
						if(_t37 <= 0xfffe) {
							_t48 =  &(_t61[4]);
							__eflags = _t48;
							if(_t48 == 0) {
								L13:
								_t38 = E6DF7D690(0, _t48, _t37);
								__eflags = _t38;
								if(_t38 >= 0) {
									L15:
									_t51 =  *_t48;
									_t61[2] = _t51;
									memmove(_t51 + (( *_t61 & 0x0000ffff) >> 1) * 2, _t63[2],  *_t63 & 0x0000ffff);
									_t53 = ( *_t63 & 0x0000ffff) +  *_t61;
									 *_t61 = _t53;
									_t61[1] = _t53 + 2;
									 *((short*)(_t61[2] + ((_t53 & 0x0000ffff) >> 1) * 2)) = 0;
									_t46 = _a4;
									__eflags = _t46;
									if(_t46 != 0) {
										 *_t46 =  *_t46 | 0x00000001;
										__eflags =  *_t46;
									}
									goto L17;
								}
								_t62 = 0xc0000017;
								goto L18;
							}
							__eflags = _t37 - _t61[8];
							if(_t37 <= _t61[8]) {
								goto L15;
							}
							goto L13;
						}
						_t62 = 0xc0000106;
						goto L18;
					}
					_t47 = E6DF7D294( &_v20, 1, __eflags);
					__eflags = _t47;
					if(_t47 == 0) {
						goto L6;
					}
					_t63 =  &_v20;
					goto L9;
				}
				_t62 = 0xc000000d;
				goto L18;
			}

0x6dfd40df
0x6dfd40e1
0x6dfd40e4
0x6dfd40e7
0x6dfd40ea
0x6dfd40ef
0x6dfd4109
0x6dfd410b
0x6dfd410d
0x6dfd41cb
0x6dfd41cf
0x6dfd41d8
0x6dfd41e5
0x6dfd41e5
0x6dfd4113
0x6dfd4117
0x6dfd412c
0x6dfd412c
0x6dfd4130
0x6dfd41c9
0x6dfd41c9
0x6dfd41c9
0x00000000
0x6dfd41c9
0x6dfd413b
0x6dfd4140
0x6dfd4142
0x00000000
0x00000000
0x6dfd4148
0x6dfd414b
0x6dfd414d
0x6dfd4153
0x6dfd4156
0x6dfd415b
0x6dfd4164
0x6dfd4167
0x6dfd4169
0x6dfd4170
0x6dfd4174
0x6dfd4179
0x6dfd417b
0x6dfd4184
0x6dfd4187
0x6dfd4192
0x6dfd4199
0x6dfd41a3
0x6dfd41a9
0x6dfd41b2
0x6dfd41bb
0x6dfd41bf
0x6dfd41c2
0x6dfd41c4
0x6dfd41c6
0x6dfd41c6
0x6dfd41c6
0x00000000
0x6dfd41c4
0x6dfd417d
0x00000000
0x6dfd417d
0x6dfd416b
0x6dfd416e
0x00000000
0x00000000
0x00000000
0x6dfd416e
0x6dfd415d
0x00000000
0x6dfd415d
0x6dfd411e
0x6dfd4123
0x6dfd4125
0x00000000
0x00000000
0x6dfd4127
0x00000000
0x6dfd4127
0x6dfd40f1
0x00000000

APIs

RtlComputePrivatizedDllName_U.9419(?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6DFD4104
RtlFreeUnicodeString.9419(?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6DFD41CF
RtlFreeUnicodeString.9419(?,?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6DFD41D8

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeStringUnicode$ComputeName_Privatized
String ID:
API String ID: 3871896386-0
Opcode ID: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction ID: 308e5df7e14f361396b089bf561667f73f34887d6ece9415ac986acbcd378411
Opcode Fuzzy Hash: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction Fuzzy Hash: 2831C07180021AAACB51CFACCC80AFEF3B8FF69304F15456AD954E7280E735D955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DF7F296, Relevance: 7.6, APIs: 5, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DF7F296(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v92;
				void _v132;
				char _v133;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t36;
				intOrPtr _t51;
				void* _t59;
				intOrPtr _t60;
				intOrPtr _t67;
				signed char* _t68;
				signed int _t69;

				_v8 =  *0x6e03d360 ^ _t69;
				_t51 = __ecx;
				_v133 = 0;
				_t3 = _t51 + 0xc; // 0xc
				_t67 = E6DF7F2E0(_t3, __edx);
				_v148 = _t67;
				if(_t67 != 0) {
					_t6 = _t67 + 0x1c; // 0x1c
					_t66 = _t6;
					E6DF6FAD0(_t6);
					 *((intOrPtr*)(_t51 + 0xc8)) = _t67;
					E6E013D12(_t51);
					_t64 = 4;
					_t8 = _t51 + 0x66; // 0x66
					_t68 = _t8;
					_v140 = _t64;
					_v144 = 2;
					do {
						if( *((char*)(_t68 - 2)) == 0) {
							_t36 = _v133;
						} else {
							_t55 =  *(_t51 + 0x36) & 0x0000ffff;
							if((_t55 & 0x00003fff) == _v144 || _t55 < 0) {
								_t55 =  *_t68 & 0x000000ff;
								E6DF88F7B( *_t68 & 0x000000ff, _t51);
								_t64 = _v140;
							}
							_t36 = 1;
							_v133 = 1;
						}
						_t68 =  &(_t68[0x18]);
						_t64 = _t64 - 1;
						_v140 = _t64;
					} while (_t64 != 0);
					if(_t36 == 0) {
						_t33 = E6DF6FA00(_t51, _t55, _t66, _t66);
					} else {
						_t59 = 2;
						if(( *(_t51 + 0x36) & 0x00003fff) == _t59) {
							memset( &_v132, 0, 0x78);
							_t60 = _v148;
							_t66 =  &_v92;
							_t68 = _t60 + 0xc;
							_v28 =  *((intOrPtr*)(_t60 + 0x88));
							_v24 =  *((intOrPtr*)(_t60 + 0x8c));
							_v20 =  *((intOrPtr*)(_t60 + 0x90));
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							E6DF6FA00(_t51, _t60,  &_v92, _t60 + 0x1c);
							_t64 = _t51;
							_t33 = E6DF7645B( &_v132, _t51, 1);
						} else {
							E6DF6FA00(_t51, _t59, _t66, _t66);
							_t33 = E6E013D4E(_t51);
						}
					}
				}
				return E6DF8B640(_t33, _t51, _v8 ^ _t69, _t64, _t66, _t68);
			}

0x6df7f2a8
0x6df7f2ac
0x6df7f2ae
0x6df7f2b7
0x6df7f2bf
0x6df7f2c1
0x6df7f2c9
0x6dfbbb57
0x6dfbbb57
0x6dfbbb5b
0x6dfbbb62
0x6dfbbb68
0x6dfbbb6f
0x6dfbbb70
0x6dfbbb70
0x6dfbbb73
0x6dfbbb79
0x6dfbbb83
0x6dfbbb87
0x6dfbbbbc
0x6dfbbb89
0x6dfbbb89
0x6dfbbb9b
0x6dfbbba2
0x6dfbbba7
0x6dfbbbac
0x6dfbbbac
0x6dfbbbb2
0x6dfbbbb4
0x6dfbbbb4
0x6dfbbbc2
0x6dfbbbc5
0x6dfbbbc8
0x6dfbbbc8
0x6dfbbbd2
0x6dfbbc50
0x6dfbbbd4
0x6dfbbbe2
0x6dfbbbe6
0x6dfbbc02
0x6dfbbc07
0x6dfbbc0d
0x6dfbbc19
0x6dfbbc1c
0x6dfbbc25
0x6dfbbc2e
0x6dfbbc34
0x6dfbbc36
0x6dfbbc37
0x6dfbbc38
0x6dfbbc39
0x6dfbbc40
0x6dfbbc45
0x6dfbbbe8
0x6dfbbbe9
0x6dfbbbf0
0x6dfbbbf0
0x6dfbbbe6
0x6dfbbbd2
0x6df7f2df

APIs

Part of subcall function 6DF7F2E0: RtlAcquireSRWLockExclusive.9419(6E0386AC,00000000,00000000,00000000,0000000C,?,6DF7F2BF,00000000,00000000,?), ref: 6DF7F2F1
Part of subcall function 6DF7F2E0: RtlReleaseSRWLockExclusive.9419(6E0386AC,?,?,6E0386AC,00000000,00000000,00000000,0000000C,?,6DF7F2BF,00000000,00000000,?), ref: 6DF7F31B

RtlAcquireSRWLockShared.9419(0000001C,00000000,00000000,?), ref: 6DFBBB5B
RtlReleaseSRWLockShared.9419(0000001C,0000001C,00000000,00000000,?), ref: 6DFBBBE9

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$AcquireExclusiveReleaseShared
String ID:
API String ID: 3474408661-0
Opcode ID: b9d270d5b11fa8972b01e891766bdead88dc58ad514de59979fcaa4b51c41bb7
Instruction ID: 551438e1467bac045eb7e50da438a92261201ee75ff50ca6cefe22f9f7725870
Opcode Fuzzy Hash: b9d270d5b11fa8972b01e891766bdead88dc58ad514de59979fcaa4b51c41bb7
Instruction Fuzzy Hash: 7E31E5759042158ACB61DF6CC880BEAB7B4FF44708F10C4AAED49AF246DB715E46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6C4A0, Relevance: 7.6, APIs: 5, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6DF6C4A0(intOrPtr* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v9;
				intOrPtr _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int _t34;
				signed int _t41;
				signed char _t46;
				intOrPtr* _t51;
				signed int _t52;

				_v8 =  *0x6e03d360 ^ _t52;
				_t41 = _a8;
				_t51 = _a4;
				_t49 = 0;
				if(E6DF6C577(_t51, 0 | _t41 != 0x00000000) == 0) {
					_t29 = 0;
				} else {
					_t50 = _t51 + 0x90;
					_t41 = _t41 & 0xffffff00 | _t41 != 0x00000000;
					_v16 =  *((intOrPtr*)(_t51 + 0x5c)) + 0x40;
					E6DF62280( *((intOrPtr*)(_t51 + 0x5c)) + 0x40, _t51 + 0x90);
					_t49 = _v16;
					_t34 = E6DF6C182(_t51, _v16, _t41);
					_t46 = _t34;
					_v9 = _t46;
					if(_a8 != 0 &&  *((char*)(_t51 + 0xdf)) != 0) {
						_t34 = E6DF5FFB0(_t41, _t50, _t50);
						_t46 = _v9;
						_t41 = 0;
					}
					if(_t46 == 0) {
						if(_t41 == 0) {
							goto L8;
						} else {
							_t34 = E6DF6E180(_t51);
							if(_t34 != 0) {
								goto L6;
							} else {
								asm("lock inc dword [esi]");
								_t46 = _v9;
								goto L4;
							}
						}
						goto L19;
					} else {
						L4:
						if(_t41 == 0) {
							if(_t46 == 0) {
								goto L8;
							} else {
								asm("lock xadd [esi], eax");
								if((_t34 | 0xffffffff) != 0) {
									goto L8;
								} else {
									_t51 =  *((intOrPtr*)( *((intOrPtr*)(_t51 + 4))));
									 *0x6e03b1e0(_t51);
									 *_t51();
									goto L7;
								}
							}
							L19:
						} else {
							_t49 = _v16;
							E6DF6DBE9(_t51, _v16, _a8, _a12, _a16);
							L6:
							E6DF5FFB0(_t41, _t50, _t50);
							L7:
							_t46 = _v9;
						}
					}
					L8:
					_t29 = _t46 & 0x000000ff;
				}
				return E6DF8B640(_t29, _t41, _v8 ^ _t52, _t49, _t50, _t51);
				goto L19;
			}

0x6df6c4af
0x6df6c4b3
0x6df6c4b9
0x6df6c4c5
0x6df6c4ce
0x6df6c561
0x6df6c4d4
0x6df6c4d7
0x6df6c4e0
0x6df6c4e6
0x6df6c4e9
0x6df6c4ee
0x6df6c4f4
0x6df6c4fd
0x6df6c4ff
0x6df6c502
0x6dfb2e52
0x6dfb2e57
0x6dfb2e5a
0x6dfb2e5a
0x6df6c513
0x6df6c54d
0x00000000
0x6df6c54f
0x6df6c550
0x6df6c557
0x00000000
0x6df6c559
0x6df6c559
0x6df6c55c
0x00000000
0x6df6c55c
0x6df6c557
0x00000000
0x6df6c515
0x6df6c515
0x6df6c517
0x6df6c567
0x00000000
0x6df6c569
0x6df6c56c
0x6df6c570
0x00000000
0x6df6c572
0x6dfb2e65
0x6dfb2e69
0x6dfb2e6f
0x00000000
0x6dfb2e6f
0x6df6c570
0x00000000
0x6df6c519
0x6df6c51c
0x6df6c527
0x6df6c52c
0x6df6c52d
0x6df6c532
0x6df6c532
0x6df6c532
0x6df6c517
0x6df6c535
0x6df6c535
0x6df6c535
0x6df6c548
0x00000000

APIs

RtlAcquireSRWLockExclusive.9419(?,00000000,?,00000000,?,?,?,?,?,6E00C9F8,000000FE), ref: 6DF6C4E9
RtlReleaseSRWLockExclusive.9419(?,?,?,?,00000000,?,00000000,?), ref: 6DF6C52D
TpIsTimerSet.9419(?,?,?,00000000,?,00000000,?), ref: 6DF6C550
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,00000000,?), ref: 6DFB2E52
RtlDebugPrintTimes.9419(?,?,?,?,00000000,?,00000000,?), ref: 6DFB2E69

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: bc4752647b031ec172d8e83898bafb05a8d550507aac2fbc8cffcab83720da0b
Instruction ID: dac0574ab7e2c0005706c5919d182a6e0889fe7cbc1f417b2df6a357bc39eda5
Opcode Fuzzy Hash: bc4752647b031ec172d8e83898bafb05a8d550507aac2fbc8cffcab83720da0b
Instruction Fuzzy Hash: 28210131604289ABCF01CF3D8C50ABFBBB5AF46358F058469ECD59B641EB31DD049BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF50541, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6DF50541(char __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				long _v16;
				short _v18;
				void* _v20;
				void* _v28;
				long _t51;
				void* _t55;
				short _t59;
				intOrPtr _t63;
				intOrPtr* _t64;
				intOrPtr _t66;
				signed int _t84;
				intOrPtr* _t92;
				signed int _t94;
				long _t101;
				char _t102;
				signed int _t105;
				signed int _t108;

				_t64 = __edx;
				_t102 = __ecx;
				_v12 = __ecx;
				_v20 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t51 = E6DF5E9C0(3, __ecx, 0, 0,  &_v8);
				if(_t51 >= 0) {
					_t66 = _v8;
					 *_t64 =  *((intOrPtr*)(_t66 + 8));
					 *((intOrPtr*)(_t64 + 4)) =  *((intOrPtr*)(_t66 + 0x58));
					_t51 =  *(_t66 + 0x50);
					_v16 = _t51;
					if( *((intOrPtr*)(_t66 + 0x74)) > 2) {
						_t51 =  *(_t66 + 0x88);
						if(_t51 != 0 &&  *((intOrPtr*)(_t66 + 0x8c)) >= 0x10) {
							_t84 = _t51 + _t102;
							_t51 = E6DF50733( &_v20, _t84, 0x10);
							asm("sbb esi, esi");
							_t105 =  ~_t51 & _t84;
							if(_t105 != 0) {
								_t51 = E6DF5050C(_t105,  *(_t105 + 0xc) & 0x0000ffff);
								if(_t51 != 0) {
									_t51 = E6DF50769( &_v20, _t51,  *(_t105 + 0xe) & 0x0000ffff, 0x10);
									if(_t51 != 0) {
										_t100 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
										_t87 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
										_t51 = E6DF50733( &_v20, _t100, 0x10);
										if(_t51 != 0) {
											_t51 = E6DF5050C(_t87,  *(_t100 + 0xc) & 0x0000ffff);
											if(_t51 != 0) {
												_t51 = E6DF50769( &_v20, _t51,  *(_t100 + 0xe) & 0x0000ffff, 1);
												if(_t51 != 0) {
													_t91 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
													_t51 = E6DF50733( &_v20, ( *(_t51 + 4) & 0x7fffffff) + _t105, 0x10);
													if(_t51 != 0) {
														_t51 = E6DF5050C(_t91, 0);
														if(_t51 != 0) {
															_t51 =  *(_t51 + 4);
															if(_t51 >= 0) {
																_t92 = _t51 + _t105;
																_t51 = E6DF50733( &_v20, _t92, 0x10);
																if(_t51 != 0 &&  *((intOrPtr*)(_t92 + 4)) >= 0x5c) {
																	_t94 =  *_t92 + _v12;
																	_t51 = E6DF50733( &_v20, _t94, 0x5c);
																	asm("sbb esi, esi");
																	_t108 =  ~_t51 & _t94;
																	if(_t108 != 0) {
																		_t51 = E6DF50733( &_v20, _t108, 0x5c);
																		if(_t51 != 0) {
																			_t55 = 0x20;
																			_t35 = _t108 + 6; // 0x6
																			_t101 = _t35;
																			_t51 = E6DF50733( &_v20, _t101, _t55);
																			if(_t51 != 0) {
																				RtlInitUnicodeString( &_v28, L"VS_VERSION_INFO");
																				_v16 = _t101;
																				_t51 = E6DF507AF(_t101,  &_v12);
																				if(_t51 >= 0) {
																					_v20 = _v12;
																					_t59 = 0x20;
																					_v18 = _t59;
																					_t51 = RtlCompareUnicodeString( &_v28,  &_v20, 0);
																					if(_t51 == 0) {
																						 *((intOrPtr*)(_t64 + 8)) =  *((intOrPtr*)(_t108 + 0x30));
																						_t63 =  *((intOrPtr*)(_t108 + 0x34));
																						 *((intOrPtr*)(_t64 + 0xc)) = _t63;
																						return _t63;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return _t51;
			}

0x6df5054c
0x6df50552
0x6df50554
0x6df50557
0x6df5055a
0x6df5055b
0x6df5055c
0x6df5055d
0x6df50569
0x6df50570
0x6df50576
0x6df5057c
0x6df50581
0x6df50588
0x6df5058b
0x6df5058e
0x6df50594
0x6df5059c
0x6df505af
0x6df505b7
0x6df505c0
0x6df505c2
0x6df505c4
0x6df505d4
0x6df505db
0x6df505ed
0x6df505f4
0x6df50606
0x6df5060a
0x6df5060c
0x6df50613
0x6df50621
0x6df50628
0x6df5063a
0x6df50641
0x6df50653
0x6df50657
0x6df5065e
0x6df50669
0x6df50670
0x6df50676
0x6df5067b
0x6df50681
0x6df50689
0x6df50690
0x6df506a5
0x6df506aa
0x6df506b3
0x6df506b5
0x6df506b7
0x6df506c0
0x6df506c7
0x6df506cb
0x6df506cc
0x6df506cc
0x6df506d5
0x6df506dc
0x6df506e7
0x6df506ef
0x6df506f5
0x6df506fc
0x6df50704
0x6df50708
0x6df50709
0x6df50717
0x6df5071e
0x6df50723
0x6df50726
0x6df50729
0x00000000
0x6df50729
0x6df5071e
0x6df506fc
0x6df506dc
0x6df506c7
0x6df506b7
0x6df50690
0x6df5067b
0x6df50670
0x6df5065e
0x6df50641
0x6df50628
0x6df50613
0x6df505f4
0x6df505db
0x6df505c4
0x6df5059c
0x6df5058e
0x6df50732

APIs

RtlImageNtHeaderEx.9419(00000003,?,00000000,00000000,?,000000AB,?,?,?,?,6DF504FB,6E01F890,0000001C,6DF503A8,?,00000000), ref: 6DF50569
RtlInitUnicodeString.9419(?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010,?,00000010,?,00000010), ref: 6DF506E7
RtlCompareUnicodeString.9419(?,6E01F890,00000000,6DF503A8,?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010), ref: 6DF50717

Part of subcall function 6DF59660: RtlCompareUnicodeStrings.9419(?,?,00000001,?,?,?,6DFA3065,?,?,00000001,?,?,00000000,?,00000002,?), ref: 6DF59680

Strings

VS_VERSION_INFO, xrefs: 6DF506DE

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$CompareString$HeaderImageInitStrings
String ID: VS_VERSION_INFO
API String ID: 1271209012-1537192461
Opcode ID: 5bd87cd80d86ec32339c2d0f73cfc05cbe8c7ca08f85bb0e9ca6ee4df8eb9feb
Instruction ID: 892b7f3867f3d903a4e92a86d7f02363e4f372dbf9fc6e0b8b3c97e05ca93493
Opcode Fuzzy Hash: 5bd87cd80d86ec32339c2d0f73cfc05cbe8c7ca08f85bb0e9ca6ee4df8eb9feb
Instruction Fuzzy Hash: FA51C231A002179AEB10CBBAFC50BFAB7B8EF64648F1445699A65DB1C0EBB0D811CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DF41390, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DF41390(void* __ebx, void* __edi, int __esi, void* __eflags) {
				signed int* _t46;
				signed int* _t47;
				void* _t51;
				int _t53;
				void* _t54;
				signed short* _t60;
				int _t63;
				void* _t65;
				void* _t71;
				signed int* _t74;
				signed int* _t75;
				int* _t76;
				int _t78;
				int _t81;
				void* _t83;
				void* _t84;

				_t82 = __esi;
				_push(0x44);
				_push(0x6e01f288);
				E6DF9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x50)) =  *((intOrPtr*)(_t83 + 8));
				_t78 =  *(_t83 + 0xc) & 0x0000ffff;
				 *(_t83 - 0x48) =  *(_t83 + 0x10);
				 *(_t83 - 0x4c) =  *(_t83 + 0x14);
				_t65 =  *(_t83 + 0x18);
				 *(_t83 - 0x44) =  *(_t83 + 0x1c);
				if(E6DF41783( *((intOrPtr*)(_t83 + 8))) == 0) {
					L13:
					return E6DF9D130(_t65, _t78, _t82);
				}
				 *(_t83 - 4) =  *(_t83 - 4) & 0x00000000;
				if(_t78 < 0xc000) {
					if(_t78 != 0) {
						_t82 = 0;
						 *((intOrPtr*)(_t83 - 0x40)) = 0;
						_t46 =  *(_t83 - 0x48);
						if(_t46 != 0) {
							 *_t46 = 1;
						}
						_t47 =  *(_t83 - 0x4c);
						if(_t47 != 0) {
							 *_t47 = 1;
						}
						if(_t65 == 0) {
							L12:
							 *(_t83 - 4) = 0xfffffffe;
							E6DF5FFB0(_t65, _t78,  *((intOrPtr*)(_t83 - 0x50)) + 8);
							goto L13;
						} else {
							_t51 = E6DF962E0(_t83 - 0x3c, 0x10, 0xffffffff, L"#%u", _t78);
							_t84 = _t84 + 0x14;
							_t78 = _t51 + _t51;
							_t53 =  *( *(_t83 - 0x44));
							if(_t78 >= _t53) {
								if(_t53 < 2) {
									_t78 = 0;
								} else {
									_t78 = _t53 - 2;
								}
							}
							if(_t78 == 0) {
								L33:
								_t82 = 0xc0000023;
								L34:
								 *((intOrPtr*)(_t83 - 0x40)) = _t82;
							} else {
								_t54 = _t83 - 0x3c;
								L11:
								memcpy(_t65, _t54, _t78);
								 *((short*)(_t65 + (_t78 >> 1) * 2)) = 0;
								 *( *(_t83 - 0x44)) = _t78;
							}
							goto L12;
						}
					}
					_t82 = 0xc000000d;
					goto L34;
				}
				_t82 = 0xc0000008;
				 *((intOrPtr*)(_t83 - 0x40)) = 0xc0000008;
				_t71 = E6DF41986( *((intOrPtr*)(_t83 - 0x50)), _t78 & 0x00003fff);
				if(_t71 == 0 ||  *((intOrPtr*)(_t71 + 6)) != _t78) {
					goto L12;
				} else {
					_t16 = _t71 + 8; // 0x8
					_t60 = _t16;
					if(_t60 == 0) {
						goto L12;
					}
					_t82 = 0;
					 *((intOrPtr*)(_t83 - 0x40)) = 0;
					_t74 =  *(_t83 - 0x48);
					if(_t74 != 0) {
						 *_t74 =  *_t60 & 0x0000ffff;
					}
					_t75 =  *(_t83 - 0x4c);
					if(_t75 != 0) {
						 *_t75 =  *(_t71 + 0xa) & 0x0000ffff;
					}
					if(_t65 == 0) {
						goto L12;
					} else {
						_t81 = ( *(_t71 + 0xc) & 0x000000ff) + ( *(_t71 + 0xc) & 0x000000ff);
						_t76 =  *(_t83 - 0x44);
						_t63 =  *_t76;
						if(_t81 >= _t63) {
							if(_t63 < 2) {
								 *_t76 = _t81;
								_t78 = 0;
							} else {
								_t78 = _t63 - 2;
							}
						}
						if(_t78 == 0) {
							goto L33;
						} else {
							_t22 = _t71 + 0xe; // 0xe
							_t54 = _t22;
							goto L11;
						}
					}
				}
			}

0x6df41390
0x6df41390
0x6df41392
0x6df41397
0x6df4139f
0x6df413a2
0x6df413a9
0x6df413af
0x6df413b2
0x6df413b8
0x6df413c2
0x6df41469
0x6df4146e
0x6df4146e
0x6df413c8
0x6df413d4
0x6df9ee5d
0x6df9ee69
0x6df9ee6b
0x6df9ee6e
0x6df9ee73
0x6df9ee75
0x6df9ee75
0x6df9ee7b
0x6df9ee80
0x6df9ee82
0x6df9ee82
0x6df9ee8a
0x6df41454
0x6df41454
0x6df41462
0x00000000
0x6df9ee90
0x6df9ee9e
0x6df9eea3
0x6df9eea8
0x6df9eead
0x6df9eeb1
0x6df9eeb6
0x6df9eebd
0x6df9eeb8
0x6df9eeb8
0x6df9eeb8
0x6df9eeb6
0x6df9eec1
0x6df9eee1
0x6df9eee1
0x6df9eefc
0x6df9eefc
0x6df9eec3
0x6df9eec3
0x6df4143a
0x6df4143d
0x6df4144b
0x6df41452
0x6df41452
0x00000000
0x6df9eec1
0x6df9ee8a
0x6df9ee5f
0x00000000
0x6df9ee5f
0x6df413da
0x6df413df
0x6df413f2
0x6df413f6
0x00000000
0x6df413fe
0x6df413fe
0x6df413fe
0x6df41403
0x00000000
0x00000000
0x6df41405
0x6df41407
0x6df4140a
0x6df4140f
0x6df41474
0x6df41474
0x6df41411
0x6df41416
0x6df4147c
0x6df4147c
0x6df4141a
0x00000000
0x6df4141c
0x6df41420
0x6df41422
0x6df41425
0x6df41429
0x6df9eece
0x6df9eed8
0x6df9eeda
0x6df9eed0
0x6df9eed0
0x6df9eed0
0x6df9eece
0x6df41431
0x00000000
0x6df41437
0x6df41437
0x6df41437
0x00000000
0x6df41437
0x6df41431
0x6df4141a

APIs

Part of subcall function 6DF41783: RtlAcquireSRWLockExclusive.9419(?,6DF413C0,6E01F288,00000044), ref: 6DF41793

RtlReleaseSRWLockExclusive.9419(?,6E01F288,00000044), ref: 6DF41462

Part of subcall function 6DF41986: RtlIsValidIndexHandle.9419(?,?,00000000,?,?,6DF413F2,6E01F288,00000044), ref: 6DF41995

memcpy.9419(?,0000000E,?,6E01F288,00000044), ref: 6DF4143D

Strings

#%u, xrefs: 6DF9EE91

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireHandleIndexReleaseValidmemcpy
String ID: #%u
API String ID: 1422088098-232158463
Opcode ID: 4a76489ca9ae5b2f61bd62b44fa31ffd61a363e67cfe1fc4e0ca180c10074797
Instruction ID: ffaea532bb58761e88f1d2776a031b956e5786d6a1e18ea36cc8a5d28d6be87a
Opcode Fuzzy Hash: 4a76489ca9ae5b2f61bd62b44fa31ffd61a363e67cfe1fc4e0ca180c10074797
Instruction Fuzzy Hash: 3741AD72E042268BEB11CF9CC8406AEBBB6BF86304F168019E914EF356D771DD42C750

Uniqueness

Uniqueness Score: -1.00%

Function 6DF417B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6DF417B0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				short _t23;
				intOrPtr _t24;
				short _t28;
				short _t40;
				void* _t41;
				short* _t43;
				intOrPtr* _t49;
				intOrPtr* _t51;
				intOrPtr _t52;
				void* _t53;

				_t41 = __ecx;
				_push(0x18);
				_push(0x6e01f2c8);
				E6DF9D08C(__ebx, __edi, __esi);
				_t49 =  *((intOrPtr*)(_t53 + 8));
				if(_t49 == 0 ||  *_t49 != 0x6d6f7441) {
					_t40 = 0;
					_t23 = 0;
				} else {
					E6DF62280(_t49 + 8, _t49 + 8);
					_t23 = 1;
					_t40 = 0;
				}
				if(_t23 == 0) {
					_t24 = 0xc000000d;
					goto L13;
				} else {
					 *((intOrPtr*)(_t53 - 4)) = _t40;
					_t51 =  *((intOrPtr*)(_t53 + 0xc));
					if(E6DF81310(_t51, _t53 - 0x1c) != 0) {
						_t28 =  *((intOrPtr*)(_t53 - 0x1c));
						if(_t28 < 0xc000) {
							_t52 = _t40;
						} else {
							_t28 = 0;
							 *((short*)(_t53 - 0x1c)) = 0;
							_t52 = 0xc000000d;
						}
						 *((intOrPtr*)(_t53 - 0x20)) = _t52;
						_t43 =  *((intOrPtr*)(_t53 + 0x10));
						if(_t43 == 0) {
							L12:
							 *((intOrPtr*)(_t53 - 4)) = 0xfffffffe;
							E6DF5FFB0(_t40, _t49, _t49 + 8);
							_t24 = _t52;
							L13:
							return E6DF9D0D1(_t24);
						}
						L11:
						 *_t43 = _t28;
						goto L12;
					}
					if( *_t51 == _t40) {
						_t52 = 0xc0000033;
						L15:
						 *((intOrPtr*)(_t53 - 0x20)) = _t52;
						goto L12;
					}
					_t52 = E6DF4187D(_t49, _t51, _t41, _t40, _t40, _t53 - 0x28, _t53 - 0x1c);
					 *((intOrPtr*)(_t53 - 0x20)) = _t52;
					if(_t52 < 0) {
						goto L12;
					}
					_t34 =  *((intOrPtr*)(_t53 - 0x1c));
					if( *((intOrPtr*)(_t53 - 0x1c)) == 0) {
						_t52 = 0xc0000034;
						goto L15;
					}
					if(E6DF41986(_t49,  *(_t34 + 4) & 0x0000ffff) == 0) {
						_t52 = 0xc0000008;
						goto L15;
					}
					_t52 = _t40;
					 *((intOrPtr*)(_t53 - 0x20)) = _t52;
					_t43 =  *((intOrPtr*)(_t53 + 0x10));
					if(_t43 == 0) {
						goto L12;
					}
					_t28 =  *((intOrPtr*)( *((intOrPtr*)(_t53 - 0x1c)) + 6));
					goto L11;
				}
			}

0x6df417b0
0x6df417b0
0x6df417b2
0x6df417b7
0x6df417bc
0x6df417c1
0x6df9ef6c
0x6df9ef6e
0x6df417d3
0x6df417d7
0x6df417dc
0x6df417de
0x6df417de
0x6df417e2
0x6df9ef75
0x00000000
0x6df417e8
0x6df417e8
0x6df417ef
0x6df417fa
0x6df9ef84
0x6df9ef8b
0x6df9ef9a
0x6df9ef8d
0x6df9ef8d
0x6df9ef8f
0x6df9ef93
0x6df9ef93
0x6df9ef9c
0x6df9ef9f
0x6df9efa4
0x6df41852
0x6df41852
0x6df4185d
0x6df41862
0x6df41864
0x6df41869
0x6df41869
0x6df4184f
0x6df4184f
0x00000000
0x6df4184f
0x6df41803
0x6df9efaf
0x6df41871
0x6df41871
0x00000000
0x6df41871
0x6df4181d
0x6df4181f
0x6df41824
0x00000000
0x00000000
0x6df41826
0x6df4182b
0x6df4186c
0x00000000
0x6df4186c
0x6df4183a
0x6df41876
0x00000000
0x6df41876
0x6df4183c
0x6df4183e
0x6df41841
0x6df41846
0x00000000
0x00000000
0x6df4184b
0x00000000
0x6df4184b

APIs

RtlAcquireSRWLockExclusive.9419(?,6E01F2C8,00000018), ref: 6DF417D7
RtlGetIntegerAtom.9419(?,?,?,6E01F2C8,00000018), ref: 6DF417F3

Part of subcall function 6DF4187D: _wcsicmp.9419(0000001C,?,?,?,00000000,?,?,?,?), ref: 6DF41921

RtlReleaseSRWLockExclusive.9419(?,?,?,?,6E01F2C8,00000018), ref: 6DF4185D

Part of subcall function 6DF41986: RtlIsValidIndexHandle.9419(?,?,00000000,?,?,6DF413F2,6E01F288,00000044), ref: 6DF41995

Strings

Atom, xrefs: 6DF417C7

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: 2c86cd76eb2fdcbb048ea579dcb6485062a95190744a04ee2d2f3c44f49f77fa
Instruction ID: 77d38e453e2d6262eea0a53e3a857eae3602cd2c679846ba76d597f2fa5b8de6
Opcode Fuzzy Hash: 2c86cd76eb2fdcbb048ea579dcb6485062a95190744a04ee2d2f3c44f49f77fa
Instruction Fuzzy Hash: 8731C13AD01216CBEB40CF9C8840AEEB7B9BF09704B01C16AE924EB205DB34CD5687A1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD4955, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E6DFD4955(void* __ecx, void* __edx, intOrPtr* _a4) {
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				intOrPtr _v104;
				intOrPtr _t36;
				intOrPtr _t38;
				signed char* _t41;
				void* _t44;
				void* _t49;
				intOrPtr _t54;
				intOrPtr* _t55;
				intOrPtr _t61;

				_v72 = 0xc00000e5;
				_t58 = 1;
				_t44 = __edx;
				_t61 = 0;
				_v68 = 0;
				E6DF71D47( &_v72,  &_v52, 0x30,  &_v56, 0x30, __edx, __ecx, 1,  &_v60,  &_v64);
				if(_v104 == 1) {
					_t36 =  *((intOrPtr*)(_t44 + 0x18));
					_t54 =  *((intOrPtr*)(_t36 + _t44 + 8));
					_t49 =  *((intOrPtr*)(_t36 + _t44 + 0xc)) + _t44;
					__eflags = 1 - _t54;
					if(__eflags < 0) {
						_t16 = _t49 + 0x18; // 0x116
						_t41 = _t16;
						while(1) {
							__eflags =  *_t41 & 0x00000002;
							if(( *_t41 & 0x00000002) != 0) {
								break;
							}
							_t58 = _t58 + 1;
							_t41 =  &(_t41[0x18]);
							__eflags = _t58 - _t54;
							if(_t58 < _t54) {
								continue;
							}
							break;
						}
						__eflags = _t58 - _t54;
					}
					if(__eflags != 0) {
						_t38 =  *((intOrPtr*)(_t58 * 0x18 + _t49 + 0x10));
						__eflags =  *((intOrPtr*)(_t38 + _t44)) - 0x6c;
						if( *((intOrPtr*)(_t38 + _t44)) == 0x6c) {
							_t55 = _a4;
							 *_t55 = _t61;
							_t24 = _t44 + 0x64; // 0x0
							 *((intOrPtr*)(_t55 + 4)) =  *((intOrPtr*)(_t38 + _t24));
							_t27 = _t44 + 0x68; // 0xfffffffe
							 *((intOrPtr*)(_t55 + 8)) =  *((intOrPtr*)(_t38 + _t27));
						} else {
							_push(_t44);
							_push("RtlpQueryRunLevel");
							_push("SXS: %s() found activation context data at %p with wrong format\n");
							goto L9;
						}
					} else {
						_push(_t44);
						_push("RtlpQueryRunLevel");
						_push("SXS: %s() found activation context data at %p with assembly roster that has no root\n");
						L9:
						_push(_t61);
						_push(0x33);
						E6DFD5720();
						_t61 = 0xc0150003;
					}
				} else {
					_t61 = _v72;
				}
				return _t61;
			}

0x6dfd4967
0x6dfd4977
0x6dfd497e
0x6dfd498e
0x6dfd4995
0x6dfd4999
0x6dfd49a4
0x6dfd49ae
0x6dfd49b5
0x6dfd49b9
0x6dfd49bb
0x6dfd49bd
0x6dfd49bf
0x6dfd49bf
0x6dfd49c2
0x6dfd49c2
0x6dfd49c5
0x00000000
0x00000000
0x6dfd49c7
0x6dfd49c8
0x6dfd49cb
0x6dfd49cd
0x00000000
0x00000000
0x00000000
0x6dfd49cd
0x6dfd49cf
0x6dfd49cf
0x6dfd49d1
0x6dfd49f3
0x6dfd49f7
0x6dfd49fb
0x6dfd4a0a
0x6dfd4a0d
0x6dfd4a0f
0x6dfd4a13
0x6dfd4a16
0x6dfd4a1a
0x6dfd49fd
0x6dfd49fd
0x6dfd49fe
0x6dfd4a03
0x00000000
0x6dfd4a03
0x6dfd49d3
0x6dfd49d3
0x6dfd49d4
0x6dfd49d9
0x6dfd49de
0x6dfd49de
0x6dfd49df
0x6dfd49e1
0x6dfd49e9
0x6dfd49e9
0x6dfd49a6
0x6dfd49a6
0x6dfd49aa
0x6dfd4a25

APIs

Part of subcall function 6DF71D47: memset.9419(00000000,00000000,6DF917F0,?,00000001,00000000,?,6DF48D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6DF71D87

DbgPrintEx.9419(00000033,00000000,SXS: %s() found activation context data at %p with wrong format,RtlpQueryRunLevel,?,?,00000030,?,00000030,?,?,00000001,?,?), ref: 6DFD49E1

Strings

SXS: %s() found activation context data at %p with wrong format, xrefs: 6DFD4A03
SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6DFD49D9
RtlpQueryRunLevel, xrefs: 6DFD49D4, 6DFD49FE

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemset
String ID: RtlpQueryRunLevel$SXS: %s() found activation context data at %p with assembly roster that has no root$SXS: %s() found activation context data at %p with wrong format
API String ID: 4188176266-4139752556
Opcode ID: 45574add489d0569e182ef570997c632393aa04e722b3bc8edfe0ce82af7390f
Instruction ID: 4b48f7c8cde7aea686c1444a5667b4bb2645f5874faa31f2743d6b6efa4a2376
Opcode Fuzzy Hash: 45574add489d0569e182ef570997c632393aa04e722b3bc8edfe0ce82af7390f
Instruction Fuzzy Hash: 7E21E772A043156FC325CF0DC880E5BB7EDEBC9358F0A865EF8555B246D630DD40CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E0040DC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
timeCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E6E0040DC(void* __ebx, intOrPtr* __ecx, signed int __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				char _t31;
				signed int _t57;
				void* _t62;

				_t59 = __edi;
				_push(0x1c);
				_push(0x6e020fe0);
				E6DF9D0E8(__ebx, __edi, __esi);
				_t47 = __edx;
				_t61 = __ecx;
				 *((intOrPtr*)(_t62 - 0x2c)) = __ecx;
				 *((char*)(_t62 - 0x1d)) = 0;
				 *((char*)(_t62 - 0x1e)) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t62 - 4) = 0;
					 *(_t62 - 4) = 1;
					_t31 = E6DF440E1("RtlSetUserValueHeap");
					__eflags = _t31;
					if(_t31 != 0) {
						_t47 = __edx |  *(__ecx + 0x44) | 0x10000000;
						 *(_t62 - 0x28) = _t47;
						__eflags = _t47 & 0x00000001;
						if((_t47 & 0x00000001) == 0) {
							L6DF5EEF0( *((intOrPtr*)(__ecx + 0xc8)));
							 *((char*)(_t62 - 0x1e)) = 1;
							_t47 = _t47 | 0x00000001;
							__eflags = _t47;
							 *(_t62 - 0x28) = _t47;
						}
						E6E004496(_t61, 0);
						_t59 =  *((intOrPtr*)(_t62 + 8));
						_t57 = _t59 - 8;
						__eflags =  *((char*)(_t57 + 7)) - 5;
						if( *((char*)(_t57 + 7)) == 5) {
							__eflags = _t57;
						}
						__eflags = E6DF43FC5(_t57, "RtlSetUserValueHeap");
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t62 + 0xc)));
							_push(_t59);
							_push(_t47);
							_push(_t61);
							 *((char*)(_t62 - 0x1d)) = E6DF41E50(_t47, _t59, _t61, __eflags);
							E6E004496(_t61, 0);
						}
					} else {
						 *((char*)(_t62 - 0x1d)) = _t31;
					}
					_t25 = _t62 - 4;
					 *_t25 =  *(_t62 - 4) & 0x00000000;
					__eflags =  *_t25;
					 *(_t62 - 4) = 0xfffffffe;
					E6E0041FD();
				} else {
					_t61 =  *0x6e035738; // 0x0
					 *0x6e03b1e0(__ecx, __edx,  *((intOrPtr*)(_t62 + 8)),  *((intOrPtr*)(_t62 + 0xc)));
					 *_t61();
				}
				return E6DF9D130(_t47, _t59, _t61);
			}

0x6e0040dc
0x6e0040dc
0x6e0040de
0x6e0040e3
0x6e0040e8
0x6e0040ea
0x6e0040ec
0x6e0040f1
0x6e0040f4
0x6e0040fe
0x6e00411d
0x6e004120
0x6e00412e
0x6e004133
0x6e004135
0x6e004147
0x6e004149
0x6e00414c
0x6e00414f
0x6e004157
0x6e00415c
0x6e004160
0x6e004160
0x6e004163
0x6e004163
0x6e00416a
0x6e00416f
0x6e004172
0x6e004175
0x6e004179
0x6e004182
0x6e004182
0x6e004190
0x6e004192
0x6e004194
0x6e004197
0x6e004198
0x6e004199
0x6e00419f
0x6e0041a6
0x6e0041a6
0x6e004137
0x6e004137
0x6e004137
0x6e0041e2
0x6e0041e2
0x6e0041e2
0x6e0041e6
0x6e0041ed
0x6e004100
0x6e004108
0x6e004110
0x6e004116
0x6e004116
0x6e0041fa

APIs

RtlDebugPrintTimes.9419(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6E020FE0), ref: 6E004110

Strings

RtlSetUserValueHeap, xrefs: 6E004127, 6E004184

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSetUserValueHeap
API String ID: 3446177414-1142157168
Opcode ID: f8e50c5485314e4b436c23cb12f46fc289ab6d27adec97cc4f75e9e4f3965462
Instruction ID: 3bdb5d15acef102e87f5a377be4f7d84395d4b63b98c99b22acc280d4191f074
Opcode Fuzzy Hash: f8e50c5485314e4b436c23cb12f46fc289ab6d27adec97cc4f75e9e4f3965462
Instruction Fuzzy Hash: B321C134904255AFEB11CFFCC8007DEBFB2AF65358F058058E5546B292CB314A4ACB98

Uniqueness

Uniqueness Score: -1.00%

Function 6E00387C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
timeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6E00387C(void* __ebx, intOrPtr* __ecx, signed int __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				char _t33;
				signed int _t57;
				void* _t61;

				_t58 = __edi;
				_push(0x1c);
				_push(0x6e020f20);
				E6DF9D0E8(__ebx, __edi, __esi);
				_t48 = __edx;
				_t60 = __ecx;
				 *((intOrPtr*)(_t61 - 0x2c)) = __ecx;
				 *((char*)(_t61 - 0x1d)) = 0;
				 *((char*)(_t61 - 0x1e)) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t61 - 4) = 0;
					 *(_t61 - 4) = 1;
					_t33 = E6DF440E1("RtlGetUserInfoHeap");
					__eflags = _t33;
					if(_t33 != 0) {
						_t48 = __edx |  *(__ecx + 0x44) | 0x10000000;
						 *(_t61 - 0x28) = _t48;
						__eflags = _t48 & 0x00000001;
						if((_t48 & 0x00000001) == 0) {
							L6DF5EEF0( *((intOrPtr*)(__ecx + 0xc8)));
							 *((char*)(_t61 - 0x1e)) = 1;
							_t48 = _t48 | 0x00000001;
							__eflags = _t48;
							 *(_t61 - 0x28) = _t48;
						}
						E6E004496(_t60, 0);
						_t58 =  *((intOrPtr*)(_t61 + 8));
						_t57 = _t58 - 8;
						__eflags =  *((char*)(_t57 + 7)) - 5;
						if( *((char*)(_t57 + 7)) == 5) {
							__eflags = _t57;
						}
						__eflags = E6DF43FC5(_t57, "RtlGetUserInfoHeap");
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t61 + 0x10)));
							_push( *((intOrPtr*)(_t61 + 0xc)));
							_push(_t58);
							_push(_t48);
							_push(_t60);
							 *((char*)(_t61 - 0x1d)) = E6DF41C70(_t48, _t58, _t60, __eflags);
						}
					} else {
						 *((char*)(_t61 - 0x1d)) = _t33;
					}
					_t27 = _t61 - 4;
					 *_t27 =  *(_t61 - 4) & 0x00000000;
					__eflags =  *_t27;
					 *(_t61 - 4) = 0xfffffffe;
					E6E00399A();
				} else {
					_t60 =  *0x6e03573c; // 0x0
					 *0x6e03b1e0(__ecx, __edx,  *((intOrPtr*)(_t61 + 8)),  *((intOrPtr*)(_t61 + 0xc)),  *((intOrPtr*)(_t61 + 0x10)));
					 *_t60();
				}
				return E6DF9D130(_t48, _t58, _t60);
			}

0x6e00387c
0x6e00387c
0x6e00387e
0x6e003883
0x6e003888
0x6e00388a
0x6e00388c
0x6e003891
0x6e003894
0x6e00389e
0x6e0038c0
0x6e0038c3
0x6e0038d1
0x6e0038d6
0x6e0038d8
0x6e0038ea
0x6e0038ec
0x6e0038ef
0x6e0038f2
0x6e0038fa
0x6e0038ff
0x6e003903
0x6e003903
0x6e003906
0x6e003906
0x6e00390d
0x6e003912
0x6e003915
0x6e003918
0x6e00391c
0x6e003925
0x6e003925
0x6e003933
0x6e003935
0x6e003937
0x6e00393a
0x6e00393d
0x6e00393e
0x6e00393f
0x6e003945
0x6e003945
0x6e0038da
0x6e0038da
0x6e0038da
0x6e00397f
0x6e00397f
0x6e00397f
0x6e003983
0x6e00398a
0x6e0038a0
0x6e0038ab
0x6e0038b3
0x6e0038b9
0x6e0038b9
0x6e003997

APIs

RtlDebugPrintTimes.9419(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6E020F20), ref: 6E0038B3

Strings

RtlGetUserInfoHeap, xrefs: 6E0038CA, 6E003927

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlGetUserInfoHeap
API String ID: 3446177414-1656697243
Opcode ID: 1eee1dec57d784b55682e4a0dd2db97a8d9f17dea82bf5c11acd2d78550478c0
Instruction ID: 38d111e9a3e7f328eeaa9f3350ff8872d4de09e0d01d261e5964db3e7e1a13d1
Opcode Fuzzy Hash: 1eee1dec57d784b55682e4a0dd2db97a8d9f17dea82bf5c11acd2d78550478c0
Instruction Fuzzy Hash: 2B21D330908259AFEF02CFECC904BDEBFB1AF49358F058448E5946B296C7754A55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DFC3E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DFC3E13(void* __ecx, wchar_t* __edx) {
				wchar_t* _v8;
				long _t4;
				void* _t8;
				long _t21;
				wchar_t* _t23;

				_push(__ecx);
				_t23 = __edx;
				_t8 = __ecx;
				_t4 = wcschr(__edx, 0x2c);
				if(_t4 != 0) {
					 *_t4 = 0;
					_t4 = wcstoul(_t4 + 2,  &_v8, 0x10);
					_t21 = _t4;
					if(_t21 != 0) {
						_push(_t21);
						_push(_t8 + 0x24);
						E6DFD5720(0x55, 3, "CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X\n", _t23);
						_t4 = E6DFC3C93( *((intOrPtr*)(_t8 + 0x18)), _t23, _t21);
					}
				}
				return _t4;
			}

0x6dfc3e18
0x6dfc3e1c
0x6dfc3e1e
0x6dfc3e23
0x6dfc3e2c
0x6dfc3e30
0x6dfc3e3d
0x6dfc3e42
0x6dfc3e49
0x6dfc3e4b
0x6dfc3e4f
0x6dfc3e5a
0x6dfc3e68
0x6dfc3e68
0x6dfc3e49
0x6dfc3e73

APIs

wcschr.9419(?,0000002C,?,?,00000000,?,?,6DFA060B), ref: 6DFC3E23
wcstoul.9419(-00000002,6DFA060B,00000010,?,?,00000000,?,?,6DFA060B), ref: 6DFC3E3D
DbgPrintEx.9419(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6DFA060B), ref: 6DFC3E5A

Part of subcall function 6DFC3C93: wcschr.9419(?,0000003D,00000000,?), ref: 6DFC3CAC
Part of subcall function 6DFC3C93: RtlInitUnicodeString.9419(?,-00000002,00000000,?), ref: 6DFC3CD0
Part of subcall function 6DFC3C93: RtlAnsiStringToUnicodeString.9419(?,?,00000001,00000000,?), ref: 6DFC3D72
Part of subcall function 6DFC3C93: RtlCompareUnicodeString.9419(?,?,00000001,?,?,00000001,00000000,?), ref: 6DFC3D89
Part of subcall function 6DFC3C93: RtlFreeUnicodeString.9419(?,00000000,?), ref: 6DFC3DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6DFC3E51

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: 2ed217fb2ba494080161607effae7e107ccba95f48d66a117146540d20cd396d
Instruction ID: 7e50c1fd6064355bbd8ee78fbca6b33ec70e70e3c38584dda06553b876255694
Opcode Fuzzy Hash: 2ed217fb2ba494080161607effae7e107ccba95f48d66a117146540d20cd396d
Instruction Fuzzy Hash: 20F02B3260420536E718535DEC47FBB379CCF866A0F11016DFA1C9B281EE62DD1082F1

Uniqueness

Uniqueness Score: -1.00%

Function 6DF41FA1, Relevance: 6.3, APIs: 4, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6DF41FA1(unsigned int __ecx, signed int __edx, signed int _a4, void* _a8, signed int* _a12, char _a16) {
				signed int _v8;
				void _v1036;
				char _v2068;
				char _v2069;
				signed int _v2076;
				signed int _v2080;
				void* _v2084;
				signed int _v2088;
				signed int _v2092;
				signed char _v2096;
				signed int _v2100;
				signed int _v2104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t86;
				signed int _t87;
				signed int _t92;
				signed int _t95;
				signed int _t97;
				signed int _t100;
				void* _t104;
				signed int _t106;
				void* _t110;
				signed int _t112;
				signed int _t123;
				signed int* _t126;
				unsigned int _t127;
				signed int _t134;
				void* _t137;
				void* _t139;
				signed int _t142;
				signed int _t151;
				signed int _t153;
				signed int _t160;
				signed int _t162;

				_t146 = __edx;
				_t127 = __ecx;
				_v8 =  *0x6e03d360 ^ _t153;
				_t86 = _a8;
				_v2080 = __edx;
				_v2084 = _t86;
				_t126 = _a12;
				_t151 = _a4;
				if(__edx == 0 || _t151 < 0xffffffff || _t126 == 0) {
					L25:
					_t87 = 0xc000000d;
					goto L20;
				} else {
					_t149 =  *_t126;
					_v2088 = _t149;
					_t160 = _t149;
					if(_t160 < 0 || _t160 > 0 && _t86 == 0) {
						goto L25;
					} else {
						_t162 = _t127 & 0xfffffff8;
						if(_t162 != 0) {
							goto L25;
						}
						_v2069 = 0;
						_v2104 = _t127 & 0x00000001;
						_t92 = _t127 & 0x00000004;
						_v2092 = _t92;
						_t93 = _t92 & 0xffffff00 | _t162 != 0x00000000;
						_t131 = _t127 >> 0x00000001 & 0x00000001;
						_v2100 = _t92 & 0xffffff00 | _t162 != 0x00000000;
						_v2096 = _t127 >> 0x00000001 & 0x00000001;
						if(_t151 == 0xffffffff) {
							_t146 = 0x7fffffff;
							_t95 = E6DF5347D(_v2080, 0x7fffffff,  &_v2076);
							__eflags = _t95;
							if(_t95 < 0) {
								goto L25;
							}
							_t146 = _v2080;
							_t151 = _v2076 + 1;
							_t93 = _v2100;
							_t131 = _v2096;
						}
						if(_t151 > 0) {
							_t149 = _v2088;
							if( *((intOrPtr*)(_t146 + _t151 * 2 - 2)) == 0) {
								_v2069 = 1;
								_t151 = _t151 - 1;
							}
						}
						_t146 = _t151;
						if(E6DF4211D(_v2080, _t151, _t93, _t131) == 0) {
							_t97 = 0x1ff;
							_t134 = 0;
							_t149 = 0;
							_t146 =  &_v1036;
							__eflags = _v2092;
							if(_v2092 == 0) {
								L32:
								__eflags = _t134 - _t151;
								if(_t134 >= _t151) {
									L36:
									__eflags = _t149;
									if(_t149 <= 0) {
										L40:
										_v2076 = 0x203;
										_t146 = _t149;
										_t87 = E6DFF8061( &_v1036, _t149,  &_v2068,  &_v2076, _v2100, _v2096);
										_t151 = _v2076;
										__eflags = _t151;
										if(_t151 == 0) {
											goto L74;
										}
										__eflags = _a16;
										if(_a16 == 0) {
											L64:
											__eflags = _v2069;
											if(_v2069 == 0) {
												L68:
												_t137 = _v2084;
												__eflags = _t137;
												if(_t137 == 0) {
													L72:
													 *_t126 = _t149;
													goto L19;
												}
												_t100 = _v2088;
												__eflags = _t100;
												if(_t100 == 0) {
													goto L72;
												}
												__eflags = _t149 - _t100;
												if(_t149 > _t100) {
													goto L73;
												}
												memcpy(_t137,  &_v1036, _t149 + _t149);
												goto L72;
											}
											__eflags = _t149 - 0x1ff;
											if(_t149 > 0x1ff) {
												L57:
												_t87 = 0xc0000716;
												goto L74;
											}
											_t104 = _t149 + _t149;
											_t149 = _t149 + 1;
											__eflags = _t104 - 0x3fe;
											if(_t104 >= 0x3fe) {
												L63:
												E6DF8B75A();
												goto L64;
											}
											__eflags = 0;
											 *((short*)(_t153 + _t104 - 0x408)) = 0;
											goto L68;
										}
										__eflags = _v2069;
										if(_v2069 == 0) {
											L46:
											_t139 = _v2084;
											__eflags = _t139;
											if(_t139 == 0) {
												goto L18;
											}
											_t106 = _v2088;
											__eflags = _t106;
											if(_t106 == 0) {
												goto L18;
											}
											__eflags = _t151 - _t106;
											if(_t151 > _t106) {
												goto L73;
											}
											_push(_t151 + _t151);
											_push( &_v2068);
											goto L17;
										}
										__eflags = _t151 - 0x203;
										if(_t151 >= 0x203) {
											goto L57;
										}
										_t110 = _t151 + _t151;
										_t151 = _t151 + 1;
										__eflags = _t110 - 0x406;
										if(_t110 >= 0x406) {
											goto L63;
										}
										__eflags = 0;
										 *((short*)(_t153 + _t110 - 0x810)) = 0;
										goto L46;
									}
									_t146 =  *(_t153 + _t149 * 2 - 0x40a) & 0x0000ffff;
									__eflags = _t146 - 0x2e;
									if(_t146 != 0x2e) {
										L39:
										__eflags = _t146;
										if(_t146 == 0) {
											goto L57;
										}
										goto L40;
									}
									_t112 = E6DFF7F39( *((intOrPtr*)(_v2080 + _t151 * 2 - 2)));
									__eflags = _t112;
									if(_t112 == 0) {
										goto L57;
									}
									goto L39;
								}
								_v2076 = _t97;
								_t87 = E6DFFB140(_t134, ((_v2104 & 0x000000ff ^ 0x00000001) << 8) + 0xd, _v2080 + _t134 * 2, _t151 - _t134, _t146,  &_v2076);
								_t142 = _v2076;
								__eflags = _t87;
								if(__eflags < 0) {
									L59:
									if(__eflags == 0) {
										goto L57;
									}
									__eflags = _t87 - 0xc0000023;
									if(_t87 == 0xc0000023) {
										goto L57;
									}
									__eflags = _t87 - 0xc0000717;
									if(_t87 == 0xc0000717) {
										goto L57;
									}
									__eflags = _t142;
									L56:
									if(__eflags <= 0) {
										goto L74;
									}
									goto L57;
								}
								__eflags = _t142;
								if(_t142 == 0) {
									__eflags = _t87;
									goto L59;
								}
								_t149 = _t149 + _t142;
								__eflags = _t149;
								goto L36;
							}
							_t149 = _v2080;
							_t146 = _t151;
							_t123 = E6DFF7EC9(_v2080, _t151);
							_v2092 = _t123;
							__eflags = _t123;
							if(_t123 == 0) {
								goto L57;
							}
							_v2076 = 0x1ff;
							_t87 = E6DFFB140( &_v1036, 1, _t149, _t123,  &_v1036,  &_v2076);
							_t149 = _v2076;
							__eflags = _t87;
							if(__eflags < 0) {
								L51:
								if(__eflags == 0) {
									goto L57;
								}
								__eflags = _t87 - 0xc0000023;
								if(_t87 == 0xc0000023) {
									goto L57;
								}
								__eflags = _t87 - 0xc0000717;
								if(_t87 == 0xc0000717) {
									goto L57;
								}
								__eflags = _t149;
								goto L56;
							}
							__eflags = _t149;
							if(_t149 == 0) {
								__eflags = _t87;
								goto L51;
							}
							_t134 = _v2092;
							_t146 =  &_v1036 + _t149 * 2;
							_t97 = 0x1ff - _t149;
							__eflags = 0x1ff;
							goto L32;
						} else {
							if(_t151 == 0) {
								_t87 = 0xc0000716;
								L20:
								return E6DF8B640(_t87, _t126, _v8 ^ _t153, _t146, _t149, _t151);
							}
							if(_v2069 != 0) {
								_t151 = _t151 + 1;
							}
							_t139 = _v2084;
							if(_t139 == 0 || _t149 == 0) {
								L18:
								 *_t126 = _t151;
								L19:
								_t87 = 0;
								goto L20;
							} else {
								if(_t151 > _t149) {
									L73:
									_t87 = 0xc0000023;
									L74:
									 *_t126 = 0;
									goto L20;
								}
								_push(_t151 + _t151);
								_push(_v2080);
								L17:
								memcpy(_t139, ??, ??);
								goto L18;
							}
						}
					}
				}
			}

0x6df41fa1
0x6df41fa1
0x6df41fb3
0x6df41fb6
0x6df41fb9
0x6df41fbf
0x6df41fc6
0x6df41fca
0x6df41fd0
0x6df42116
0x6df42116
0x00000000
0x6df41fe7
0x6df41fe7
0x6df41fe9
0x6df41fef
0x6df41ff1
0x00000000
0x6df42001
0x6df42001
0x6df42007
0x00000000
0x00000000
0x6df4200f
0x6df42019
0x6df42021
0x6df42024
0x6df4202a
0x6df4202f
0x6df42032
0x6df42038
0x6df42041
0x6df420d7
0x6df420dc
0x6df420e1
0x6df420e3
0x00000000
0x00000000
0x6df420eb
0x6df420f1
0x6df420f2
0x6df420f8
0x6df420f8
0x6df42049
0x6df42052
0x6df42058
0x6df42103
0x6df4210a
0x6df4210a
0x6df42058
0x6df42065
0x6df4206f
0x6df9f32f
0x6df9f334
0x6df9f336
0x6df9f338
0x6df9f33e
0x6df9f344
0x6df9f3b0
0x6df9f3b0
0x6df9f3b2
0x6df9f401
0x6df9f401
0x6df9f403
0x6df9f433
0x6df9f43f
0x6df9f44f
0x6df9f45f
0x6df9f464
0x6df9f46a
0x6df9f46c
0x00000000
0x00000000
0x6df9f472
0x6df9f476
0x6df9f510
0x6df9f510
0x6df9f517
0x6df9f536
0x6df9f536
0x6df9f53c
0x6df9f53e
0x6df9f562
0x6df9f562
0x00000000
0x6df9f562
0x6df9f540
0x6df9f546
0x6df9f548
0x00000000
0x00000000
0x6df9f54a
0x6df9f54c
0x00000000
0x00000000
0x6df9f55a
0x00000000
0x6df9f55f
0x6df9f519
0x6df9f51f
0x6df9f4f0
0x6df9f4f0
0x00000000
0x6df9f4f0
0x6df9f521
0x6df9f524
0x6df9f525
0x6df9f52a
0x6df9f50b
0x6df9f50b
0x00000000
0x6df9f50b
0x6df9f52c
0x6df9f52e
0x00000000
0x6df9f52e
0x6df9f47c
0x6df9f483
0x6df9f4a2
0x6df9f4a2
0x6df9f4a8
0x6df9f4aa
0x00000000
0x00000000
0x6df9f4b0
0x6df9f4b6
0x6df9f4b8
0x00000000
0x00000000
0x6df9f4be
0x6df9f4c0
0x00000000
0x00000000
0x6df9f4c9
0x6df9f4d0
0x00000000
0x6df9f4d0
0x6df9f485
0x6df9f48b
0x00000000
0x00000000
0x6df9f48d
0x6df9f490
0x6df9f491
0x6df9f496
0x00000000
0x00000000
0x6df9f498
0x6df9f49a
0x00000000
0x6df9f49a
0x6df9f405
0x6df9f40d
0x6df9f410
0x6df9f42a
0x6df9f42a
0x6df9f42d
0x00000000
0x00000000
0x00000000
0x6df9f42d
0x6df9f41d
0x6df9f422
0x6df9f424
0x00000000
0x00000000
0x00000000
0x6df9f424
0x6df9f3b4
0x6df9f3e4
0x6df9f3e9
0x6df9f3ef
0x6df9f3f1
0x6df9f4f9
0x6df9f4f9
0x00000000
0x00000000
0x6df9f4fb
0x6df9f500
0x00000000
0x00000000
0x6df9f502
0x6df9f507
0x00000000
0x00000000
0x6df9f4ec
0x6df9f4ee
0x6df9f4ee
0x00000000
0x00000000
0x00000000
0x6df9f4ee
0x6df9f3f7
0x6df9f3f9
0x6df9f4f7
0x00000000
0x6df9f4f7
0x6df9f3ff
0x6df9f3ff
0x00000000
0x6df9f3ff
0x6df9f346
0x6df9f34c
0x6df9f350
0x6df9f355
0x6df9f35b
0x6df9f35d
0x00000000
0x00000000
0x6df9f369
0x6df9f37f
0x6df9f384
0x6df9f38a
0x6df9f38c
0x6df9f4d8
0x6df9f4d8
0x00000000
0x00000000
0x6df9f4da
0x6df9f4df
0x00000000
0x00000000
0x6df9f4e1
0x6df9f4e6
0x00000000
0x00000000
0x6df9f4e8
0x00000000
0x6df9f4e8
0x6df9f392
0x6df9f394
0x6df9f4d6
0x00000000
0x6df9f4d6
0x6df9f39a
0x6df9f3ab
0x6df9f3ae
0x6df9f3ae
0x00000000
0x6df42075
0x6df42077
0x6df9f323
0x6df420b7
0x6df420c7
0x6df420c7
0x6df42084
0x6df42110
0x6df42110
0x6df4208a
0x6df42092
0x6df420b3
0x6df420b3
0x6df420b5
0x6df420b5
0x00000000
0x6df42098
0x6df4209a
0x6df9f569
0x6df9f569
0x6df9f56e
0x6df9f570
0x00000000
0x6df9f570
0x6df420a3
0x6df420a4
0x6df420aa
0x6df420ab
0x00000000
0x6df420b0
0x6df42092
0x6df4206f
0x6df41ff1

APIs

memcpy.9419(?,?,00000000,?,?,?), ref: 6DF420AB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d24b2bff04d4087b8785a7e2765b018ffa9df7bd08d10288ca7b820aa4232401
Instruction ID: f99c51ca3faa1fb3987fcac4eafc2cb686c2a9e4914348f216acfb5db02cdced
Opcode Fuzzy Hash: d24b2bff04d4087b8785a7e2765b018ffa9df7bd08d10288ca7b820aa4232401
Instruction Fuzzy Hash: 16A17E71E0411A9BEB65CA1CC840BFA76F8BF88314F15C1B9A999D7241DB359E82CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF411E0, Relevance: 6.2, APIs: 4, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6DF411E0(signed short* _a4, signed int _a8, signed short** _a12, signed int* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				char _v25;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t55;
				signed int _t56;
				signed int _t57;
				long _t58;
				void* _t60;
				signed int _t64;
				signed int _t65;
				signed short _t67;
				signed int _t74;
				signed int _t80;
				int _t81;
				signed int _t82;
				signed short** _t86;
				signed int _t88;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				signed char _t94;
				signed char _t97;
				signed int _t102;
				void* _t109;
				long _t116;
				signed int _t119;
				signed short* _t122;
				signed short* _t123;
				signed int _t124;

				_v8 =  *0x6e03d360 ^ _t124;
				_t86 = _a12;
				_t122 = _a4;
				_v48 = _a16;
				_t119 =  &_v24;
				do {
					_v36 = _v36 & 0x00000000;
					_v25 = 0;
					_v32 = 0xa;
					if( *_t122 == 0x30) {
						_t123 =  &(_t122[1]);
						_t55 =  *_t123 & 0x0000ffff;
						if(_t55 >= 0x80 || iswctype(_t55, 4) == 0) {
							_t56 =  *_t123 & 0x0000ffff;
							if(_t56 == 0x78 || _t56 == 0x58) {
								_t57 = 0x10;
								_v32 = _t57;
								_t123 =  &(_t123[1]);
								goto L3;
							} else {
								_v25 = 1;
								goto L2;
							}
						} else {
							_t57 = 8;
							_v32 = _t57;
							goto L3;
						}
						L59:
					} else {
						L2:
						_t57 = _v32;
					}
					L3:
					_t115 = _a8;
					if(_a8 != 0) {
						if(_t57 == 0xa) {
							goto L4;
						} else {
							goto L13;
						}
					} else {
						L4:
						_t58 =  *_t123 & 0x0000ffff;
						_v40 = _t58;
						if(_t58 == 0) {
							_t88 = _v36;
							_t115 = _v25;
							goto L11;
						} else {
							do {
								_t116 = 0x80;
								if(_t58 >= 0x80) {
									_t102 = _v32;
									goto L8;
								} else {
									_t81 = iswctype(_t58, 4);
									_t102 = _v32;
									_t58 = _v40;
									if(_t81 != 0) {
										_t82 = _t58 & 0x0000ffff;
										_v44 = _t82;
										if(_t82 + 0xffffffd0 >= _t102) {
											_t58 = _v40;
											goto L7;
										} else {
											_t115 = _v36;
											_t80 = _v32 * _t115;
											_t109 = _v44 + 0xffffffd0;
											goto L32;
										}
									} else {
										L7:
										_t116 = 0x80;
										L8:
										if(_t102 == 0x10) {
											if(_t58 >= _t116 || iswctype(_t58, _t116) == 0) {
												goto L9;
											} else {
												_t74 = iswctype(_v40, 2);
												_t115 = _v36;
												asm("sbb eax, eax");
												_t109 = (_t115 << 4) - ( ~_t74 & 0x00000020) + 0x41;
												_t80 = (_v40 & 0x0000ffff) + 0xa;
												L32:
												_t88 = _t109 + _t80;
												if(_t88 < _t115) {
													goto L13;
												} else {
													goto L33;
												}
											}
										} else {
											L9:
											_t88 = _v36;
											L10:
											_t115 = _a8;
											L11:
											if( *_t123 == 0x2e) {
												if(_t119 >=  &_v12) {
													goto L13;
												} else {
													goto L36;
												}
											} else {
												if(_t115 != 0) {
													 *_t119 = _t88;
													_t119 = _t119 -  &_v24 + 4 >> 2;
													if(_t115 == 0 || _t119 == 4) {
														_t119 = _t119 - 1;
														if(_t119 == 0) {
															_t91 = _v24;
															goto L58;
														} else {
															_t119 = _t119 - 1;
															if(_t119 == 0) {
																_t92 = _v24;
																if(_t92 > 0xff) {
																	goto L13;
																} else {
																	_t64 = _v20;
																	_t115 = 0xffffff;
																	if(_t64 > 0xffffff) {
																		goto L13;
																	} else {
																		_t93 = _t92 << 0x18;
																		_t65 = _t64 & 0x00ffffff;
																		goto L56;
																	}
																}
															} else {
																_t119 = _t119 - 1;
																if(_t119 == 0) {
																	_t115 = _v24;
																	if(_t115 > 0xff) {
																		goto L13;
																	} else {
																		_t94 = _v20;
																		if(_t94 > 0xff) {
																			goto L13;
																		} else {
																			_t67 = _v16;
																			if(_t67 > 0xffff) {
																				goto L13;
																			} else {
																				_t115 = _t115 << 8;
																				_t65 = _t67 & 0x0000ffff;
																				_t93 = (_t94 & 0x000000ff | _t115) << 0x10;
																				goto L56;
																			}
																		}
																	}
																} else {
																	if(_t119 != 0) {
																		goto L13;
																	} else {
																		_t115 = _v24;
																		if(_t115 > 0xff) {
																			goto L13;
																		} else {
																			_t97 = _v20;
																			if(_t97 > 0xff || _v16 > 0xff || _v12 > 0xff) {
																				goto L13;
																			} else {
																				_t93 = ((_t97 & 0x000000ff | _t115) << 0x00000008 | _v16 & 0x000000ff) << 8;
																				_t65 = _v12 & 0x000000ff;
																				L56:
																				_t91 = _t93 | _t65;
																				L58:
																				asm("bswap ecx");
																				 *_t86 = _t123;
																				 *_v48 = _t91;
																				_t60 = 0;
																			}
																		}
																	}
																}
															}
														}
													} else {
														goto L13;
													}
												} else {
													L13:
													 *_t86 = _t123;
													_t60 = 0xc000000d;
												}
											}
										}
									}
								}
								goto L14;
								L33:
								_t123 =  &(_t123[1]);
								_v36 = _t88;
								_v25 = 1;
								_t58 =  *_t123 & 0x0000ffff;
								_v40 = _t58;
							} while (_t58 != 0);
							goto L10;
						}
					}
					L14:
					return E6DF8B640(_t60, _t86, _v8 ^ _t124, _t115, _t119, _t123);
					goto L59;
					L36:
					 *_t119 = _t88;
					_t122 =  &(_t123[1]);
					_t119 = _t119 + 4;
				} while (_t115 != 0);
				goto L13;
			}

0x6df411ef
0x6df411f6
0x6df411fa
0x6df411fe
0x6df41201
0x6df41204
0x6df41209
0x6df41211
0x6df41215
0x6df4121c
0x6df9ec5c
0x6df9ec5f
0x6df9ec65
0x6df9ec80
0x6df9ec86
0x6df9ec98
0x6df9ec99
0x6df9ec9c
0x00000000
0x6df9ec8d
0x6df9ec8d
0x00000000
0x6df9ec8d
0x6df9ec75
0x6df9ec77
0x6df9ec78
0x00000000
0x6df9ec78
0x00000000
0x6df41222
0x6df41222
0x6df41222
0x6df41222
0x6df41225
0x6df41225
0x6df4122a
0x6df4129f
0x00000000
0x6df412a1
0x00000000
0x6df412a1
0x6df4122c
0x6df4122c
0x6df4122c
0x6df4122f
0x6df41235
0x6df412a8
0x6df412ab
0x00000000
0x6df41237
0x6df41237
0x6df41237
0x6df4123f
0x6df412a3
0x00000000
0x6df41241
0x6df41244
0x6df4124b
0x6df41250
0x6df41253
0x6df9eca4
0x6df9eca7
0x6df9ecaf
0x6df9ecc2
0x00000000
0x6df9ecb1
0x6df9ecb4
0x6df9ecba
0x6df9ecbd
0x00000000
0x6df9ecbd
0x6df41259
0x6df41259
0x6df41259
0x6df4125e
0x6df41261
0x6df9eccd
0x00000000
0x6df9ece4
0x6df9ecea
0x6df9ecef
0x6df9ecf5
0x6df9ed03
0x6df9ed0b
0x6df9ed0e
0x6df9ed0e
0x6df9ed12
0x00000000
0x00000000
0x00000000
0x00000000
0x6df9ed12
0x6df41267
0x6df41267
0x6df4126a
0x6df4126d
0x6df4126d
0x6df41270
0x6df41274
0x6df9ed3c
0x00000000
0x00000000
0x00000000
0x00000000
0x6df4127a
0x6df4127c
0x6df9ed57
0x6df9ed61
0x6df9ed66
0x6df9ed71
0x6df9ed74
0x6df9ee3d
0x00000000
0x6df9ed7a
0x6df9ed7a
0x6df9ed7d
0x6df9ee15
0x6df9ee1e
0x00000000
0x6df9ee24
0x6df9ee24
0x6df9ee27
0x6df9ee2e
0x00000000
0x6df9ee34
0x6df9ee34
0x6df9ee37
0x00000000
0x6df9ee37
0x6df9ee2e
0x6df9ed83
0x6df9ed83
0x6df9ed86
0x6df9eddc
0x6df9ede6
0x00000000
0x6df9edec
0x6df9edec
0x6df9edf1
0x00000000
0x6df9edf7
0x6df9edf7
0x6df9edff
0x00000000
0x6df9ee05
0x6df9ee08
0x6df9ee0d
0x6df9ee10
0x00000000
0x6df9ee10
0x6df9edff
0x6df9edf1
0x6df9ed88
0x6df9ed8b
0x00000000
0x6df9ed91
0x6df9ed91
0x6df9ed9b
0x00000000
0x6df9eda1
0x6df9eda1
0x6df9eda6
0x00000000
0x6df9edbe
0x6df9edd4
0x6df9edd7
0x6df9ee39
0x6df9ee39
0x6df9ee40
0x6df9ee43
0x6df9ee45
0x6df9ee47
0x6df9ee49
0x6df9ee49
0x6df9eda6
0x6df9ed9b
0x6df9ed8b
0x6df9ed86
0x6df9ed7d
0x00000000
0x00000000
0x00000000
0x6df41282
0x6df41282
0x6df41282
0x6df41284
0x6df41284
0x6df4127c
0x6df41274
0x6df41261
0x6df41253
0x00000000
0x6df9ed18
0x6df9ed18
0x6df9ed1b
0x6df9ed20
0x6df9ed23
0x6df9ed26
0x6df9ed29
0x00000000
0x6df9ed32
0x6df41235
0x6df41289
0x6df41299
0x00000000
0x6df9ed42
0x6df9ed42
0x6df9ed44
0x6df9ed47
0x6df9ed4a
0x00000000

APIs

iswctype.9419(0000000A,00000004), ref: 6DF41244
iswctype.9419(00000000,00000004), ref: 6DF9EC6A

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype
String ID:
API String ID: 304682654-0
Opcode ID: 68315f96be15a526ef51a9a8f02f1dd83189852d2fd7f95bf1dcac36f1e01a9f
Instruction ID: 668b4ca40b1475482ace622cf06454c4826ee6d745eedc660b0b35511b2975a6
Opcode Fuzzy Hash: 68315f96be15a526ef51a9a8f02f1dd83189852d2fd7f95bf1dcac36f1e01a9f
Instruction Fuzzy Hash: 4971B272E0411A8BEB18CEACD8917BEBBF1BF45310F10852ADC91EB385D7399A51C761

Uniqueness

Uniqueness Score: -1.00%

Function 6DF41E50, Relevance: 6.2, APIs: 4, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6DF41E50(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t78;
				unsigned int* _t79;
				intOrPtr _t84;
				signed int _t86;
				signed char _t91;
				signed char _t101;
				signed int _t110;
				signed char _t120;
				unsigned int _t130;
				intOrPtr _t136;
				void* _t142;
				void* _t143;

				_t137 = __esi;
				_push(0x18);
				_push(0x6e01f330);
				E6DF9D08C(__ebx, __edi, __esi);
				_t136 =  *((intOrPtr*)(_t143 + 8));
				 *((intOrPtr*)(_t143 - 0x28)) = _t136;
				_t106 = 0;
				 *((char*)(_t143 - 0x19)) = 0;
				if( *((intOrPtr*)(_t136 + 8)) == 0xddeeddee) {
					 *(_t143 - 0x24) = E6DFF2E4E( *(_t143 + 0xc));
					_t110 =  *(_t136 + 0x28);
					__eflags = _t110;
					if(_t110 != 0) {
						_t84 =  *[fs:0x18];
						__eflags = _t110 -  *((intOrPtr*)(_t84 + 0x24));
						if(_t110 ==  *((intOrPtr*)(_t84 + 0x24))) {
							_t44 = _t143 - 0x24;
							 *_t44 =  *(_t143 - 0x24) | 0x00000001;
							__eflags =  *_t44;
						}
					}
					__eflags =  *0x6e035cb8 & 0x00000002;
					if(__eflags != 0) {
						__eflags =  *(_t143 + 0x10) - _t106;
						if(__eflags != 0) {
							_t51 = _t143 + 0x10;
							 *_t51 =  *(_t143 + 0x10) -  *((intOrPtr*)( *(_t143 + 0x10) - 8));
							__eflags =  *_t51;
						}
					}
					_t78 = E6E00ACFD(_t136,  *(_t143 + 0x10), __eflags,  *(_t136 + 0xc) |  *(_t143 - 0x24), _t106);
					__eflags = _t78;
					if(_t78 != 0) {
						__eflags = _t78 - 0xffffffff;
						if(_t78 != 0xffffffff) {
							 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t143 + 0x14));
							_t106 = 1;
							__eflags = 1;
						}
					}
					__eflags = _t106;
					if(_t106 == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
					}
					_t79 = _t106;
					L15:
					return E6DF9D0D1(_t79);
				}
				_t86 =  *(_t143 + 0xc) |  *(_t136 + 0x44);
				 *(_t143 - 0x24) = _t86;
				if((_t86 & 0x61000000) != 0) {
					__eflags = _t86 & 0x10000000;
					if(__eflags != 0) {
						goto L2;
					}
					_t79 = E6E0040DC(0, _t136, _t86, _t136, __esi, __eflags,  *(_t143 + 0x10),  *((intOrPtr*)(_t143 + 0x14)));
					goto L15;
				}
				L2:
				if(( *(_t136 + 0x48) & 0x00000001) != 0) {
					_t139 = E6DF41E04(_t136,  *(_t143 + 0x10), _t136, _t137, __eflags);
					L6:
					 *(_t143 - 0x20) = _t139;
					if(_t139 == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
						_t79 = 0;
						goto L15;
					}
					 *(_t143 - 0x1a) = _t106;
					 *(_t143 - 4) = _t106;
					if(( *(_t143 - 0x24) & 0x00000001) == 0) {
						L6DF5EEF0( *((intOrPtr*)(_t136 + 0xc8)));
						 *((char*)(_t143 - 0x19)) = 1;
					}
					_t91 = _t139[1];
					if((_t91 & 0x0000003f) == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
						 *(_t143 - 0x20) = _t106;
						goto L38;
					} else {
						if(_t91 < 0) {
							L38:
							_t139 = _t106;
							 *(_t143 - 0x20) = _t106;
							L14:
							 *(_t143 - 4) = 0xfffffffe;
							E6DF41F37(_t106, _t136, _t139);
							_t79 =  *(_t143 - 0x1a);
							goto L15;
						}
						if( *((intOrPtr*)(_t136 + 0x4c)) != _t106) {
							_t130 =  *(_t136 + 0x50) ^  *_t139;
							 *_t139 = _t130;
							_t120 = _t130 >> 0x00000010 ^ _t130 >> 0x00000008 ^ _t130;
							if(_t130 >> 0x18 != _t120) {
								_push(_t120);
								E6DFFFA2B(_t106, _t136, _t139, _t136, _t139, __eflags);
							}
						}
						if((_t139[0] & 0x00000002) != 0) {
							 *((intOrPtr*)(E6DF41F5B(_t139) + 4)) =  *((intOrPtr*)(_t143 + 0x14));
							 *(_t143 - 0x1a) = 1;
						}
						goto L14;
					}
				}
				_t101 =  *(_t143 + 0x10);
				if((_t101 & 0x00000007) != 0) {
					_push(_t106);
					_push(_t106);
					_push(_t101);
					_push(9);
					L34:
					E6E00A80D(_t136);
					_t139 = _t106;
					goto L6;
				}
				_t142 = _t101 - 8;
				if( *((char*)(_t142 + 7)) == 5) {
					_t139 = _t142 - (( *(_t142 + 6) & 0x000000ff) << 3);
				}
				if((_t139[1] & 0x0000003f) == 0) {
					_push(_t108);
					_push(_t106);
					_push(_t106);
					_push(_t139);
					_push(8);
					goto L34;
				} else {
					goto L6;
				}
			}

0x6df41e50
0x6df41e50
0x6df41e52
0x6df41e57
0x6df41e5c
0x6df41e5f
0x6df41e62
0x6df41e64
0x6df41e6e
0x6df9f1b1
0x6df9f1b4
0x6df9f1b7
0x6df9f1b9
0x6df9f1bb
0x6df9f1c1
0x6df9f1c4
0x6df9f1c6
0x6df9f1c6
0x6df9f1c6
0x6df9f1c6
0x6df9f1c4
0x6df9f1ca
0x6df9f1d1
0x6df9f1d3
0x6df9f1d6
0x6df9f1de
0x6df9f1de
0x6df9f1de
0x6df9f1de
0x6df9f1d6
0x6df9f1ee
0x6df9f1f3
0x6df9f1f5
0x6df9f1f7
0x6df9f1fa
0x6df9f1ff
0x6df9f204
0x6df9f204
0x6df9f204
0x6df9f1fa
0x6df9f205
0x6df9f207
0x6df9f215
0x6df9f228
0x6df9f228
0x6df9f22b
0x6df41f2f
0x6df41f34
0x6df41f34
0x6df41e77
0x6df41e7a
0x6df41e82
0x6df9f232
0x6df9f237
0x00000000
0x00000000
0x6df9f247
0x00000000
0x6df9f247
0x6df41e88
0x6df41e8c
0x6df9f25b
0x6df41eb4
0x6df41eb4
0x6df41eb9
0x6df9f298
0x6df9f2ab
0x6df9f2ae
0x00000000
0x6df9f2ae
0x6df41ebf
0x6df41ec2
0x6df41ec9
0x6df9f2bb
0x6df9f2c0
0x6df9f2c0
0x6df41ecf
0x6df41ed4
0x6df9f2d4
0x6df9f2e7
0x6df9f2ea
0x00000000
0x6df41eda
0x6df41edc
0x6df9f2ed
0x6df9f2ed
0x6df9f2ef
0x6df41f20
0x6df41f20
0x6df41f27
0x6df41f2c
0x00000000
0x6df41f2c
0x6df41ee5
0x6df41eea
0x6df41eec
0x6df41efa
0x6df41f01
0x6df9f2f7
0x6df9f2fc
0x6df9f2fc
0x6df41f01
0x6df41f0b
0x6df41f17
0x6df41f1d
0x6df41f1d
0x00000000
0x6df41f0b
0x6df41ed4
0x6df41e92
0x6df41e97
0x6df9f279
0x6df9f27a
0x6df9f27b
0x6df9f27c
0x6df9f27e
0x6df9f281
0x6df9f286
0x00000000
0x6df9f286
0x6df41e9d
0x6df41ea4
0x6df9f269
0x6df9f269
0x6df41eae
0x6df9f270
0x6df9f271
0x6df9f272
0x6df9f273
0x6df9f274
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlNtStatusToDosError.9419(C000000D,?,00000000,6E01F330,00000018), ref: 6DF9F223
RtlNtStatusToDosError.9419(C000000D), ref: 6DF9F2A6
RtlEnterCriticalSection.9419(?), ref: 6DF9F2BB
RtlNtStatusToDosError.9419(C000000D), ref: 6DF9F2E2

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: e94d2796b136a09ecd3a0846d124576cb12d53ec5dc36075fc90cecef53f207b
Instruction ID: adb52e0b246f4b8fb024031c85f12825f1b26b657b0a8bbc3d4d849ff6578459
Opcode Fuzzy Hash: e94d2796b136a09ecd3a0846d124576cb12d53ec5dc36075fc90cecef53f207b
Instruction Fuzzy Hash: 48512175A047869FEB41CF6CC540BAABBF1BF49318F10C528EC659B641C734AC56CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF78ED7, Relevance: 6.1, APIs: 4, Instructions: 110
libraryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E6DF78ED7(signed char __ecx, void* __edx, int* _a8, intOrPtr* _a12, signed int* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				wchar_t* _v24;
				char _v28;
				void* _v32;
				signed int _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t43;
				intOrPtr _t47;
				signed char _t52;
				signed int _t56;
				intOrPtr* _t61;
				intOrPtr* _t65;
				int _t71;
				wchar_t* _t73;
				intOrPtr* _t74;
				int _t76;
				void* _t78;
				void* _t79;
				signed int _t81;
				void* _t82;
				void* _t83;
				intOrPtr* _t84;

				_t69 = __edx;
				_v36 = _v36 & 0x00000000;
				_push(_t83);
				_t52 = __ecx;
				_v32 = __edx;
				_t78 =  &_v28;
				_t56 = 6;
				memset(_t78, 0, _t56 << 2);
				_t79 = _t78 + _t56;
				_t92 = _t52 & 0x00000003;
				if((_t52 & 0x00000003) == 0) {
					_t84 = E6DF5B550(0, _t69, _t52,  &_v36);
					__eflags = _t84;
					if(_t84 >= 0) {
						_t81 = _v36;
						_t71 = ( *(_t81 + 0x24) & 0x0000ffff) - ( *(_t81 + 0x2c) & 0x0000ffff);
						 *_a8 = _t71;
						__eflags = _t71 - ( *(_t81 + 0x24) & 0x0000ffff);
						if(_t71 > ( *(_t81 + 0x24) & 0x0000ffff)) {
							goto L15;
						} else {
							__eflags = _t71 - 0x2be;
							if(_t71 >= 0x2be) {
								goto L15;
							} else {
								memcpy(_v32,  *(_t81 + 0x28), _t71);
								 *_a12 =  *((intOrPtr*)(_t81 + 0x30));
								 *_a16 =  *(_t81 + 0x2c) & 0x0000ffff;
								_t61 = _a20;
								__eflags = _t61;
								if(_t61 != 0) {
									_t43 =  *((intOrPtr*)(_t81 + 0x48));
									goto L8;
								}
							}
						}
					}
				} else {
					_t84 = E6DF792FC(_t52, _t52,  &_v28, _t79, _t83, _t92);
					if(_t84 >= 0) {
						_t73 = wcsrchr(_v24, 0x5c);
						if(_t73 == 0) {
							_t84 = 0xc0000039;
						} else {
							_t74 = _t73 + 2;
							_t65 = _t74;
							 *_a12 = _t74;
							_t11 = _t65 + 2; // 0x0
							_t82 = _t11;
							do {
								_t47 =  *_t65;
								_t65 = _t65 + 2;
							} while (_t47 != 0);
							_t76 = _t74 - _v24 & 0xfffffffe;
							 *_a16 = (_t65 - _t82 >> 1) + (_t65 - _t82 >> 1);
							 *_a8 = _t76;
							if(_t76 >= 0x2be) {
								L15:
								_t84 = 0x80000005;
							} else {
								memcpy(_v32, _v24, _t76);
								_t61 = _a20;
								if(_t61 != 0) {
									_t43 = _v8;
									if(_t43 != 0xffffffff) {
										L8:
										 *_t61 = _t43;
									}
								}
							}
						}
					}
				}
				return _t84;
			}

0x6df78ed7
0x6df78ee2
0x6df78eea
0x6df78eec
0x6df78eee
0x6df78ef2
0x6df78ef8
0x6df78ef9
0x6df78ef9
0x6df78efb
0x6df78efe
0x6df78fa2
0x6df78fa4
0x6df78fa6
0x6df78fa8
0x6df78fb7
0x6df78fb9
0x6df78fbf
0x6df78fc1
0x00000000
0x6df78fc3
0x6df78fc3
0x6df78fc9
0x00000000
0x6df78fcb
0x6df78fd3
0x6df78fe1
0x6df78fea
0x6df78fec
0x6df78fef
0x6df78ff1
0x6df78ff3
0x00000000
0x6df78ff3
0x6df78ff1
0x6df78fc9
0x6df78fc1
0x6df78f04
0x6df78f0f
0x6df78f13
0x6df78f20
0x6df78f26
0x6dfb9387
0x6df78f2c
0x6df78f2f
0x6df78f32
0x6df78f36
0x6df78f38
0x6df78f38
0x6df78f3b
0x6df78f3b
0x6df78f3e
0x6df78f41
0x6df78f51
0x6df78f56
0x6df78f5b
0x6df78f63
0x6df78ff8
0x6df78ff8
0x6df78f69
0x6df78f72
0x6df78f77
0x6df78f7f
0x6df78f81
0x6df78f88
0x6df78f8a
0x6df78f8a
0x6df78f8a
0x6df78f88
0x6df78f7f
0x6df78f63
0x6df78f26
0x6df78f13
0x6df78f94

APIs

wcsrchr.9419(?,0000005C,00000000,00000000,00000000), ref: 6DF78F1B
memcpy.9419(?,?,?,00000000,00000000,00000000), ref: 6DF78F72
LdrFindEntryForAddress.9419(?,?,00000000,00000000,00000000), ref: 6DF78F9D
memcpy.9419(?,?,00000004,?,?,00000000,00000000,00000000), ref: 6DF78FD3

Part of subcall function 6DF792FC: RtlEnterCriticalSection.9419(6E036D80,6E020158,00000018,6DF463DB), ref: 6DF79331

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$AddressCriticalEnterEntryFindSectionwcsrchr
String ID:
API String ID: 3299649961-0
Opcode ID: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction ID: a4fe5917843318ce075f0c3a3e1200634eca1205b8391d8d35b34ebf0025dd2a
Opcode Fuzzy Hash: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction Fuzzy Hash: C631B3722087429FD715CF1CD840AEAB7E2FF84320F09852AF9558B690D730DC60D795

Uniqueness

Uniqueness Score: -1.00%

Function 6E01ED52, Relevance: 6.1, APIs: 4, Instructions: 110
timeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E6E01ED52(intOrPtr* __ecx, signed int* __edx) {
				signed int _v8;
				unsigned int _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t25;
				signed char _t41;
				intOrPtr* _t49;
				void* _t50;
				signed char _t67;
				signed int _t70;
				signed char _t72;
				signed int* _t79;
				void* _t80;
				signed int _t82;
				void* _t84;
				unsigned int _t86;
				signed int _t90;

				_push(__ecx);
				_push(__ecx);
				_v8 =  *0x6e03d360 ^ _t90;
				_t79 = __edx;
				_t49 = __ecx;
				_t70 = __edx + 8;
				_t82 =  *_t70;
				_t25 = _t82;
				while((_t25 & 0x00ffffff) != 1) {
					_t25 = _t82;
					asm("lock cmpxchg [edx], ecx");
					if(_t25 == _t82) {
						break;
					}
					_t82 = _t25;
				}
				if((_t82 & 0x00ffffff) > 1) {
					L15:
					_pop(_t80);
					_pop(_t84);
					_pop(_t50);
					return E6DF8B640(_t25, _t50, _v8 ^ _t90, _t70, _t80, _t84);
				}
				_t4 = _t49 + 0x1c; // 0x6e038684
				_t85 = _t4;
				E6DF62280(_t25, _t4);
				_t70 = _t70 | 0xffffffff;
				asm("lock xadd [ecx], eax");
				if((_t70 - 0x00000001 & 0x00ffffff) != 0) {
					_t25 = E6DF5FFB0(_t49, _t79, _t85);
					goto L15;
				}
				_t86 =  *(_t49 + 4);
				_t72 = _t70 << (_t86 & 0x0000001f) & _t79[1];
				_v12 = _t72;
				_t70 = 0;
				_t67 =  *((intOrPtr*)(_t49 + 8)) + ((_t86 >> 0x00000005) - 0x00000001 & (_v12 >> 0x00000018) + ((_v12 >> 0x00000010 & 0x000000ff) + ((_t72 >> 0x00000008 & 0x000000ff) + ((_t72 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025) * 4;
				if(( *_t79 & 0x80000002) == 0x80000002) {
				}
				while(1) {
					_t41 =  *_t67;
					if((_t41 & 0x00000001) != 0) {
						break;
					}
					if(_t41 == _t79) {
						 *_t67 =  *_t79;
						 *_t49 =  *_t49 - 1;
						 *_t79 =  *_t79 | 0x80000002;
						L13:
						_t19 = _t49 + 0x1c; // 0x6e038683
						E6DF5FFB0(_t49, _t79, _t19);
						 *0x6e03b1e0(_t79,  *((intOrPtr*)(_t49 + 0x28)));
						_t25 =  *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x24))))();
						goto L15;
					}
					_t67 = _t41;
				}
				goto L13;
			}

0x6e01ed57
0x6e01ed58
0x6e01ed60
0x6e01ed66
0x6e01ed68
0x6e01ed6a
0x6e01ed6d
0x6e01ed6f
0x6e01ed8c
0x6e01ed76
0x6e01ed82
0x6e01ed88
0x00000000
0x00000000
0x6e01ed8a
0x6e01ed8a
0x6e01ed9f
0x6e01ee60
0x6e01ee63
0x6e01ee64
0x6e01ee67
0x6e01ee70
0x6e01ee70
0x6e01eda5
0x6e01eda5
0x6e01eda9
0x6e01edae
0x6e01edb6
0x6e01edc0
0x6e01ee5b
0x00000000
0x6e01ee5b
0x6e01edc6
0x6e01edd3
0x6e01ede4
0x6e01ee15
0x6e01ee17
0x6e01ee20
0x6e01ee20
0x6e01ee24
0x6e01ee24
0x6e01ee28
0x00000000
0x00000000
0x6e01ee2c
0x6e01ee34
0x6e01ee36
0x6e01ee38
0x6e01ee3e
0x6e01ee3e
0x6e01ee42
0x6e01ee50
0x6e01ee56
0x00000000
0x6e01ee56
0x6e01ee2e
0x6e01ee2e
0x00000000

APIs

RtlAcquireSRWLockExclusive.9419(6E038684,6E038668,?,?,6E038668,6E038668,?,6E01E5F4,?,80000002,6E038668,6E038660), ref: 6E01EDA9
RtlReleaseSRWLockExclusive.9419(6E038684,6E038684,6E038668,?,?,6E038668,6E038668,?,6E01E5F4,?,80000002,6E038668,6E038660), ref: 6E01EE42
RtlDebugPrintTimes.9419(?,?,6E038684,6E038684,6E038668,?,?,6E038668,6E038668,?,6E01E5F4,?,80000002,6E038668,6E038660), ref: 6E01EE50
RtlReleaseSRWLockExclusive.9419(6E038684,6E038684,6E038668,?,?,6E038668,6E038668,?,6E01E5F4,?,80000002,6E038668,6E038660), ref: 6E01EE5B

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimes
String ID:
API String ID: 309489879-0
Opcode ID: 713074d8b9d26243e320c889a5998a9de76b564cd0d9f355fdc3c5eedaae78a8
Instruction ID: 6c580828c5521772f8e89b15e611962961b22fa9c0dc6189dbc8f6807abef455
Opcode Fuzzy Hash: 713074d8b9d26243e320c889a5998a9de76b564cd0d9f355fdc3c5eedaae78a8
Instruction Fuzzy Hash: 80310836A084259B8B18CE99CC906ADB7F5EF89320355426DE956CF799DB34ED02CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6ECE0, Relevance: 6.1, APIs: 4, Instructions: 103
timeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DF6ECE0(intOrPtr _a4, signed int _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				void* _v20;
				signed int _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t35;
				void* _t41;
				signed char _t51;
				signed int _t57;
				void* _t58;
				void* _t63;
				intOrPtr* _t66;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t76;
				signed int _t78;
				signed int _t80;

				_t80 = (_t78 & 0xfffffff8) - 0xc;
				_v8 =  *0x6e03d360 ^ _t80;
				_t57 = _a8;
				_push(_t72);
				_t70 = _a4;
				_t68 = 0;
				_t59 = _t70;
				if(E6DF6E760(_t70, _t57, 0 | _t57 != 0x00000000) == 0) {
					L15:
					_t35 = 0;
					L11:
					_pop(_t71);
					_pop(_t73);
					_pop(_t58);
					return E6DF8B640(_t35, _t58, _v8 ^ _t80, _t68, _t71, _t73);
				}
				if(_a16 != 0) {
					E6E0188F5(_t57, _t59, 0, _t70, _t72, __eflags);
					goto L15;
				}
				E6DF62280(_t70 + 0x90, _t70 + 0x90);
				_t68 =  *((intOrPtr*)(_t70 + 0x5c)) + 0x40;
				_t41 = E6DF6EDC4( *((intOrPtr*)(_t70 + 0x5c)) + 0x40, 0,  &_v16);
				_t75 = _v24;
				_t63 = _t41;
				_v24 = 0 | _t75 != 0x00000000;
				if(_t57 == 0 ||  *((char*)(_t70 + 0xdf)) != 0) {
					L9:
					E6DF5FFB0(_t57, _t70, _t70 + 0x90);
					if(_t75 < 0) {
						_t76 =  ~_t75;
						asm("lock xadd [edi], eax");
						__eflags =  ~_t76 - _t76;
						if( ~_t76 == _t76) {
							 *0x6e03b1e0(_t70);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t70 + 4))))))();
						}
					}
					_t35 =  *((intOrPtr*)(_t80 + 0x10));
					goto L11;
				} else {
					if(_t63 == 0) {
						_t66 = _a12;
						_t51 =  *(_t70 + 0x124) | 0x00000001;
						 *((intOrPtr*)(_t70 + 0xe8)) = _t57;
						 *(_t70 + 0x124) = _t51;
						__eflags = _t66;
						if(_t66 != 0) {
							 *(_t70 + 0x124) = _t51 | 0x00000002;
							 *((intOrPtr*)(_t70 + 0xf0)) =  *_t66;
							 *((intOrPtr*)(_t70 + 0xf4)) =  *((intOrPtr*)(_t66 + 4));
						}
						L7:
						if(_t75 > 0) {
							asm("lock xadd [edi], esi");
							_t75 = 0;
						}
						goto L9;
					}
					if( *((intOrPtr*)(_t70 + 0xe0)) != 0) {
						goto L9;
					} else {
						_t68 = _t57;
						_t75 = _t75 + E6DF6FC39(_t70, _t57, _a12);
						goto L7;
					}
				}
			}

0x6df6ece8
0x6df6ecf2
0x6df6ecf7
0x6df6ecfc
0x6df6ed00
0x6df6ed07
0x6df6ed09
0x6df6ed12
0x6dfb42e3
0x6dfb42e3
0x6df6ed9d
0x6df6eda1
0x6df6eda2
0x6df6eda3
0x6df6edae
0x6df6edae
0x6df6ed1c
0x6dfb42de
0x00000000
0x6dfb42de
0x6df6ed2c
0x6df6ed3a
0x6df6ed3d
0x6df6ed42
0x6df6ed46
0x6df6ed4f
0x6df6ed55
0x6df6ed89
0x6df6ed90
0x6df6ed97
0x6df6edb1
0x6df6edb7
0x6df6edbb
0x6df6edbd
0x6dfb432f
0x6dfb4335
0x6dfb4335
0x6df6edbd
0x6df6ed99
0x00000000
0x6df6ed60
0x6df6ed62
0x6dfb42f0
0x6dfb42f3
0x6dfb42f5
0x6dfb42fb
0x6dfb4301
0x6dfb4303
0x6dfb430b
0x6dfb4313
0x6dfb431c
0x6dfb431c
0x6df6ed7f
0x6df6ed81
0x6df6ed83
0x6df6ed87
0x6df6ed87
0x00000000
0x6df6ed81
0x6df6ed6f
0x00000000
0x6df6ed71
0x6df6ed74
0x6df6ed7d
0x00000000
0x6df6ed7d
0x6df6ed6f

APIs

RtlAcquireSRWLockExclusive.9419(?,00000000,00000000), ref: 6DF6ED2C
RtlReleaseSRWLockExclusive.9419(?,00000000,00000000,?,00000000,00000000), ref: 6DF6ED90
TpSetWaitEx.9419 ref: 6DFB42DE
RtlDebugPrintTimes.9419(?,?,00000000,00000000,?,00000000,00000000), ref: 6DFB432F

Part of subcall function 6DF6FC39: ZwAssociateWaitCompletionPacket.9419(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6DF6FC71

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockWait$AcquireAssociateCompletionDebugPacketPrintReleaseTimes
String ID:
API String ID: 1549838691-0
Opcode ID: eb18282543f60dc88ac0f8e34c6c471d14ad7dec76d4e5ae617da5067399c03f
Instruction ID: 898a0898c5ca936913a7a8ff10eb374618b75de91bc0f6dc3c6542c7ad28be45
Opcode Fuzzy Hash: eb18282543f60dc88ac0f8e34c6c471d14ad7dec76d4e5ae617da5067399c03f
Instruction Fuzzy Hash: 9031A176604797AFC714CF6C88407AAB7A5BF89314F058929DC69C7640DB30EC258BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFFC08A, Relevance: 6.1, APIs: 4, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DFFC08A(void* __ecx, void* __edx, signed int _a4) {
				int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* _t66;
				void* _t70;
				void* _t78;
				signed int _t79;
				void* _t88;
				intOrPtr* _t92;

				_push(__ecx);
				_push(__ecx);
				_t88 = __ecx;
				_t70 = __edx;
				_t74 = ( *(__edx + 0xa) & 0x0000ffff) << 2;
				_v8 = ( *(__edx + 0xa) & 0x0000ffff) << 2;
				_t92 = __ecx + 0x17c + _a4 %  *(__ecx + 0x178) * 8;
				_v12 = _t92;
				asm("lock inc dword [edi+0x5c]");
				if( *0x6e037bc8 == 0) {
					E6DF62280(_t92 + 4, _t92 + 4);
					_t74 = _v8;
				}
				while(1) {
					_t92 =  *_t92;
					if(_t92 == 0) {
						break;
					}
					if( *((intOrPtr*)(_t92 + 0xa)) !=  *((intOrPtr*)(_t70 + 0xa))) {
						continue;
					}
					_t66 = E6DF9D4F0(_t92 + 0xc, _t70 + 0xc, _t74);
					_t74 = _v8;
					if(_t66 == _v8) {
						L7:
						_t79 =  *(_t92 + 4) & 0x0000ffff;
						if((_t79 & 0x000007ff) != 0x7ff) {
							 *(_t92 + 4) = (_t79 + 0x00000001 ^ _t79) & 0x000007ff ^ _t79;
						}
						L10:
						if( *0x6e037bc8 == 0) {
							E6DF5FFB0(_t70, _t88, _v12 + 4);
						}
						return _t92;
					}
				}
				_t92 = E6DFFBFDB(_t88,  *((intOrPtr*)(_t70 + 0xa)));
				if(_t92 == 0) {
					asm("lock inc dword [edi+0x70]");
					goto L10;
				} else {
					_t24 = _t92 + 0xc; // 0xc
					memcpy(_t24, _t70 + 0xc, _v8);
					 *(_t92 + 4) =  *(_t92 + 4) & 0x0000f800;
					 *((short*)(_t92 + 0xa)) =  *((intOrPtr*)(_t70 + 0xa));
					_t78 = _t88 + _a4 %  *(_t88 + 0x178) * 8;
					 *_t92 =  *((intOrPtr*)(_t78 + 0x17c));
					 *((intOrPtr*)(_t78 + 0x17c)) = _t92;
					goto L7;
				}
			}

0x6dffc08f
0x6dffc090
0x6dffc097
0x6dffc099
0x6dffc0ad
0x6dffc0b0
0x6dffc0b3
0x6dffc0b6
0x6dffc0b9
0x6dffc0c4
0x6dffc0ca
0x6dffc0cf
0x6dffc0cf
0x6dffc0f3
0x6dffc0f3
0x6dffc0f7
0x00000000
0x00000000
0x6dffc0dc
0x00000000
0x00000000
0x6dffc0e7
0x6dffc0ec
0x6dffc0f1
0x6dffc14a
0x6dffc14a
0x6dffc15a
0x6dffc165
0x6dffc165
0x6dffc16f
0x6dffc176
0x6dffc17f
0x6dffc17f
0x6dffc18c
0x6dffc18c
0x6dffc0f1
0x6dffc104
0x6dffc108
0x6dffc16b
0x00000000
0x6dffc10a
0x6dffc111
0x6dffc115
0x6dffc123
0x6dffc12f
0x6dffc139
0x6dffc142
0x6dffc144
0x00000000
0x6dffc144

APIs

RtlAcquireSRWLockExclusive.9419(?,?,?,?,00000001,?,?,?,6DFFBC33,?,C0000002,00000020,?,?), ref: 6DFFC0CA
memcpy.9419(0000000C,?,?,?,?,?,?,?,?,00000001,?,?,?,6DFFBC33,?,C0000002), ref: 6DFFC115
RtlReleaseSRWLockExclusive.9419(?,?,?,?,?,?,?,00000001,?,?,?,6DFFBC33,?,C0000002,00000020,?), ref: 6DFFC17F

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleasememcpy
String ID:
API String ID: 753335654-0
Opcode ID: 91bd4591d108376692a40b91f0a6cdcb9ed5b3b3f6f95bc4fb962d5ccf6d13ef
Instruction ID: 5b1004ee05a46b6361830c26a60c3766ba170dd8d3fa174f374d3de439d8e0a6
Opcode Fuzzy Hash: 91bd4591d108376692a40b91f0a6cdcb9ed5b3b3f6f95bc4fb962d5ccf6d13ef
Instruction Fuzzy Hash: FF31E176A08516ABC715CF6CC880AA6B3B9FF44714B48C46DE95ACB201DB30E953C794

Uniqueness

Uniqueness Score: -1.00%

Function 6E018050, Relevance: 6.1, APIs: 4, Instructions: 78
threadCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E6E018050(void* __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t5;
				signed int _t6;
				signed int _t8;
				signed int _t13;
				signed int _t19;
				signed int _t24;
				signed int _t27;
				signed int _t29;

				_push(__ecx);
				_t5 =  *0x7ffe03c0;
				_t13 = _t5 << 3;
				if(_t13 < 0x300) {
					_t13 = 0x300;
				}
				_t6 = _t5 << 2;
				_v8 = _t6;
				if(_t6 < 0x180) {
					_t6 = 0x180;
					_v8 = 0x180;
				}
				_t19 =  *0x6e038754;
				_t27 = _a4;
				if(_t19 != 0) {
					__eflags = _t27 - _t19;
					if(_t27 <= _t19) {
						goto L23;
					}
					goto L9;
				} else {
					if(_t27 <= _t6) {
						L23:
						return _t6;
					}
					_t6 = _t13;
					if(_t27 <= _t13) {
						L10:
						if(_t6 == 0) {
							goto L23;
						}
						E6DF62280(_t6, 0x6e0386c4);
						_t8 =  *0x6e038754;
						_t24 = 0;
						if(_t8 != 0) {
							__eflags = _t27 - _t8;
							if(_t27 <= _t8) {
								L19:
								_t6 = E6DF5FFB0(0x6e0386c4, _t24, 0x6e0386c4);
								_t40 = _t24;
								if(_t24 != 0) {
									_t6 = E6DF44B3F(0x6e0386c4, _t24, _t27, _t40);
									_t29 = _t6;
									_t41 = _t29;
									if(_t29 != 0) {
										E6DF75AA0(_t19, _t29, _t24);
										E6DF85C70(_t29, 0);
										_t6 = E6DF79B82(0x6e0386c4, 0x6e0386c0, 0x6e0386c4, _t24, _t29, _t41);
									}
								}
								goto L23;
							}
							L16:
							_t24 = _t27;
							L17:
							if(_t24 != 0) {
								 *0x6e038754 = _t24;
							}
							goto L19;
						}
						if(_t27 <= _v8) {
							goto L19;
						}
						_t24 = _t13;
						if(_t27 <= _t13) {
							goto L17;
						}
						goto L16;
					}
					L9:
					_t6 = _t27;
					goto L10;
				}
			}

0x6e018055
0x6e018056
0x6e018063
0x6e018069
0x6e01806b
0x6e01806b
0x6e01806d
0x6e018075
0x6e01807a
0x6e01807c
0x6e01807e
0x6e01807e
0x6e018081
0x6e018087
0x6e01808c
0x6e01809a
0x6e01809c
0x00000000
0x00000000
0x00000000
0x6e01808e
0x6e018090
0x6e01810d
0x6e018112
0x6e018112
0x6e018092
0x6e018096
0x6e0180a0
0x6e0180a2
0x00000000
0x00000000
0x6e0180aa
0x6e0180af
0x6e0180b4
0x6e0180b8
0x6e0180c7
0x6e0180c9
0x6e0180d7
0x6e0180dd
0x6e0180e2
0x6e0180e4
0x6e0180e6
0x6e0180eb
0x6e0180ed
0x6e0180ef
0x6e0180f3
0x6e0180fb
0x6e018107
0x6e018107
0x6e0180ef
0x00000000
0x6e01810c
0x6e0180cb
0x6e0180cb
0x6e0180cd
0x6e0180cf
0x6e0180d1
0x6e0180d1
0x00000000
0x6e0180cf
0x6e0180bd
0x00000000
0x00000000
0x6e0180bf
0x6e0180c3
0x00000000
0x00000000
0x00000000
0x6e0180c5
0x6e01809e
0x6e01809e
0x00000000
0x6e01809e

APIs

RtlAcquireSRWLockExclusive.9419(6E0386C4,00000008,?,00000000,00000008,?,6DF9F8D6,?,00000000,00000000,?,6DF422D2,00000000,?,00000000,00000034), ref: 6E0180AA
RtlReleaseSRWLockExclusive.9419(6E0386C4,6E0386C4,00000008,?,00000000,00000008,?,6DF9F8D6,?,00000000,00000000,?,6DF422D2,00000000,?,00000000), ref: 6E0180DD
TpSetPoolMaxThreads.9419(00000000,00000000,6E0386C4,6E0386C4,00000008,?,00000000,00000008,?,6DF9F8D6,?,00000000,00000000,?,6DF422D2,00000000), ref: 6E0180F3
TpSetPoolMaxThreadsSoftLimit.9419(00000000,00000000,00000000,00000000,6E0386C4,6E0386C4,00000008,?,00000000,00000008,?,6DF9F8D6,?,00000000,00000000), ref: 6E0180FB

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockPoolThreads$AcquireLimitReleaseSoft
String ID:
API String ID: 4208054433-0
Opcode ID: 4070989b96a61e8b2f06e7e7530feaa322550bf93ed838255bff8fd62ef9d0fe
Instruction ID: 8ce7dbd06159aff08562a2b1f3981dbc4e67b20817043fdbe9747f6c1e70df6f
Opcode Fuzzy Hash: 4070989b96a61e8b2f06e7e7530feaa322550bf93ed838255bff8fd62ef9d0fe
Instruction Fuzzy Hash: 61110A33E0D56A5787A55AED4CA0BCEA2E45B853C4B51027DEE15EF380DA21CF4146F1

Uniqueness

Uniqueness Score: -1.00%

Function 6DFD2D0B, Relevance: 6.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DFD2D0B(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				intOrPtr* _t17;
				signed int _t29;
				signed int _t34;
				intOrPtr* _t37;
				void* _t42;

				_push(__ecx);
				_t34 = 0;
				_t29 = 0;
				_v8 = 0;
				E6DF6FAD0( *0x6e0384cc + 4);
				_t32 =  *0x6e0384cc;
				_t17 =  *0x6e0384cc + 8;
				_t37 =  *_t17;
				if(_t37 == _t17) {
					L10:
					return E6DF6FA00(_t29, _t32, _t34, _t32 + 4);
				} else {
					goto L1;
				}
				do {
					L1:
					_t3 = _t37 + 0xc; // 0xc
					E6DF6FAD0(_t3);
					if( *((intOrPtr*)(_t37 + 0x40)) != 2) {
						goto L7;
					}
					if((_t34 | _t29) == 0) {
						L6:
						_t34 =  *(_t37 + 0x44);
						_t29 =  *(_t37 + 0x48);
						_v8 = 1;
						goto L7;
					}
					_t42 =  *(_t37 + 0x48) - _t29;
					if(_t42 <= 0 && (_t42 < 0 ||  *(_t37 + 0x44) < _t34)) {
						goto L6;
					}
					L7:
					_t10 = _t37 + 0xc; // 0xc
					E6DF6FA00(_t29, _t32, _t34, _t10);
					_t32 =  *0x6e0384cc;
					_t37 =  *_t37;
				} while (_t37 !=  *0x6e0384cc + 8);
				if(_v8 != 0) {
					E6DFD33A0(_t29, _t34, _t29);
					_t32 =  *0x6e0384cc;
				}
				goto L10;
			}

0x6dfd2d10
0x6dfd2d1c
0x6dfd2d1f
0x6dfd2d21
0x6dfd2d24
0x6dfd2d29
0x6dfd2d2f
0x6dfd2d32
0x6dfd2d36
0x6dfd2d91
0x6dfd2da0
0x00000000
0x00000000
0x00000000
0x6dfd2d38
0x6dfd2d38
0x6dfd2d38
0x6dfd2d3c
0x6dfd2d45
0x00000000
0x00000000
0x6dfd2d4b
0x6dfd2d59
0x6dfd2d59
0x6dfd2d5c
0x6dfd2d5f
0x00000000
0x6dfd2d5f
0x6dfd2d4d
0x6dfd2d50
0x00000000
0x00000000
0x6dfd2d66
0x6dfd2d66
0x6dfd2d6a
0x6dfd2d6f
0x6dfd2d75
0x6dfd2d7a
0x6dfd2d82
0x6dfd2d86
0x6dfd2d8b
0x6dfd2d8b
0x00000000

APIs

RtlAcquireSRWLockShared.9419(?,00000000,00000000,00000008,?,?,6DF9FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6DFD2D24
RtlAcquireSRWLockShared.9419(0000000C,?,00000000,00000000,00000008,?,?,6DF9FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6DFD2D3C

Part of subcall function 6DF6FAD0: RtlDllShutdownInProgress.9419(00000000), ref: 6DF6FB35
Part of subcall function 6DF6FAD0: ZwWaitForAlertByThreadId.9419(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6DF6FBE3

RtlReleaseSRWLockShared.9419(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6DF9FFD2,00000000,?), ref: 6DFD2D6A
RtlReleaseSRWLockShared.9419(?,?,00000000,00000000,00000008,?,?,6DF9FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6DFD2D95

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: b2a32190f8314177fe937dfd69dc31f276d1e87524682247bbc28412d318d976
Instruction ID: 67374f0971bfaae26ec761e7a39db948280a1ac0f405de9738745f5c689d6124
Opcode Fuzzy Hash: b2a32190f8314177fe937dfd69dc31f276d1e87524682247bbc28412d318d976
Instruction Fuzzy Hash: 6811C23150660AAFCB70CF98C4809A6B3FCFF85318B19846EE64987600D732ED45CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DF6E63F, Relevance: 6.1, APIs: 4, Instructions: 53
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6DF6E63F(intOrPtr* __ecx, intOrPtr __edx) {
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr* _t34;

				_push(__ecx);
				_t24 = __edx;
				_t34 = __ecx;
				if( *((intOrPtr*)(__edx + 0x38)) != 0xffffffff) {
					if( *((intOrPtr*)(__edx + 0x38)) != 0) {
						 *__ecx = 0x24;
						 *((intOrPtr*)(__ecx + 4)) = 1;
						E6DF5F540(__ecx,  *((intOrPtr*)(__edx + 0x38)));
						 *(__ecx + 0x28) =  *(__ecx + 0x28) | 0x00000001;
					}
				}
				 *(_t34 + 0x50) =  *(_t34 + 0x50) | 0x00000240;
				 *((intOrPtr*)(_t34 + 0x6c)) = _t24;
				if(( *(_t24 + 0x68) & 0x00000003) == 1) {
					E6DF44B00(_t34);
				}
				_t18 =  *((intOrPtr*)(_t24 + 0x3c));
				if(_t18 != 0) {
					 *((intOrPtr*)(_t34 + 0x2c)) = _t18;
					E6DF43E80(_t18);
				}
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E6DF6E6B0(_t24 + 0x50);
			}

0x6df6e647
0x6df6e649
0x6df6e64d
0x6df6e653
0x6df6e69b
0x6df9e248
0x6df9e24e
0x6df9e258
0x6df9e25d
0x6df9e25d
0x6df6e69b
0x6df6e655
0x6df6e65c
0x6df6e666
0x6df6e6a3
0x6df6e6a3
0x6df6e668
0x6df6e66d
0x6df9e267
0x6df9e26a
0x6df9e26a
0x6df6e687
0x6df6e688
0x6df6e689
0x6df6e68a
0x6df6e696

APIs

RtlSetThreadWorkOnBehalfTicket.9419(?,?,?), ref: 6DF6E68B
TpCallbackMayRunLong.9419(?,?,?), ref: 6DF6E6A3
RtlActivateActivationContextUnsafeFast.9419(?,?,?,?,?,6DF79688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6DF9E258

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: 63804f34e36a0bfa9b4cc5277b8aead06c2e71fd1c175763714a3bdda4f16898
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: 980108325646418BD711CF1DC8847537798BF46328F108669DA44CB581E772A885C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 6DFF8061, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E6DFF8061(signed short __ecx, signed int __edx, signed int _a4, signed int* _a8, char _a12, char _a16) {
				signed int _v8;
				signed short _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed short _v48;
				signed short _v52;
				intOrPtr _v56;
				signed short _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				signed short _v80;
				signed int _v84;
				signed int _t149;
				signed int _t152;
				void* _t153;
				void* _t155;
				signed short _t160;
				char* _t162;
				signed short _t163;
				signed int _t166;
				intOrPtr _t170;
				void* _t172;
				intOrPtr _t176;
				intOrPtr _t181;
				intOrPtr _t182;
				intOrPtr _t186;
				void* _t188;
				signed short _t189;
				intOrPtr _t193;
				signed int _t194;
				void* _t196;
				signed short _t197;
				signed int _t198;
				void* _t203;
				char* _t204;
				signed short _t205;
				void* _t209;
				signed int _t210;
				signed short _t213;
				signed int* _t214;
				intOrPtr* _t215;
				signed short _t216;
				signed int _t217;
				signed short _t222;
				intOrPtr _t228;
				signed int _t229;
				void* _t232;
				signed int _t233;
				intOrPtr _t236;
				signed int _t237;
				signed int _t238;
				intOrPtr _t241;
				signed short _t248;
				signed int _t249;
				signed short _t250;
				signed int _t252;
				void* _t253;
				signed short _t254;
				void* _t259;
				void* _t261;
				signed int _t262;
				signed short _t265;
				signed int _t266;
				signed short _t267;
				intOrPtr _t268;
				signed short _t269;
				signed short _t270;
				signed int _t273;
				signed short _t274;
				void* _t275;

				_t216 = __ecx;
				_v12 = __ecx;
				_v52 = __ecx;
				_t214 = _a8;
				_v40 = __ecx + __edx * 2;
				_t273 = _a4;
				_t149 = _t273;
				_v72 = _t149;
				_t262 = _t149;
				_v84 = _t262;
				_v20 = _t262 +  *_t214 * 2;
				if(__edx > 0) {
					_t241 = _v40;
					_t152 = _t262;
					__eflags = __ecx - _t241;
					if(__ecx >= _t241) {
						L87:
						__eflags = _a12;
						_t262 = _t152;
						_t217 = _t262;
						if(_a12 != 0) {
							goto L89;
						}
						goto L88;
					} else {
						_v36 = _t152;
						_v76 = 0x19;
						while(1) {
							_t215 = E6DF45DDE(_t216, _t241, _a12);
							_t160 = _v12;
							__eflags = _t215 - _t160;
							if(_t215 == _t160) {
								break;
							}
							__eflags = _a12;
							if(_a12 != 0) {
								_t162 = L"xl--";
								L13:
								_push(_t216);
								_push(_t216);
								_t163 = E6DFCE850(_t273, _v20 - _t273 >> 1, _t162,  &_a4,  &_a4);
								__eflags = _t163;
								if(_t163 < 0) {
									L92:
									_t155 = 0xc0000023;
									L91:
									 *_a8 =  *_a8 & 0x00000000;
									return _t155;
								}
								_t222 = _v12;
								_t265 = 0;
								_t273 = _a4;
								_t248 = _t222;
								_v28 = 0;
								_v24 = _t273;
								__eflags = _t222 - _t215;
								if(_t222 >= _t215) {
									L33:
									_v80 = _t265;
									_t166 = _t215 - _t222 >> 1;
									_v68 = _t166;
									__eflags = _t265 - _t166;
									if(_t265 != _t166) {
										__eflags = (_v40 - _t222 & 0xfffffffe) - 8;
										if((_v40 - _t222 & 0xfffffffe) < 8) {
											L42:
											_v32 = _v32 & 0x00000000;
											__eflags = _t265;
											if(_t265 <= 0) {
												L45:
												_t170 = 0x48;
												_v48 = 0x80;
												_t249 = 0;
												__eflags = 0;
												_v44 = _t170;
												while(1) {
													_v8 = _t249;
													__eflags = _t265 - _v68;
													if(_t265 >= _v68) {
														break;
													}
													_t176 = 0x7ffffff;
													_t267 = _t222;
													_v16 = 0x7ffffff;
													__eflags = _t222 - _t215;
													if(__eflags >= 0) {
														L54:
														_t265 = _v28;
														_t252 = _t249 + (_t265 - _v32 + 1) * (_t176 - _v48);
														_t222 = _v12;
														_v8 = _t252;
														_t178 = _t222;
														_v48 = _t222;
														__eflags = _t222 - _t215;
														if(__eflags >= 0) {
															L77:
															_t249 = _t252 + 1;
															_v48 = _v16 + 1;
															continue;
														} else {
															goto L55;
														}
														do {
															L55:
															_t181 = E6DFF7EE9(_t178, __eflags);
															_t252 = _v8;
															_t228 = _t181;
															_t182 = _v16;
															_v64 = _t228;
															__eflags = _t228 - _t182;
															if(__eflags < 0) {
																_t252 = _t252 + 1;
																__eflags = _t228 - _t182;
																_v8 = _t252;
															}
															if(__eflags == 0) {
																_t186 = _v44;
																_t229 = _t252;
																_t268 = 0x24;
																_t253 = _t268;
																_t254 = _t253 - _t186;
																__eflags = _t254;
																while(1) {
																	_v60 = _t254;
																	_v56 = _t268;
																	__eflags = _t268 - _t186;
																	if(_t268 > _t186) {
																		__eflags = _t268 - _t186 + 0x1a;
																		if(_t268 < _t186 + 0x1a) {
																			_t269 = _t254;
																		} else {
																			_t269 = 0x1a;
																		}
																	} else {
																		_t269 = 1;
																	}
																	__eflags = _t229 - _t269;
																	if(_t229 < _t269) {
																		break;
																	}
																	__eflags = _t273 - _v20;
																	if(_t273 >= _v20) {
																		goto L92;
																	}
																	_v24 = _t229 - _t269;
																	_t194 = _v24;
																	_t232 = 0x24;
																	_t233 = _t232 - _t269;
																	asm("cdq");
																	_t229 = _t194 / _t233;
																	_v24 = _t229;
																	_t196 = _t194 % _t233 + _t269;
																	_t259 = 0x19;
																	__eflags = _t196 - _t259;
																	if(_t196 <= _t259) {
																		_t197 = _t196 + 0x61;
																		__eflags = _t197;
																		_t198 = _t197 & 0x0000ffff;
																	} else {
																		_t198 = _t196 + 0x00000016 & 0x0000ffff;
																		_t229 = _v24;
																	}
																	_t268 = _v56 + 0x24;
																	 *_t273 = _t198;
																	_t273 = _t273 + 2;
																	_t186 = _v44;
																	_t254 = _v60 + 0x24;
																}
																__eflags = _t273 - _v20;
																if(_t273 >= _v20) {
																	goto L92;
																}
																_t188 = 0x19;
																__eflags = _t229 - _t188;
																_t189 = _t229 + 0x16;
																if(_t229 <= _t188) {
																	_t189 = _t229 + 0x61;
																}
																_t270 = _v28;
																 *_t273 = _t189 & 0x0000ffff;
																_t273 = _t273 + 2;
																__eflags = _t270 - _v80;
																_v24 = _t273;
																_a4 = _t273;
																_t193 = E6DFF7FD5(_v8, _t270 - _v32 + 1, (_t189 & 0xff00 | _t270 == _v80) & 0x000000ff);
																_t228 = _v64;
																_t252 = 0;
																_t265 = _t270 + 1;
																_v44 = _t193;
																__eflags = _v16 - 0x10000;
																_v8 = 0;
																_v28 = _t265;
																if(_v16 >= 0x10000) {
																	_t265 = _t265 + 1;
																	_t112 =  &_v32;
																	 *_t112 = _v32 + 1;
																	__eflags =  *_t112;
																	_v28 = _t265;
																}
															}
															__eflags = _t228 - 0x10000;
															_v48 = _v48 + 2 + (0 | _t228 - 0x00010000 >= 0x00000000) * 2;
															_t178 = _v48;
															__eflags = _v48 - _t215;
														} while (__eflags < 0);
														_t222 = _v12;
														goto L77;
													}
													_t274 = _v48;
													do {
														_t236 = E6DFF7EE9(_t267, __eflags);
														__eflags = _t236 - _t274;
														if(_t236 >= _t274) {
															__eflags = _t236 - _v16;
															if(_t236 < _v16) {
																_v16 = _t236;
															}
														}
														__eflags = _t236 - 0x10000;
														_t267 = _t267 + 2 + (0 | _t236 - 0x00010000 >= 0x00000000) * 2;
														__eflags = _t267 - _t215;
													} while (__eflags < 0);
													_t273 = _v24;
													_t249 = _v8;
													_t176 = _v16;
													goto L54;
												}
												_t266 = _v36;
												L79:
												_t250 = _a12;
												__eflags = _t250;
												if(_t250 != 0) {
													L81:
													__eflags = _t215 - _v40;
													if(_t215 == _v40) {
														L86:
														_t241 = _v40;
														_t216 = _t215 + 2;
														_v12 = _t216;
														_t152 = _t273;
														_v36 = _t273;
														_t262 = _t273;
														__eflags = _t215 - _t241;
														if(_t215 < _t241) {
															continue;
														}
														goto L87;
													}
													__eflags = _t273 - _v20;
													if(_t273 >= _v20) {
														goto L92;
													}
													 *_t273 =  *_t215;
													_t273 = _t273 + 2;
													_a4 = _t273;
													__eflags = _t250;
													if(_t250 != 0) {
														_t172 = 0x40;
														__eflags =  *_t215 - _t172;
														if( *_t215 == _t172) {
															__eflags = 0;
															_v72 = _t273;
															_a12 = 0;
														}
													}
													goto L86;
												}
												__eflags = (_t273 - _t266 & 0xfffffffe) - 0x7e;
												if((_t273 - _t266 & 0xfffffffe) > 0x7e) {
													L90:
													_t155 = 0xc0000716;
													goto L91;
												}
												goto L81;
											}
											__eflags = _t273 - _v20;
											if(_t273 >= _v20) {
												goto L92;
											}
											_t203 = 0x2d;
											 *_t273 = _t203;
											_t273 = _t273 + 2;
											__eflags = _t273;
											_v24 = _t273;
											_a4 = _t273;
											goto L45;
										}
										__eflags = _a12;
										_t204 = L"xl--";
										if(_a12 == 0) {
											_t204 = L"xn--";
										}
										_t205 = E6DF8E5C0(_t222, _t204, 4);
										_t275 = _t275 + 0xc;
										__eflags = _t205;
										if(_t205 == 0) {
											goto L90;
										} else {
											_t222 = _v12;
											goto L42;
										}
									}
									_t266 = _v36;
									_t261 = _t273 - 8;
									_t237 = _t266;
									__eflags = _t266 - _t261;
									if(_t266 >= _t261) {
										L36:
										_t273 = _t273 - 8;
										_a4 = _t273;
										goto L79;
									} else {
										goto L35;
									}
									do {
										L35:
										 *_t237 =  *((intOrPtr*)(_t237 + 8));
										_t237 = _t237 + 2;
										__eflags = _t237 - _t261;
									} while (_t237 < _t261);
									goto L36;
								} else {
									goto L15;
								}
								do {
									L15:
									_t238 =  *_t248 & 0x0000ffff;
									__eflags = _t238 - 0x80;
									if(_t238 >= 0x80) {
										__eflags = _t238 + 0x2800 - 0x3ff;
										if(_t238 + 0x2800 <= 0x3ff) {
											_t248 = _t248 + 2;
											__eflags = _t248;
										}
										goto L31;
									}
									_t209 = _a12;
									__eflags = _t209;
									if(_t209 != 0) {
										L22:
										__eflags = _t238;
										if(_t238 == 0) {
											goto L90;
										}
										__eflags = _t273 - _v20;
										if(_t273 >= _v20) {
											goto L92;
										}
										__eflags = _t209;
										if(_t209 != 0) {
											L27:
											_t210 = _t238;
											L28:
											 *_t273 = _t210;
											_t273 = _t273 + 2;
											_t265 = _t265 + 1;
											_v24 = _t273;
											_a4 = _t273;
											_v28 = _t265;
											goto L31;
										}
										__eflags = _t238 - 0x41 - _v76;
										if(_t238 - 0x41 > _v76) {
											goto L27;
										} else {
											_t210 = _t238 + 0x00000020 & 0x0000ffff;
											goto L28;
										}
									}
									__eflags = _a16 - _t209;
									if(_a16 == _t209) {
										L20:
										__eflags = _t238 - 0x20;
										if(_t238 < 0x20) {
											goto L90;
										}
										__eflags = _t238 - 0x7f;
										if(_t238 == 0x7f) {
											goto L90;
										}
										goto L22;
									}
									_t213 = E6DFF7F9F(_t238);
									__eflags = _t213;
									if(_t213 == 0) {
										goto L90;
									} else {
										_t209 = _a12;
										goto L20;
									}
									L31:
									_t248 = _t248 + 2;
									__eflags = _t248 - _t215;
								} while (_t248 < _t215);
								_t222 = _v12;
								goto L33;
							}
							__eflags = _a16;
							if(_a16 == 0) {
								L11:
								_t162 = L"xn--";
								goto L13;
							}
							_t216 = 0x2d;
							__eflags =  *_t160 - _t216;
							if( *_t160 == _t216) {
								goto L90;
							}
							__eflags = _t215 - _v52;
							if(_t215 <= _v52) {
								goto L11;
							}
							__eflags =  *((intOrPtr*)(_t215 - 2)) - _t216;
							if( *((intOrPtr*)(_t215 - 2)) == _t216) {
								goto L90;
							}
							goto L11;
						}
						__eflags = _a12;
						if(_a12 != 0) {
							L95:
							 *_a8 =  *_a8 & 0x00000000;
							goto L2;
						}
						__eflags = _t215 - _t241;
						if(_t215 == _t241) {
							L88:
							_t217 = _t262;
							 *((short*)(_t273 - 2)) - 0x2e = _t262 - _v72 >> 1 - ( *((short*)(_t273 - 2)) == 0x2e) + 0xfe;
							if(_t262 - _v72 >> 1 > ( *((short*)(_t273 - 2)) == 0x2e) + 0xfe) {
								goto L90;
							}
							L89:
							_t153 = 0x40;
							__eflags =  *((intOrPtr*)(_t273 - 2)) - _t153;
							if( *((intOrPtr*)(_t273 - 2)) != _t153) {
								__eflags = 0;
								 *_a8 = _t217 - _v84 >> 1;
								return 0;
							}
							goto L90;
						}
						goto L95;
					}
				} else {
					 *_t214 =  *_t214 & 0x00000000;
					L2:
					return 0xc0000716;
				}
			}

0x6dff8061
0x6dff8069
0x6dff806e
0x6dff8072
0x6dff8078
0x6dff807c
0x6dff807f
0x6dff8081
0x6dff8085
0x6dff8089
0x6dff808f
0x6dff8094
0x6dff80a3
0x6dff80a6
0x6dff80a8
0x6dff80aa
0x6dff8464
0x6dff8464
0x6dff8468
0x6dff846a
0x6dff846c
0x00000000
0x00000000
0x00000000
0x6dff80b0
0x6dff80b0
0x6dff80b3
0x6dff80ba
0x6dff80c2
0x6dff80c4
0x6dff80c7
0x6dff80c9
0x00000000
0x00000000
0x6dff80cf
0x6dff80d3
0x6dff80fd
0x6dff8102
0x6dff8105
0x6dff8106
0x6dff8113
0x6dff8118
0x6dff811a
0x6dff849e
0x6dff849e
0x6dff8496
0x6dff8499
0x00000000
0x6dff8499
0x6dff8120
0x6dff8123
0x6dff8125
0x6dff8128
0x6dff812a
0x6dff812d
0x6dff8130
0x6dff8132
0x6dff81cf
0x6dff81d1
0x6dff81d6
0x6dff81d8
0x6dff81db
0x6dff81dd
0x6dff820c
0x6dff820f
0x6dff8238
0x6dff8238
0x6dff823c
0x6dff823e
0x6dff8258
0x6dff825a
0x6dff825b
0x6dff8262
0x6dff8262
0x6dff8264
0x6dff8267
0x6dff8267
0x6dff826a
0x6dff826d
0x00000000
0x00000000
0x6dff8273
0x6dff8278
0x6dff827a
0x6dff827d
0x6dff827f
0x6dff82ba
0x6dff82ba
0x6dff82c9
0x6dff82cb
0x6dff82ce
0x6dff82d1
0x6dff82d3
0x6dff82d6
0x6dff82d8
0x6dff83ff
0x6dff8402
0x6dff8404
0x00000000
0x00000000
0x00000000
0x00000000
0x6dff82de
0x6dff82de
0x6dff82e0
0x6dff82e5
0x6dff82e8
0x6dff82ea
0x6dff82ed
0x6dff82f0
0x6dff82f2
0x6dff82f4
0x6dff82f5
0x6dff82f7
0x6dff82f7
0x6dff82fa
0x6dff8300
0x6dff8303
0x6dff8307
0x6dff8309
0x6dff830a
0x6dff830a
0x6dff830c
0x6dff830c
0x6dff830f
0x6dff8312
0x6dff8314
0x6dff831e
0x6dff8320
0x6dff8327
0x6dff8322
0x6dff8324
0x6dff8324
0x6dff8316
0x6dff8318
0x6dff8318
0x6dff8329
0x6dff832b
0x00000000
0x00000000
0x6dff832d
0x6dff8330
0x00000000
0x00000000
0x6dff8338
0x6dff833b
0x6dff8340
0x6dff8341
0x6dff8343
0x6dff8348
0x6dff834a
0x6dff834d
0x6dff8350
0x6dff8351
0x6dff8353
0x6dff8360
0x6dff8360
0x6dff8363
0x6dff8355
0x6dff8358
0x6dff835b
0x6dff835b
0x6dff836c
0x6dff836f
0x6dff8372
0x6dff8375
0x6dff8378
0x6dff8378
0x6dff837d
0x6dff8380
0x00000000
0x00000000
0x6dff8388
0x6dff8389
0x6dff838b
0x6dff838e
0x6dff8390
0x6dff8390
0x6dff8393
0x6dff839e
0x6dff83a1
0x6dff83a4
0x6dff83a7
0x6dff83ad
0x6dff83b8
0x6dff83bd
0x6dff83c0
0x6dff83c2
0x6dff83c3
0x6dff83c6
0x6dff83cd
0x6dff83d0
0x6dff83d3
0x6dff83d5
0x6dff83d6
0x6dff83d6
0x6dff83d6
0x6dff83d9
0x6dff83d9
0x6dff83d3
0x6dff83de
0x6dff83ee
0x6dff83f1
0x6dff83f4
0x6dff83f4
0x6dff83fc
0x00000000
0x6dff83fc
0x6dff8281
0x6dff8284
0x6dff828b
0x6dff828d
0x6dff828f
0x6dff8291
0x6dff8294
0x6dff8296
0x6dff8296
0x6dff8294
0x6dff829b
0x6dff82ab
0x6dff82ad
0x6dff82ad
0x6dff82b1
0x6dff82b4
0x6dff82b7
0x00000000
0x6dff82b7
0x6dff840c
0x6dff840f
0x6dff840f
0x6dff8412
0x6dff8414
0x6dff8422
0x6dff8422
0x6dff8425
0x6dff844c
0x6dff844c
0x6dff844f
0x6dff8452
0x6dff8455
0x6dff8457
0x6dff845a
0x6dff845c
0x6dff845e
0x00000000
0x00000000
0x00000000
0x6dff845e
0x6dff8427
0x6dff842a
0x00000000
0x00000000
0x6dff842f
0x6dff8432
0x6dff8435
0x6dff8438
0x6dff843a
0x6dff843e
0x6dff843f
0x6dff8442
0x6dff8444
0x6dff8446
0x6dff8449
0x6dff8449
0x6dff8442
0x00000000
0x6dff843a
0x6dff841d
0x6dff8420
0x6dff8491
0x6dff8491
0x00000000
0x6dff8491
0x00000000
0x6dff8420
0x6dff8240
0x6dff8243
0x00000000
0x00000000
0x6dff824b
0x6dff824c
0x6dff824f
0x6dff824f
0x6dff8252
0x6dff8255
0x00000000
0x6dff8255
0x6dff8211
0x6dff8215
0x6dff821a
0x6dff821c
0x6dff821c
0x6dff8225
0x6dff822a
0x6dff822d
0x6dff822f
0x00000000
0x6dff8235
0x6dff8235
0x00000000
0x6dff8235
0x6dff822f
0x6dff81df
0x6dff81e2
0x6dff81e5
0x6dff81e7
0x6dff81e9
0x6dff81f9
0x6dff81f9
0x6dff81fc
0x00000000
0x00000000
0x00000000
0x00000000
0x6dff81eb
0x6dff81eb
0x6dff81ef
0x6dff81f2
0x6dff81f5
0x6dff81f5
0x00000000
0x00000000
0x00000000
0x00000000
0x6dff8138
0x6dff8138
0x6dff8138
0x6dff8140
0x6dff8143
0x6dff81b9
0x6dff81bc
0x6dff81be
0x6dff81be
0x6dff81be
0x00000000
0x6dff81bc
0x6dff8145
0x6dff8148
0x6dff814a
0x6dff8173
0x6dff8173
0x6dff8176
0x00000000
0x00000000
0x6dff817c
0x6dff817f
0x00000000
0x00000000
0x6dff8185
0x6dff8187
0x6dff819a
0x6dff819a
0x6dff819c
0x6dff819c
0x6dff819f
0x6dff81a2
0x6dff81a3
0x6dff81a6
0x6dff81a9
0x00000000
0x6dff81a9
0x6dff818c
0x6dff8190
0x00000000
0x6dff8192
0x6dff8195
0x00000000
0x6dff8195
0x6dff8190
0x6dff814c
0x6dff814f
0x6dff8161
0x6dff8161
0x6dff8164
0x00000000
0x00000000
0x6dff816a
0x6dff816d
0x00000000
0x00000000
0x00000000
0x6dff816d
0x6dff8151
0x6dff8156
0x6dff8158
0x00000000
0x6dff815e
0x6dff815e
0x00000000
0x6dff815e
0x6dff81c1
0x6dff81c1
0x6dff81c4
0x6dff81c4
0x6dff81cc
0x00000000
0x6dff81cc
0x6dff80d5
0x6dff80d9
0x6dff80f6
0x6dff80f6
0x00000000
0x6dff80f6
0x6dff80dd
0x6dff80de
0x6dff80e1
0x00000000
0x00000000
0x6dff80e7
0x6dff80ea
0x00000000
0x00000000
0x6dff80ec
0x6dff80f0
0x00000000
0x00000000
0x00000000
0x6dff80f0
0x6dff84a5
0x6dff84a9
0x6dff84af
0x6dff84b2
0x00000000
0x6dff84b2
0x6dff84ab
0x6dff84ad
0x6dff846e
0x6dff846e
0x6dff8484
0x6dff8486
0x00000000
0x00000000
0x6dff8488
0x6dff848a
0x6dff848b
0x6dff848f
0x6dff84c2
0x6dff84c4
0x00000000
0x6dff84c4
0x00000000
0x6dff848f
0x00000000
0x6dff84ad
0x6dff8096
0x6dff8096
0x6dff8099
0x00000000
0x6dff8099

Strings

xl--, xrefs: 6DFF80FD, 6DFF8215
xn--, xrefs: 6DFF80F6, 6DFF810E, 6DFF821C, 6DFF8223

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: xl--$xn--
API String ID: 0-2182639396
Opcode ID: 16e708abd58d7e7ce5fe791631f2080fd03dbf980dcd6edf2b60cacf7dac2856
Instruction ID: a11ba988cdf10ab7e6210c1c9f78fffd07135551dd797bdcd5b4bda91adc52b0
Opcode Fuzzy Hash: 16e708abd58d7e7ce5fe791631f2080fd03dbf980dcd6edf2b60cacf7dac2856
Instruction Fuzzy Hash: 15E1E4B1E0425A9FDF14CFADC8806EDB7B1FF88310F24842AD955AB360D7709A838B41

Uniqueness

Uniqueness Score: -1.00%

Function 6DFCF2B7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6DFCF2B7(intOrPtr __ecx) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				void* _t25;
				intOrPtr* _t29;
				intOrPtr _t30;
				intOrPtr* _t35;
				signed int _t36;
				intOrPtr* _t37;
				void* _t40;

				_t30 = __ecx;
				_v8 = __ecx;
				if( *0x6e03b238 == 0) {
					L14:
					return 0;
				} else {
					_t35 =  *0x6e0370c0;
					while(_t35 != 0x6e0370c0) {
						_t29 =  *((intOrPtr*)(_t35 + 0x14));
						_v12 = _v12 & 0x00000000;
						_t35 =  *_t35;
						_v16 = _t35;
						if( *_t29 == 0) {
							continue;
						}
						_t36 = _v12;
						_t37 = _t29;
						do {
							if(( *(_t37 + 4) & 0x00000001) != 0) {
								if(E6DF8E490( *((intOrPtr*)(_t30 + 0x30)),  *_t37) != 0) {
									_t30 = _v8;
								} else {
									if(( *0x6e0387c8 & 0x00000004) != 0) {
										_push( *((intOrPtr*)(_v8 + 0x30)));
										E6DF4B150("AVRF: pid 0x%X: found dll descriptor for `%ws\' with verified exports \n",  *((intOrPtr*)( *[fs:0x18] + 0x20)));
										_t40 = _t40 + 0xc;
									}
									_t25 = E6DFCF0E8( *((intOrPtr*)(_t37 + 0xc)), _v8);
									_t30 = _v8;
									if(_t25 != 0) {
										 *(_t37 + 4) =  *(_t37 + 4) & 0xfffffffe;
									}
								}
							}
							_t36 = _t36 + 1;
							_t37 = (_t36 << 4) + _t29;
						} while ( *_t37 != 0);
						_t35 = _v16;
					}
					goto L14;
				}
			}

0x6dfcf2b7
0x6dfcf2c9
0x6dfcf2cc
0x6dfcf364
0x6dfcf36a
0x6dfcf2d2
0x6dfcf2d2
0x6dfcf356
0x6dfcf2da
0x6dfcf2dd
0x6dfcf2e1
0x6dfcf2e3
0x6dfcf2e9
0x00000000
0x00000000
0x6dfcf2eb
0x6dfcf2ee
0x6dfcf2f0
0x6dfcf2f4
0x6dfcf304
0x6dfcf343
0x6dfcf306
0x6dfcf30d
0x6dfcf312
0x6dfcf323
0x6dfcf328
0x6dfcf328
0x6dfcf331
0x6dfcf336
0x6dfcf33b
0x6dfcf33d
0x6dfcf33d
0x6dfcf33b
0x6dfcf304
0x6dfcf346
0x6dfcf34c
0x6dfcf34e
0x6dfcf353
0x6dfcf353
0x00000000
0x6dfcf356

APIs

_wcsicmp.9419(?,?,-00000054,-00000054,00000000), ref: 6DFCF2FB
DbgPrint.9419(AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports ,?,?,-00000054,-00000054,00000000), ref: 6DFCF323

Strings

AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports , xrefs: 6DFCF31E

Memory Dump Source

Source File: 00000000.00000002.272418768.000000006DF21000.00000020.00020000.sdmp, Offset: 6DF20000, based on PE: true

Associated: 00000000.00000002.272338458.000000006DF20000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.272994023.000000006E035000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.273005751.000000006E03B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.273038058.000000006E03F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print_wcsicmp
String ID: AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
API String ID: 2655330621-555053354
Opcode ID: 2a0608bdfe4f14ef648d3c743904736a0a239a435b5726d6d03534c4db5ad251
Instruction ID: b0fb2260c94e79d8f9d4d42140537c99926fca58bf17a791e02e0f55c2f126b8
Opcode Fuzzy Hash: 2a0608bdfe4f14ef648d3c743904736a0a239a435b5726d6d03534c4db5ad251
Instruction Fuzzy Hash: 1821B73690560BEBDB51CE98C94076EFBB1FF81324F2541D8C9546B291C331AD91CB41

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: eurbbce PID: 6392 Parent PID: 904 eurbbceCOMMON

Executed Functions

Function 0040E600, Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 275timememoryfileCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00427BE8), ref: 0040E61B
GetTitleBarInfo.USER32(00000000,00000000), ref: 0040E630
SetLastError.KERNEL32(00000000), ref: 0040E760
GetFileAttributesA.KERNEL32(00000000), ref: 0040E805
GetNumberOfConsoleMouseButtons.KERNEL32(00000000), ref: 0040E84F
DisconnectNamedPipe.KERNEL32(00000000), ref: 0040E857
SetLocalTime.KERNEL32(00000000), ref: 0040E85F
GetLastError.KERNEL32 ref: 0040E865
SetLocalTime.KERNEL32(00000000), ref: 0040E876
GetCommandLineW.KERNEL32 ref: 0040E87C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0040E8DD
LocalAlloc.KERNELBASE(00000000,0048E5EC), ref: 0040E8EE
GetSystemTime.KERNEL32(?), ref: 0040E998
DeleteVolumeMountPointA.KERNEL32(00000000), ref: 0040E9A0
SetThreadContext.KERNEL32(00000000,00000000), ref: 0040EA16
OpenMutexW.KERNEL32(00000000,00000000,00000000), ref: 0040EA22
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040EA42
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 0040EAE9
GetTimeZoneInformation.KERNEL32(00000000), ref: 0040EAF1
MoveFileW.KERNEL32(00000000,00000000), ref: 0040EAFB

Strings

l, xrefs: 0040E8B9
<73[, xrefs: 0040E7E3
";, xrefs: 0040E949
&, xrefs: 0040EA75
yufoxejoxu, xrefs: 0040E636

Memory Dump Source

Source File: 00000011.00000002.342914379.000000000040A000.00000020.00020000.sdmp, Offset: 0040A000, based on PE: false

Similarity

API ID: Time$Local$ConsoleErrorFileLastSystem$AllocAttributesButtonsCommandContextDeleteDisconnectInfoInformationInputLineMountMouseMoveMutexNamedNumberOpenPipePointProcessSpecificTerminateThreadTitleVolumeWriteZonelstrlen
String ID: ";$&$<73[$l$yufoxejoxu
API String ID: 3676403651-4119945496
Opcode ID: 3983bd9558c8484b5c342ba4d8757a584fd549a42b600974b6061b8281545602
Instruction ID: e8289e15ceee18bb51e841d1d362706e30fdff6bd683ed9cb8de6d5add1f7723
Opcode Fuzzy Hash: 3983bd9558c8484b5c342ba4d8757a584fd549a42b600974b6061b8281545602
Instruction Fuzzy Hash: 82C16C70D04228DBEBA4DFA2DC45B9977B0BB48305F1084FAE149B62D0DB745A94CF9E

Uniqueness

Uniqueness Score: -1.00%

Function 004016B6, Relevance: 3.0, APIs: 2, Instructions: 48sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401756
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040177E

Memory Dump Source

Source File: 00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: cdc5c6d1207e72b774336099cfd4d7a0f50d8a067ed502ab486bb145d8488358
Instruction ID: 9817d08ee7cb01b68207c7a3fae4a1d30fdf779655ca1dda478e712fdb591fba
Opcode Fuzzy Hash: cdc5c6d1207e72b774336099cfd4d7a0f50d8a067ed502ab486bb145d8488358
Instruction Fuzzy Hash: 3601D835208241A7DB009FA4CD45ABD7B249F45325F6444BBBB437B1F2CA3C9517AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401718, Relevance: 3.0, APIs: 2, Instructions: 48sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401756
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040177E

Memory Dump Source

Source File: 00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 5b65caea2b662a27809642b241393292fac4c4074eef7ec28df2f23109d55589
Instruction ID: 243def003460411f04d2403cbbbe299c52fffa44889989118422b7cf4232d45c
Opcode Fuzzy Hash: 5b65caea2b662a27809642b241393292fac4c4074eef7ec28df2f23109d55589
Instruction Fuzzy Hash: F601A439208105F7EB006AA48D41EBA3628AB44365F304137BB037B0F2DA3C8917676B

Uniqueness

Uniqueness Score: -1.00%

Function 0040172E, Relevance: 3.0, APIs: 2, Instructions: 43sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401756
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040177E

Memory Dump Source

Source File: 00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 072872cd30e6d723020d54ecfb89e03fff5b1653ccea87c2db6cd78b2849899c
Instruction ID: a05afc57eb46c70f1857230eee8d3c3d1e536e5b652ebbc10141345a9555c0e6
Opcode Fuzzy Hash: 072872cd30e6d723020d54ecfb89e03fff5b1653ccea87c2db6cd78b2849899c
Instruction Fuzzy Hash: 4EF0F936204105EBDF019FA58D41AE937289F04315F144477BA02BB0F2CA3C84179B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00401723, Relevance: 3.0, APIs: 2, Instructions: 42sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401756
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040177E

Memory Dump Source

Source File: 00000011.00000002.342900534.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 04389c4ee57fed76261b78415012b1d2c75a6e09e15c73b726d6d84759801c5e
Instruction ID: f958e37b69b25004bddca34a7ba9431922d6f5e10619a22f28f1878958057736
Opcode Fuzzy Hash: 04389c4ee57fed76261b78415012b1d2c75a6e09e15c73b726d6d84759801c5e
Instruction Fuzzy Hash: D5F06239308105EBEB005AA18D40EFE3624AB44315F244577BB13BB0F2DA3C8517A72B

Uniqueness

Uniqueness Score: -1.00%

Function 6E049600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6E041119,?,?,00000018,?), ref: 6E04960A

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6fc8c345f9ada7eb6685d91a20ad6bba126afa5d935e2ce204691f09cae7c183
Instruction ID: e03126d548a293db45505ac9252c7b653867c8703ed9f630f0b2a5d908e849dc
Opcode Fuzzy Hash: 6fc8c345f9ada7eb6685d91a20ad6bba126afa5d935e2ce204691f09cae7c183
Instruction Fuzzy Hash: A29002B120100543D10162998504B4B4A09A7E0341F51C026E0404A24DC59588B17961

Uniqueness

Uniqueness Score: -1.00%

Function 6E049660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6E0918BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6E0E0810,0000001C,6E091616), ref: 6E04966A

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 32fcc38b4e1eace810608f6db1e67ed3aa6bb43c3e6c29c423dc4be47eb24c5f
Instruction ID: f9557de53c6389d71f4210833b47d70666baeee2010444168e508f272113a608
Opcode Fuzzy Hash: 32fcc38b4e1eace810608f6db1e67ed3aa6bb43c3e6c29c423dc4be47eb24c5f
Instruction Fuzzy Hash: A39002B120100903D1817199850474B090997D1341F91C026E0015A24DCA558AA97FE1

Uniqueness

Uniqueness Score: -1.00%

Function 6E049780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6E091A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6E04978A

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a10d95aa70e9f4b8c03f082e1fe1070d97eab5726c4f97d89fdf27b8940531f3
Instruction ID: ca8a8fb060096c6e79ffad1ffa57e5aefb7669db590438f53bb808e48af6244b
Opcode Fuzzy Hash: a10d95aa70e9f4b8c03f082e1fe1070d97eab5726c4f97d89fdf27b8940531f3
Instruction Fuzzy Hash: 8F9002B921300103D1817199950870B090997D1242F91D426E0005928CC95588B96B61

Uniqueness

Uniqueness Score: -1.00%

Function 6E049820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6E062EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6E04982A

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 04532372e7a7cde2166e1f69c68203fb4dc191750e70504210941cc8721b7e7b
Instruction ID: 88f3ff62cb595fb1aad27838a3eca4e352721ecfafb658a013d04258e512c8b8
Opcode Fuzzy Hash: 04532372e7a7cde2166e1f69c68203fb4dc191750e70504210941cc8721b7e7b
Instruction Fuzzy Hash: 3F9002B124100503D14271998504707090DA7D0281F91C023E0414924EC6958AA6BEA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E049860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6E0915BB,00000073,?,00000008,00000000,?,00000568), ref: 6E04986A

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c4131bf29b3923057d405d0d4bcbe7055b930127a1e842b13062979cdcebd76f
Instruction ID: 1b740a12ff304fdaafa1e4123328bb7985970339fb210f6e823c078f94d943ed
Opcode Fuzzy Hash: c4131bf29b3923057d405d0d4bcbe7055b930127a1e842b13062979cdcebd76f
Instruction Fuzzy Hash: 079002B120100513D11261998604707090D97D0281F91C423E0414928DD69689A2B961

Uniqueness

Uniqueness Score: -1.00%

Function 6E0498C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6E09108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6E0E07D0,00000058,6E090C91,?,00000000,?,00000000), ref: 6E0498CA

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8547193339c50b8b89d6fd301d3d84411a22bb5eea32bec1d3336c82f190068b
Instruction ID: 5213e170f20092f397825d9f71dfb8c18e84630d98387cadabad28a538b5de7d
Opcode Fuzzy Hash: 8547193339c50b8b89d6fd301d3d84411a22bb5eea32bec1d3336c82f190068b
Instruction Fuzzy Hash: 3A9002B120100583E10261998504F07190D97E0281F91C027E1019934DC655C9A2BA65

Uniqueness

Uniqueness Score: -1.00%

Function 6E0499A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6E091A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6E0499AA

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 815ca1016d95ecc1f7a091bffc9bfbb18546af369a71119c3b58e15e601c4460
Instruction ID: c612c8180c7f9fa83ae4a2efe1783e58dc36cf1c0a4858d7c04e83d2e15ce94c
Opcode Fuzzy Hash: 815ca1016d95ecc1f7a091bffc9bfbb18546af369a71119c3b58e15e601c4460
Instruction Fuzzy Hash: D79002F134100543D10161998514B070909D7E1341F51C026E1054924DC659CCA27966

Uniqueness

Uniqueness Score: -1.00%

Function 0040E490, Relevance: 21.1, APIs: 14, Instructions: 97memorythreadtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E3A0: EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0040E3BE
Part of subcall function 0040E3A0: DebugBreakProcess.KERNEL32(00000000), ref: 0040E3C6
Part of subcall function 0040E3A0: RtlLeaveCriticalSection.NTDLL(00000000), ref: 0040E3CE
Part of subcall function 0040E3A0: BuildCommDCBAndTimeoutsA.KERNEL32(00000000,?,00000000), ref: 0040E429
Part of subcall function 0040E3A0: GetPriorityClass.KERNEL32(00000000), ref: 0040E443
Part of subcall function 0040E3A0: LoadResource.KERNEL32(00000000,00000000), ref: 0040E461
Part of subcall function 0040E3A0: SizeofResource.KERNEL32(00000000,00000000), ref: 0040E46B

SetConsoleScreenBufferSize.KERNEL32(00000000,?), ref: 0040E4DA
SetConsoleMode.KERNEL32(00000000,00000000), ref: 0040E4E4
GlobalSize.KERNEL32(00000000), ref: 0040E4EC
GetBinaryType.KERNEL32(00000000,?), ref: 0040E52F
SetThreadToken.ADVAPI32(00000000,00000000), ref: 0040E539
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040E55F
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040E56B
GetOEMCP.KERNEL32 ref: 0040E571
SetCommMask.KERNEL32(00000000,00000000), ref: 0040E59F
VirtualFree.KERNEL32(00000000,00000000,00000000), ref: 0040E5AB
GetCurrentDirectoryW.KERNEL32(00000000,?), ref: 0040E5BA
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 0040E5C4
SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040E5D6
GetProfileSectionA.KERNEL32(00000000,?,00000000), ref: 0040E5E7

Memory Dump Source

Source File: 00000011.00000002.342914379.000000000040A000.00000020.00020000.sdmp, Offset: 0040A000, based on PE: false

Similarity

API ID: CommConsoleFreePriorityProcessResourceSectionSize$BinaryBoostBreakBufferBuildClassCriticalCurrentDebugDirectoryEnumExceptionFormatsGlobalHeapLeaveLoadMaskModeProfileRaiseScreenSizeofThreadTimeTimeoutsTimerTokenTypeVirtualWaitable
String ID:
API String ID: 1907465077-0
Opcode ID: 6be970c317f049458fe6ed43ee86a8ea9f57e038c5b2517a8cf02cdeca8a3095
Instruction ID: c4101c22455ece0e5db5df02ae07c6e272dab6b6df6809b486dffeb643fc604c
Opcode Fuzzy Hash: 6be970c317f049458fe6ed43ee86a8ea9f57e038c5b2517a8cf02cdeca8a3095
Instruction Fuzzy Hash: 55312D70A44604FFEB50DBE1DD0ABED7B74BB4870AF108979F209AA1D0DAB415408F5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E010, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33librarymemorystringCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00416B9C), ref: 0040E01B
lstrcpy.KERNEL32(00427BE8,00416BB8), ref: 0040E037
VirtualProtect.KERNELBASE(00428AE4,0048E5EC,00000040,?), ref: 0040E09F

Strings

@, xrefs: 0040E059

Memory Dump Source

Source File: 00000011.00000002.342914379.000000000040A000.00000020.00020000.sdmp, Offset: 0040A000, based on PE: false

Similarity

API ID: LibraryLoadProtectVirtuallstrcpy
String ID: @
API String ID: 2834514698-2766056989
Opcode ID: 97a83ae4951357697bf0532ff02359068473342de8675ae743db6df910dd7c92
Instruction ID: b2bc6ae5ef521cdb534ac7602f0bde13ec116e35e9d0bd19121a12df56279631
Opcode Fuzzy Hash: 97a83ae4951357697bf0532ff02359068473342de8675ae743db6df910dd7c92
Instruction Fuzzy Hash: F3015E3060C6C4DBD721CBA8EC09B863FA4571570DFD441A8E5444B3A1D7FA7159C76E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E0C4496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6E0C49A4: ZwAllocateVirtualMemory.9419(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6E0C44B7,?), ref: 6E0C49DF
Part of subcall function 6E0C49A4: RtlCompareMemory.9419(?,01000000,?,00000000,?,00000000,?,?,6E0C44B7,?), ref: 6E0C49FE
Part of subcall function 6E0C49A4: DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?), ref: 6E0C4A42
Part of subcall function 6E0C49A4: DbgPrint.9419(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6E0C4A66

ZwAllocateVirtualMemory.9419(000000FF,?,00000000,?,00001000,00000004), ref: 6E0C459A
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C), ref: 6E0C4657
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C,6E05F07A), ref: 6E0C4664
DbgPrint.9419(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C), ref: 6E0C4670
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C), ref: 6E0C46B8
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C,6E05F07A), ref: 6E0C46C5
DbgPrint.9419(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20), ref: 6E0C46D4
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C), ref: 6E0C47CB
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C,6E05F07A), ref: 6E0C47D8
DbgPrint.9419(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20), ref: 6E0C47E7
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C), ref: 6E0C4856
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C,6E05F07A), ref: 6E0C4863
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C), ref: 6E0C491C
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C,6E05F07A), ref: 6E0C4929
DbgPrint.9419(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6E0C4942
DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C), ref: 6E0C4970
DbgPrint.9419(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6E0E0F20,0000001C,6E05F07A), ref: 6E0C497D
DbgPrint.9419(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6E0C4997

Strings

dedicated (%04Ix) free list element %p is marked busy, xrefs: 6E0C46CF
HEAP: , xrefs: 6E0C465F, 6E0C46C0, 6E0C47D3, 6E0C485E, 6E0C4924, 6E0C4978
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6E0C47E2
Non-Dedicated free list element %p is out of order, xrefs: 6E0C466B
HEAP[%wZ]: , xrefs: 6E0C4652, 6E0C46B3, 6E0C47C6, 6E0C4851, 6E0C4917, 6E0C496B
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6E0C486F
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6E0C493D
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6E0C4992

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: 1fad3e63cfa45cee80961f79bf799b6a72718d63e06fdb62af134d3f4b35889e
Instruction ID: c7435cd772f04bfa03b1c6a8304021b96b38fef7a1ed0857b454d68d1319b882
Opcode Fuzzy Hash: 1fad3e63cfa45cee80961f79bf799b6a72718d63e06fdb62af134d3f4b35889e
Instruction Fuzzy Hash: E3F12131910646EFDB11CFE9C490BEEB7F5FF49B04F508529E0569B241C730A98ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E0BCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6E00F108: RtlOpenCurrentUser.9419(02000000,00000000,?,00000000,02000000,?,6E0BCFA7,?,?,?), ref: 6E00F12C

RtlInitUnicodeString.9419(?,Control Panel\Desktop,?,?,?), ref: 6E0BCFC1
RtlInitUnicodeString.9419(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6E0BCFE1
ZwOpenKey.9419(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6E0BD020
RtlInitUnicodeString.9419(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6E0BD035
ZwClose.9419(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6E0BD06D
RtlInitUnicodeString.9419(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6E0BD080
ZwOpenKey.9419(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6E0BD0B8
RtlInitUnicodeString.9419(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6E0BD0CD
ZwClose.9419(?,?,?,?), ref: 6E0BD139
ZwClose.9419(00000000,?,?,?), ref: 6E0BD14E

Strings

MachinePreferredUILanguages, xrefs: 6E0BD02B
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6E0BD072
PreferredUILanguages, xrefs: 6E0BD0C3
Control Panel\Desktop, xrefs: 6E0BCFBB
@, xrefs: 6E0BD0A7
Control Panel\Desktop\MuiCached, xrefs: 6E0BCFDB
@, xrefs: 6E0BD010

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: a0447763e5d8be9ac26cf16433a2064bbd80526db2e7cc866e9aa9f1f42dd0cb
Instruction ID: bf99d341e21835172d6bfffdeb9797182cfa8547cf0634b5dc270ad265aa452e
Opcode Fuzzy Hash: a0447763e5d8be9ac26cf16433a2064bbd80526db2e7cc866e9aa9f1f42dd0cb
Instruction Fuzzy Hash: 71512071808706AFD311CF99D980B9BF7E8BB89758F404E2EF594A7250D731DA058F92

Uniqueness

Uniqueness Score: -1.00%

Function 6E002FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262timeCOMMON

Download Yara Rule

APIs

RtlDeleteCriticalSection.9419(?,00000000,00008000), ref: 6E003070
RtlGetCurrentServiceSessionId.9419(00000000,00008000), ref: 6E00308F
RtlGetCurrentServiceSessionId.9419 ref: 6E0030B1
RtlGetCurrentServiceSessionId.9419 ref: 6E0030D3
DbgPrint.9419(HEAP[%wZ]: ,-0000002C), ref: 6E05FBAB
DbgPrint.9419((HeapHandle != NULL)), ref: 6E05FBC3
RtlDebugPrintTimes.9419(?), ref: 6E05FC36

Part of subcall function 6E0031B0: RtlAcquireSRWLockExclusive.9419(6E0F8660,?,00000000,6E05FC0E), ref: 6E0031BC
Part of subcall function 6E0031B0: RtlReleaseSRWLockExclusive.9419(6E0F8660,6E0F8660,?,00000000,6E05FC0E), ref: 6E0031CF

Strings

HEAP: , xrefs: 6E05FBB3
(HeapHandle != NULL), xrefs: 6E05FBBE
HEAP[%wZ]: , xrefs: 6E05FBA6

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: 26f335625d7e66dbcf391e5b89d35a921fb10aa3846d924a8be63274e0627d0d
Instruction ID: fc9473bdd8f6837e4136933a7a3cd22270d6a54462f5fbb1a3627c361f2abac2
Opcode Fuzzy Hash: 26f335625d7e66dbcf391e5b89d35a921fb10aa3846d924a8be63274e0627d0d
Instruction Fuzzy Hash: 5A913630705A01DFE316CBE5C968FAEB7E9BF49744F104869E8408B380DB39D950CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E006F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235nativememoryCOMMON

Download Yara Rule

APIs

ZwOpenKey.9419(?,?,?,?,00020019,00000018), ref: 6E006FBF

Part of subcall function 6E049600: LdrInitializeThunk.NTDLL(6E041119,?,?,00000018,?), ref: 6E04960A

memcpy.9419(?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6E00701D
RtlInitUnicodeString.9419(?,?,?,?,?,?,00020019,00000018), ref: 6E0620F3
ZwOpenKey.9419(?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6E06212F
RtlInitUnicodeString.9419(?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6E06215C
RtlAllocateHeap.9419(?,00000000,?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6E062182
ZwClose.9419(00000000,?,?,?,?,00020019,00000018), ref: 6E0622A5

Strings

@, xrefs: 6E06211F
TargetPath, xrefs: 6E062151, 6E062156

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode$AllocateCloseHeapInitializeThunkmemcpy
String ID: @$TargetPath
API String ID: 1135747570-4164548946
Opcode ID: 012ab4338605d508047be51d92eb9c71c69755c6c8f6554168bf46a663e50b6d
Instruction ID: 07ded2e9f96558fbb55193b7ec884796f2f502631a81df5361e5e01ad9aff599
Opcode Fuzzy Hash: 012ab4338605d508047be51d92eb9c71c69755c6c8f6554168bf46a663e50b6d
Instruction Fuzzy Hash: 1381CC72908317EFE710DFA8D880B9BB7F8BB94348F058A2DE9549B250D335D945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E095F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161memorynativefileCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.9419(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 6E095FD9
ZwOpenFile.9419(?,00100001,?,?,00000007,00004021), ref: 6E096020
ZwClose.9419(00000000,?,00100001,?,?,00000007,00004021), ref: 6E09603F
RtlFreeHeap.9419(?,00000000,?,00000000,?,00100001,?,?,00000007,00004021), ref: 6E096050
RtlFreeHeap.9419(?,00000000,00000000,?,00100001,?,?,00000007,00004021), ref: 6E096061
RtlAllocateHeap.9419(?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6E09607F
ZwClose.9419(00000000,?,00100001,?,?,00000007,00004021), ref: 6E09612E

Part of subcall function 6E0165BA: RtlInitUnicodeStringEx.9419(?,?,?), ref: 6E0165CA

RtlInitUnicodeString.9419(?,?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6E09609D
ZwQueryDirectoryFile.9419(?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?,00000008,00000410,?), ref: 6E0960BC
RtlAllocateHeap.9419(?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6E0960E0
memcpy.9419(00000000,0000005E,?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000), ref: 6E0960FA
RtlFreeHeap.9419(?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6E09611E

Strings

@, xrefs: 6E096017

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeInitStringUnicode$AllocateCloseFile$DirectoryOpenQuerymemcpy
String ID: @
API String ID: 1610808139-2766056989
Opcode ID: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction ID: 12e36819d282ca736fb9fa1f5220f3f9bf1fb8cc57dd535ca0d6a81af7e7493c
Opcode Fuzzy Hash: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction Fuzzy Hash: 8551CB72518706EFD7118FA4D940FABB7E8FB84754F000929FA5097290E7B1E904EBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6E03AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205nativeCOMMON

Download Yara Rule

APIs

ZwFreeVirtualMemory.9419(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6E03AD0B
RtlFillMemoryUlong.9419(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6E079F5B

Strings

HEAP: , xrefs: 6E07A0BA
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6E07A0CD
HEAP[%wZ]: , xrefs: 6E07A0AD

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: 9e4563d73a59d0f6c0aeade0b18adbae356b708f4220545aca100277a875594a
Instruction ID: 76c0c9d2764305074f4fc3a68101a0e93256087caaa3e80d4e9510eb4d19c1a1
Opcode Fuzzy Hash: 9e4563d73a59d0f6c0aeade0b18adbae356b708f4220545aca100277a875594a
Instruction Fuzzy Hash: 68812531244A96EFDB22CBE8C894F9ABBF8FF05355F2005A5E5918B792D734E940CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6E040F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.9419(?,?,00000018), ref: 6E041015
ZwClose.9419(?,?,?,00000018), ref: 6E041078
ZwClose.9419(?,?,?,?,?,00000018), ref: 6E041084

Strings

FilterFullPath, xrefs: 6E07CCF4
UseFilter, xrefs: 6E07CD29

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: 994c6c103c9483c8a68da1de147533006e87e0917800b0a813a1218ec00fcffd
Instruction ID: 259376f8885ca56da9e5fcdaac279188e9032741f48e3a4f8ace3828948684e3
Opcode Fuzzy Hash: 994c6c103c9483c8a68da1de147533006e87e0917800b0a813a1218ec00fcffd
Instruction Fuzzy Hash: 8261CE72508342DFD711CFE58640B6FBBE8AF89758F04493DF884A7250E771D9088B92

Uniqueness

Uniqueness Score: -1.00%

Function 6E0B64FB, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 125nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.9419(?,00000001,?,00000124,00000000,00000000), ref: 6E0B6598

Part of subcall function 6E049600: LdrInitializeThunk.NTDLL(6E041119,?,?,00000018,?), ref: 6E04960A

ZwQueryValueKey.9419(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6E0B65BA
RtlEqualUnicodeString.9419(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6E0B65EC
RtlEqualUnicodeString.9419(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6E0B6602
ZwClose.9419(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6E0B663B

Strings

LanmanNt, xrefs: 6E0B656D
\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6E0B655B
WinNt, xrefs: 6E0B657B
ServerNt, xrefs: 6E0B6574
ProductType, xrefs: 6E0B6566

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-2051245877
Opcode ID: 95c176779ac59da1fbf1cf0366a3d9cb46264983c52cf7da6fe1be083a8e161e
Instruction ID: b7d6e88e9fa3d75eb56fd54979d2fc3830182338d61f2650284455409fe3ec7a
Opcode Fuzzy Hash: 95c176779ac59da1fbf1cf0366a3d9cb46264983c52cf7da6fe1be083a8e161e
Instruction Fuzzy Hash: 69416AB2C1020DEADB10CFE8E991BDEB7BCFF08304F60402AE510AB250E7728909CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6E083C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

wcschr.9419(?,0000003D,00000000,?), ref: 6E083CAC
RtlInitUnicodeString.9419(?,-00000002,00000000,?), ref: 6E083CD0
wcstoul.9419(-00000002,?,00000010,00000000,?), ref: 6E083CEC
RtlAnsiStringToUnicodeString.9419(?,?,00000001,00000000,?), ref: 6E083D72
RtlCompareUnicodeString.9419(?,?,00000001,?,?,00000001,00000000,?), ref: 6E083D89
ZwProtectVirtualMemory.9419(000000FF,?,?,00000000,?,00000000,?), ref: 6E083DBC
DbgPrintEx.9419(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6E083DD6
RtlFreeUnicodeString.9419(?,00000000,?), ref: 6E083DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6E083DCD

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: cadeada5c02c150227893081aabf0eb6a8da4a91e71415152c7fca17e4362bc3
Instruction ID: fc4702c7cc408dae0981c8551ae7db44c63d458dd6134f1a760eaad91d891a03
Opcode Fuzzy Hash: cadeada5c02c150227893081aabf0eb6a8da4a91e71415152c7fca17e4362bc3
Instruction Fuzzy Hash: BD41D232D0060AAADF04CBE5DC65BEFB7F8AF5C350F50452AE951A3180E7799A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E0337EB, Relevance: 15.3, APIs: 10, Instructions: 269memorynativeCOMMON

Download Yara Rule

APIs

RtlImageNtHeader.9419(?,6E0DFF48,00000050,6E033E98,?,6E02F900,00000000,00000000,?,?,?,6E0DFEB8,0000001C,6E002C4C,?), ref: 6E033817

Part of subcall function 6E01B060: RtlImageNtHeaderEx.9419(00000001,?,00000000,00000000,?,?,?,6E03381C,?,6E0DFF48,00000050,6E033E98,?,6E02F900,00000000,00000000), ref: 6E01B076

RtlAllocateHeap.9419(?,?,00000120,?,6E0DFF48,00000050,6E033E98,?,6E02F900,00000000,00000000,?,?,?,6E0DFEB8,0000001C), ref: 6E033860
RtlAllocateHeap.9419(?,?,00000000,?,?,00000120,?,6E0DFF48,00000050,6E033E98,?,6E02F900,00000000,00000000), ref: 6E03389D
RtlAllocateHeap.9419(?,?,?,?,?,00000000,?,?,00000120,?,6E0DFF48,00000050,6E033E98,?,6E02F900,00000000), ref: 6E033916
RtlAllocateHeap.9419(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6E0DFF48,00000050,6E033E98), ref: 6E03394D
ZwCreateIoCompletion.9419(00000028,001F0003,00000000,?), ref: 6E0339C2
ZwCreateWorkerFactory.9419(00000024,000F00FF,00000000,?,000000FF,6E02C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6E033A0C
RtlAcquireSRWLockExclusive.9419(6E0F86B4,00000000,00000024,000F00FF,00000000,?,000000FF,6E02C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6E033A8D
RtlGetCurrentServiceSessionId.9419(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6E0DFF48,00000050,6E033E98), ref: 6E033AF5
ZwSetInformationWorkerFactory.9419(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6E02C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6E033B1F

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: 894c6c9325aa9b5f7ee8e4019da11a3a57b26f61f15ab127892486abddfd1de1
Instruction ID: 69b2ff4b015ed4f6b58e7be8c9a438c1b1caa4bd3d51f1120cd4791f897d4db6
Opcode Fuzzy Hash: 894c6c9325aa9b5f7ee8e4019da11a3a57b26f61f15ab127892486abddfd1de1
Instruction Fuzzy Hash: 83B157B190061ADFCB15CF99D984B9EBBF9FB49304F24842EE52AAB350D734A901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E03DE9E, Relevance: 13.6, APIs: 9, Instructions: 79memorynativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.9419(?,00000000,?,00000000,?,?,6E003A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6E03DEB5
RtlAcquireSRWLockExclusive.9419(?,?,00000000,?,00000000,?,?,6E003A82,?,?,?,?,?,00000001,00000000,?), ref: 6E03DEBE

Part of subcall function 6E022280: RtlDllShutdownInProgress.9419(00000000), ref: 6E0222BA
Part of subcall function 6E022280: ZwWaitForAlertByThreadId.9419(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6E0223A3

RtlGetCurrentServiceSessionId.9419(?,?,00000000,?,00000000,?,?,6E003A82,?,?,?,?,?,00000001,00000000,?), ref: 6E03DECE
ZwUnsubscribeWnfStateChange.9419(?,?,?,00000000,?,00000000,?,?,6E003A82,?,?,?,?,?,00000001,00000000), ref: 6E03DEEE
RtlReleaseSRWLockExclusive.9419(?,?,?,?,00000000,?,00000000,?,?,6E003A82,?,?,?,?,?,00000001), ref: 6E03DF0A
RtlFreeHeap.9419(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6E003A82,?), ref: 6E03DF25
RtlReleaseSRWLockExclusive.9419(?,?,?,?,00000000,?,00000000,?,?,6E003A82,?,?,?,?,?,00000001), ref: 6E03DF33
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,00000000,?,?,6E003A82,?,?,?,?,?,00000001,00000000), ref: 6E03DF40
RtlFreeHeap.9419(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6E003A82,?), ref: 6E07B46E

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: 5433dba7e8409f0a3ed1cb2b34836360186157d4e113e837d4861c7714d1dcf4
Instruction ID: 04442b8f70d9b13f95d18e977fea882563bd903adfb48411871e3015e6afb053
Opcode Fuzzy Hash: 5433dba7e8409f0a3ed1cb2b34836360186157d4e113e837d4861c7714d1dcf4
Instruction Fuzzy Hash: 5C21FF71114641EFCB219BE9C880F96B7FDFF4235CF244A69E405AB6A8D730E841CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E00C600, Relevance: 12.2, APIs: 8, Instructions: 225memorynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeStringEx.9419(?,?,?,?,?), ref: 6E00C639
ZwQueryValueKey.9419(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6E00C665
RtlFreeHeap.9419(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6E077A15
RtlAllocateHeap.9419(?,?,?,?,?,?,?,?), ref: 6E077A43
ZwQueryValueKey.9419(?,?,00000002,00000000,?,?,?,?), ref: 6E077A65
RtlFreeHeap.9419(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6E077A8A
RtlUnicodeStringToInteger.9419(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6E077B52
memcpy.9419(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6E077BB1

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: 56665c8b35b71995e4589b28517b96eff528ea683d3758d8a817847116508f43
Instruction ID: bbe9bfa182125ef253d39e84b97e39c6dd498cd3bf8fabb62a6840b00cbd829a
Opcode Fuzzy Hash: 56665c8b35b71995e4589b28517b96eff528ea683d3758d8a817847116508f43
Instruction Fuzzy Hash: A481B4716582029FDF21CE94C890B6E77E8FB843D5F184929FD848B284D330DD44CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6E02B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 6E072BE8
HEAP[%wZ]: , xrefs: 6E072BDB
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6E072BF3

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: c46c097963ea0e91f8d7ce0294cecd7fa64fc0391deeb6b06295fb2c4e7ac95f
Instruction ID: 886218473d2b3532021737051a718583a11201ee0bd95d1d7f7db79696d78c64
Opcode Fuzzy Hash: c46c097963ea0e91f8d7ce0294cecd7fa64fc0391deeb6b06295fb2c4e7ac95f
Instruction Fuzzy Hash: BA61DC70600201DFDB18CFA8C480BAABBF5FF45748F6485AEE8598B249D730E881CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E003FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

DbgPrint.9419(HEAP[%wZ]: ,-0000002C,?,?,?,?,6E0C3933,RtlGetUserInfoHeap), ref: 6E0603D9
DbgPrint.9419(HEAP: ,?,?,?,?,6E0C3933,RtlGetUserInfoHeap), ref: 6E0603E6
DbgPrint.9419(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6E0C3933,RtlGetUserInfoHeap), ref: 6E0603F9

Strings

HEAP: , xrefs: 6E0603E1
HEAP[%wZ]: , xrefs: 6E0603D4
Invalid address specified to %s( %p, %p ), xrefs: 6E0603F4

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: 768db5b48206770125f3cb20958a929236f77d959fc90777e43c7efe8d7d1dda
Instruction ID: d2a838c0179e096a9b25b6812ea9a895b90e687ec3fdb416318f11edf2b6769c
Opcode Fuzzy Hash: 768db5b48206770125f3cb20958a929236f77d959fc90777e43c7efe8d7d1dda
Instruction Fuzzy Hash: FB41A630248302DFFBB4CBD9C0D07AA73E89F12388F044469D4454B266D3B2D986CB26

Uniqueness

Uniqueness Score: -1.00%

Function 6E039ED0, Relevance: 10.6, APIs: 7, Instructions: 125COMMON

Download Yara Rule

APIs

RtlReleaseSRWLockExclusive.9419(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6E079836
RtlReleaseSRWLockShared.9419(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6E07984A
RtlAcquireSRWLockExclusive.9419(?), ref: 6E07987A
RtlAcquireSRWLockShared.9419(?), ref: 6E079897
RtlReleaseSRWLockExclusive.9419(?), ref: 6E0798B3

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: db44f892c1baba3e410e966195f1d154029bade3fc25046609cc171e84d3e1e4
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: B241B07161C3528FCB44CEA9C80074FB7E9AFC5318FA9491DF894A7245D634E90887E7

Uniqueness

Uniqueness Score: -1.00%

Function 6E09FF10, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.9419(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6E0E09B0,00000014,6E01EBD8,?,?,?,00000000,?,6E001E03,?), ref: 6E09FF69
RtlDecodePointer.9419(6E0E09B0,00000014,6E01EBD8,?,?,?,00000000,?,6E001E03,?,6E001D6E,?), ref: 6E09FF78
RtlRaiseStatus.9419(C0000264,6E0E09B0,00000014,6E01EBD8,?,?,?,00000000,?,6E001E03,?,6E001D6E,?), ref: 6E09FF89
RtlDebugPrintTimes.9419(?,C0000264,6E0E09B0,00000014,6E01EBD8,?,?,?,00000000,?,6E001E03,?,6E001D6E,?), ref: 6E09FF9A
RtlpNotOwnerCriticalSection.9419 ref: 6E09FFB1

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6E09FF60

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CriticalDebugDecodeOwnerPointerRaiseRtlpSectionStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 2675442896-1911121157
Opcode ID: 59fba93484526faf906dd7b8e0fef1195b952ef610755065d21f8de9846309e4
Instruction ID: 4124e3e0e86002ef62bcd8b2fc4d16ac71b8a4526db5e2e3883ea9e9825809bd
Opcode Fuzzy Hash: 59fba93484526faf906dd7b8e0fef1195b952ef610755065d21f8de9846309e4
Instruction Fuzzy Hash: 9311CB75910244EFCF12CF90C954BA9BBB5BF08309F208854F508AB2A1C7399990EB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E0D2EF7, Relevance: 9.2, APIs: 6, Instructions: 183timeCOMMON

Download Yara Rule

APIs

_allshl.9419(?,00000000,00000000,00000000,?,?,?,?,6E0CB632,?,00000000), ref: 6E0D303C
_allshl.9419(?,00000000,00000000,00000000,?,?,?,?,6E0CB632,?,00000000), ref: 6E0D3049
RtlAcquireSRWLockExclusive.9419(?,?,00000000,00000000,00000000,?,?,?,?,6E0CB632,?,00000000), ref: 6E0D305E
RtlDebugPrintTimes.9419(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6E0D3081
RtlDebugPrintTimes.9419(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6E0D30AF
RtlReleaseSRWLockExclusive.9419(?), ref: 6E0D30DB

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: ad6e28981693f204c9e491ddd0abaf3953e003d1a6ae81a17be3f6fcdb861310
Instruction ID: 043dac864bf440bcb27e53615307c41365b7a6d311912a379c5c89c283fe8203
Opcode Fuzzy Hash: ad6e28981693f204c9e491ddd0abaf3953e003d1a6ae81a17be3f6fcdb861310
Instruction Fuzzy Hash: 41511A326043559FC704CFAAC89066ABBF6FF893117068669E895DB281DB34D916CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6E085623, Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.9419(00000000,00000002,?,6E07E4BC,6E0E03D0,0000000C,6E079687,00000000,00000000,00000001,?,?,7FFE0386,?,6E006778,00000001), ref: 6E085628
RtlGetCurrentServiceSessionId.9419 ref: 6E085661
RtlTryEnterCriticalSection.9419(6E0F5350,00000000,00000002,?,6E07E4BC,6E0E03D0,0000000C,6E079687,00000000,00000000,00000001,?,?,7FFE0386,?,6E006778), ref: 6E08569B
RtlGetCurrentServiceSessionId.9419(6E0F5350,00000000,00000002,?,6E07E4BC,6E0E03D0,0000000C,6E079687,00000000,00000000,00000001,?,?,7FFE0386,?,6E006778), ref: 6E0856A2
RtlGetCurrentServiceSessionId.9419 ref: 6E0856D2
RtlGetCurrentServiceSessionId.9419 ref: 6E08572F

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 1902a220b9afb02b7d55b281df950ef051560d30e8f94d511b797f4a1bbda299
Instruction ID: 74398c0fbb0b4f26b184ac447754bae95c6f1454d11a38c7287d60a3313a4e7f
Opcode Fuzzy Hash: 1902a220b9afb02b7d55b281df950ef051560d30e8f94d511b797f4a1bbda299
Instruction Fuzzy Hash: D631E639645B83DFEB2287E8DD64F5637D4BB027B4F2807A0E9718B6E2DB689400C210

Uniqueness

Uniqueness Score: -1.00%

Function 6E00F7C0, Relevance: 9.1, APIs: 6, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.9419(00000058,00000000,00000000,00000000,?,6E0776A7,?,?,00000000,6DFE67CC,00000000,00000000,?,00000040), ref: 6E00F7F5
RtlReleaseSRWLockExclusive.9419(00000058,00000058,00000000,00000000,00000000,?,6E0776A7,?,?,00000000,6DFE67CC,00000000,00000000,?,00000040), ref: 6E00F860

Part of subcall function 6E00F8C8: RtlAcquireSRWLockExclusive.9419(6E0F86AC,00000058,?,00000030,6E00F813,00000058,00000000,00000000,00000000,?,6E0776A7,?,?,00000000,6DFE67CC,00000000), ref: 6E00F8D5
Part of subcall function 6E00F8C8: RtlRbRemoveNode.9419(6E0F86DC,00000030,6E0F86AC,00000058,?,00000030,6E00F813,00000058,00000000,00000000,00000000,?,6E0776A7,?,?,00000000), ref: 6E00F8E0
Part of subcall function 6E00F8C8: RtlReleaseSRWLockExclusive.9419(6E0F86AC,6E0F86DC,00000030,6E0F86AC,00000058,?,00000030,6E00F813,00000058,00000000,00000000,00000000,?,6E0776A7,?,?), ref: 6E00F8EE

RtlReleaseSRWLockExclusive.9419(00000058,00000058,00000000,00000000,00000000,?,6E0776A7,?,?,00000000,6DFE67CC,00000000,00000000,?,00000040), ref: 6E00F814
ZwClose.9419(?,00000058,00000058,00000000,00000000,00000000,?,6E0776A7,?,?,00000000,6DFE67CC,00000000,00000000,?,00000040), ref: 6E00F82E
RtlSetLastWin32Error.9419(00000006,00000000,00000000,00000000,?,6E0776A7,?,?,00000000,6DFE67CC,00000000,00000000,?,00000040), ref: 6E00F867

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: da607a5c571bfa6cbb6cea9529723dfed3e0d21f3f5d41d10970e85fd73b7c42
Instruction ID: 0a99e19e0dfa77d995f3bcfccb9a6c095ba9509bf9cd4fd3e758c47c8f498a11
Opcode Fuzzy Hash: da607a5c571bfa6cbb6cea9529723dfed3e0d21f3f5d41d10970e85fd73b7c42
Instruction Fuzzy Hash: 0A11B2362142069BFB41EFD1C8C0BEA33ADAF41B54FA44529ED145F149DB309886A7A8

Uniqueness

Uniqueness Score: -1.00%

Function 6E0D3E22, Relevance: 7.6, APIs: 5, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

ZwTraceControl.9419(0000001A,6E0F5338,00000008,00000000,00000000,?,6E0F5338,00000000,6E0F5320,6E0F5320,6E0F5338,?,6E0F84E0,?,00000001,6DFE5C80), ref: 6E0D3E5D
RtlNtStatusToDosError.9419(00000000,0000001A,6E0F5338,00000008,00000000,00000000,?,6E0F5338,00000000,6E0F5320,6E0F5320,6E0F5338,?,6E0F84E0,?,00000001), ref: 6E0D3E6B
RtlAcquireSRWLockExclusive.9419(6E0F8504,00000000,0000001A,6E0F5338,00000008,00000000,00000000,?,6E0F5338,00000000,6E0F5320,6E0F5320,6E0F5338,?,6E0F84E0), ref: 6E0D3E7A
RtlReleaseSRWLockExclusive.9419(6E0F8504,6E0F8504,00000000,0000001A,6E0F5338,00000008,00000000,00000000,?,6E0F5338,00000000,6E0F5320,6E0F5320,6E0F5338,?,6E0F84E0), ref: 6E0D3EA1
RtlSetLastWin32Error.9419(00000006,6E0F5338,00000000,6E0F5320,6E0F5320,6E0F5338,?,6E0F84E0,?,00000001,6DFE5C80,6E00591B), ref: 6E0D3EAC

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID:
API String ID: 1422652320-0
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: 6c1cc75236091372045ba722c72339e8ac077eae770d3d274603d4fd97b2cbfa
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: 3911C472600214A6DB509FD9C884BDF7BACEF49750F404525EC089B188DB34D9098BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E09176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

ZwOpenEvent.9419(00000568,00100001,?,?,00000000), ref: 6E0917B5
ZwWaitForSingleObject.9419(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6E0917E1
ZwClose.9419(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6E0917EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6E09178B

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: 401c786b60a10e1f354dcaf3dd189018021eb86f6c475eaa594f8fee15d9bea9
Instruction ID: 013c97986613d14aa917016d5c59060a291c2e5e52c635574be24b41564f5ad7
Opcode Fuzzy Hash: 401c786b60a10e1f354dcaf3dd189018021eb86f6c475eaa594f8fee15d9bea9
Instruction Fuzzy Hash: C8117075E0021DAACB10CFE99941AEEFBFCEF89210F10426BE914F3290E7704A05DB95

Uniqueness

Uniqueness Score: -1.00%

Function 6E006730, Relevance: 6.1, APIs: 4, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.9419 ref: 6E00674F
RtlGetCurrentServiceSessionId.9419(00000001), ref: 6E00677C
RtlDebugPrintTimes.9419(?,?,?,?,00000001), ref: 6E0067B1
RtlGetCurrentServiceSessionId.9419 ref: 6E0067B9

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: 636ebeae21886848f9274e2c6f7f403bb25d81a1cbac6e010a1bb911d848bfbb
Instruction ID: c7f1fc6c0b8a934be6476281576dd823115e03a13f9076e3174cc7c4721c1c5e
Opcode Fuzzy Hash: 636ebeae21886848f9274e2c6f7f403bb25d81a1cbac6e010a1bb911d848bfbb
Instruction Fuzzy Hash: A331CD35625A06BFDB428FA4DA80B8ABBB6FF45754F805425EC0547E60DB31E874CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E096652, Relevance: 6.1, APIs: 4, Instructions: 74memorynativeCOMMON

Download Yara Rule

APIs

ZwClose.9419(00000000,00000000,00000000,00000000,?,?,6E07B381,00000001,6E0F861C,6E0E0268,00000020,6E01BE44,?,00000000,?,00000001), ref: 6E09668C
RtlAllocateHeap.9419(?,00000008,?,00000000,00000000,00000000,?,?,6E07B381,00000001,6E0F861C,6E0E0268,00000020,6E01BE44,?,00000000), ref: 6E0966D0

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCloseHeap
String ID:
API String ID: 3565931908-0
Opcode ID: 7d4a443dcf934d430d67e2332c05bdf24b4080cfb2226c9d37e1b4cc4d7b151d
Instruction ID: 7060f6fdb04623b1151a83097ae9d58ba0687f8b7c3f8c518ac2057f5a709cdf
Opcode Fuzzy Hash: 7d4a443dcf934d430d67e2332c05bdf24b4080cfb2226c9d37e1b4cc4d7b151d
Instruction Fuzzy Hash: 7E21A871620B13ABD6414EA5B950751F7B8BB113B8F011326EC31935D1C772E861F6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6E043EE4, Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.9419(?,00000008,00000028,?,?,6E068546), ref: 6E043F07
RtlGetLocaleFileMappingAddress.9419(00000000,6E0F65D4,6E068546,?,00000008,00000028,?,?,6E068546), ref: 6E043F23

Part of subcall function 6E043FA0: ZwInitializeNlsFiles.9419(00000028,00000008,?,?,?,00000000,?,6E043F28,00000000,6E0F65D4,6E068546,?,00000008,00000028,?), ref: 6E043FCD

RtlFreeHeap.9419(?,00000000,00000000,00000000,6E0F65D4,6E068546,?,00000008,00000028,?,?,6E068546), ref: 6E07E7D3
RtlFreeHeap.9419(?,00000000,00000000,00000000,6E0F65D4,6E068546,?,00000008,00000028,?,?,6E068546), ref: 6E07E7EB

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: ef3e871080406f49a502f42701cac76fa249e5eabc56b1f1de2fb7823a6c8c01
Instruction ID: 05afe4de3eb779da08ace01467f3061141555fa1251e09bb74668316f2841ba8
Opcode Fuzzy Hash: ef3e871080406f49a502f42701cac76fa249e5eabc56b1f1de2fb7823a6c8c01
Instruction Fuzzy Hash: C2219D79601A01DFCB24DFA9C900B9677F9AF08708F144879E819CBB61E730E853CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6E00A745, Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.9419(?,?,00000000,?,6E03DFD8,00000000,?,?,?,?,?,6E003DAD,?,00000000,6E0DF4D0,00000084), ref: 6E00A757
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,6E03DFD8,00000000,?,?,?,?,?,6E003DAD,?,00000000,6E0DF4D0), ref: 6E00A774
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,6E03DFD8,00000000,?,?,?,?,?,6E003DAD,?,00000000,6E0DF4D0), ref: 6E06442E
RtlFreeHeap.9419(?,00000000,00000000,?,?,?,00000000,?,6E03DFD8,00000000,?,?,?,?,?,6E003DAD), ref: 6E06443F

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: f6edf79791c2cd6bf939e9698b137d96fbf011892c28a5ee22b0a72bf375033c
Instruction ID: 21cf2b8d574f519ad835657433cde6a0b8e0843ee4cf97500d34f94b300d771c
Opcode Fuzzy Hash: f6edf79791c2cd6bf939e9698b137d96fbf011892c28a5ee22b0a72bf375033c
Instruction Fuzzy Hash: 8301A272146201EFD710DBAEDC01B95B7FDFF43328B54866AE5088B251DA75E841CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6E040E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.9419(?,00000000,00000618,?,?), ref: 6E040EDA
RtlRaiseException.9419 ref: 6E07CC58

Strings

Flst, xrefs: 6E040E63

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: 467490b1299aa6a28e7c5ee191237309b10f833b75c87d0a167811995a13acee
Instruction ID: 4dca756be5f5550c4ba24e09683081ac4a2bd127651aecb09c78d3611295518c
Opcode Fuzzy Hash: 467490b1299aa6a28e7c5ee191237309b10f833b75c87d0a167811995a13acee
Instruction Fuzzy Hash: 3141C9B1609302CFC714CF9AC690B1AFBE4EB59B00F14856EE459DF284EB31C841CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6E0066D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.9419(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6E0066F5
ZwQueryValueKey.9419(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6E00670B

Strings

UBR, xrefs: 6E0066EE

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: bac1d5f88488d7a3561a83a8b1b63ec321226220860ad3c141d358ae05d511a5
Instruction ID: 9af5927b6b3b5d1406dd1ca916930c316b397ee7fd95fbbd06abe98ea90c1558
Opcode Fuzzy Hash: bac1d5f88488d7a3561a83a8b1b63ec321226220860ad3c141d358ae05d511a5
Instruction Fuzzy Hash: 9F011A71A1410EEFEB00CAD99901BEEB3FCEB45714F500466E905A7100D771AA458BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E0C1C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6E0C1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6dfe48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6E00B150();
				} else {
					E6E00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6e0f589c);
				E6E00B150("Heap error detected at %p (heap handle %p)\n",  *0x6e0f58a0);
				_t27 =  *0x6e0f5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6E0C1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6E00B150();
				} else {
					E6E00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6E00B150("Error code: %d - %s\n",  *0x6e0f5898);
				_t113 =  *0x6e0f58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6E00B150();
					} else {
						E6E00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6E00B150("Parameter1: %p\n",  *0x6e0f58a4);
				}
				_t115 =  *0x6e0f58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6E00B150();
					} else {
						E6E00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6E00B150("Parameter2: %p\n",  *0x6e0f58a8);
				}
				_t117 =  *0x6e0f58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6E00B150();
					} else {
						E6E00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6E00B150("Parameter3: %p\n",  *0x6e0f58ac);
				}
				_t119 =  *0x6e0f58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6E00B150();
					} else {
						E6E00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6e0f58b4);
					E6E00B150("Last known valid blocks: before - %p, after - %p\n",  *0x6e0f58b0);
				} else {
					_t120 =  *0x6e0f58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6E00B150();
				} else {
					E6E00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6E00B150("Stack trace available at %p\n", 0x6e0f58c0);
			}

0x6e0c1c10
0x6e0c1c16
0x6e0c1c1e
0x6e0c1c3d
0x6e0c1c3e
0x6e0c1c20
0x6e0c1c35
0x6e0c1c3a
0x6e0c1c44
0x6e0c1c55
0x6e0c1c5a
0x6e0c1c65
0x6e0c1c67
0x00000000
0x6e0c1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e0c1c67
0x6e0c1cdc
0x6e0c1ce5
0x6e0c1d04
0x6e0c1d05
0x6e0c1ce7
0x6e0c1cfc
0x6e0c1d01
0x6e0c1d0b
0x6e0c1d17
0x6e0c1d1f
0x6e0c1d25
0x6e0c1d30
0x6e0c1d4f
0x6e0c1d50
0x6e0c1d32
0x6e0c1d47
0x6e0c1d4c
0x6e0c1d61
0x6e0c1d67
0x6e0c1d68
0x6e0c1d6e
0x6e0c1d79
0x6e0c1d98
0x6e0c1d99
0x6e0c1d7b
0x6e0c1d90
0x6e0c1d95
0x6e0c1daa
0x6e0c1db0
0x6e0c1db1
0x6e0c1db7
0x6e0c1dc2
0x6e0c1de1
0x6e0c1de2
0x6e0c1dc4
0x6e0c1dd9
0x6e0c1dde
0x6e0c1df3
0x6e0c1df9
0x6e0c1dfa
0x6e0c1e00
0x6e0c1e0a
0x6e0c1e13
0x6e0c1e32
0x6e0c1e33
0x6e0c1e15
0x6e0c1e2a
0x6e0c1e2f
0x6e0c1e39
0x6e0c1e4a
0x6e0c1e02
0x6e0c1e02
0x6e0c1e08
0x00000000
0x00000000
0x6e0c1e08
0x6e0c1e5b
0x6e0c1e7a
0x6e0c1e7b
0x6e0c1e5d
0x6e0c1e72
0x6e0c1e77
0x6e0c1e95

APIs

DbgPrint.9419(HEAP[%wZ]: ,?,?,00000002,6E0F58C0,6E0C20B1,?,6E0BFFAF,00000001,00000020,6E0F58C0,00000000), ref: 6E0C1C35
DbgPrint.9419(HEAP: ,?,00000002,6E0F58C0,6E0C20B1,?,6E0BFFAF,00000001,00000020,6E0F58C0,00000000), ref: 6E0C1C3E
DbgPrint.9419(Heap error detected at %p (heap handle %p),?,00000002,6E0F58C0,6E0C20B1,?,6E0BFFAF,00000001,00000020,6E0F58C0,00000000), ref: 6E0C1C55
DbgPrint.9419(HEAP[%wZ]: ,?,00000020,6E0F58C0,00000000), ref: 6E0C1CFC
DbgPrint.9419(HEAP: ,00000020,6E0F58C0,00000000), ref: 6E0C1D05
DbgPrint.9419(Error code: %d - %s,6DFE48A4,00000020,6E0F58C0,00000000), ref: 6E0C1D17
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1D47
DbgPrint.9419(HEAP: ,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1D50
DbgPrint.9419(Parameter1: %p,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1D61
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1D90
DbgPrint.9419(HEAP: ,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1D99
DbgPrint.9419(Parameter2: %p,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1DAA
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1DD9
DbgPrint.9419(HEAP: ,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1DE2
DbgPrint.9419(Parameter3: %p,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1DF3
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1E2A
DbgPrint.9419(HEAP: ,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1E33
DbgPrint.9419(Last known valid blocks: before - %p, after - %p,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1E4A
DbgPrint.9419(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1E72
DbgPrint.9419(Stack trace available at %p,6E0F58C0,?,?,?,?,?,?,?,6E0F58C0,00000000), ref: 6E0C1E8B

Strings

heap_failure_cross_heap_operation, xrefs: 6E0C1CC2
HEAP[%wZ]: , xrefs: 6E0C1C30, 6E0C1CF7, 6E0C1D42, 6E0C1D8B, 6E0C1DD4, 6E0C1E25, 6E0C1E6D
Heap error detected at %p (heap handle %p), xrefs: 6E0C1C50
Parameter1: %p, xrefs: 6E0C1D5C
heap_failure_multiple_entries_corruption, xrefs: 6E0C1C8A
heap_failure_usage_after_free, xrefs: 6E0C1CBB
heap_failure_internal, xrefs: 6E0C1C6E
HEAP: , xrefs: 6E0C1C16, 6E0C1C3D, 6E0C1D04, 6E0C1D4F, 6E0C1D98, 6E0C1DE1, 6E0C1E32, 6E0C1E7A
Last known valid blocks: before - %p, after - %p, xrefs: 6E0C1E45
heap_failure_invalid_allocation_type, xrefs: 6E0C1CB4
heap_failure_listentry_corruption, xrefs: 6E0C1CD0
heap_failure_buffer_overrun, xrefs: 6E0C1C98
heap_failure_block_not_busy, xrefs: 6E0C1CA6
Parameter2: %p, xrefs: 6E0C1DA5
heap_failure_freelists_corruption, xrefs: 6E0C1CC9
Error code: %d - %s, xrefs: 6E0C1D12
heap_failure_invalid_argument, xrefs: 6E0C1CAD
heap_failure_buffer_underrun, xrefs: 6E0C1C9F
heap_failure_generic, xrefs: 6E0C1C7C
heap_failure_entry_corruption, xrefs: 6E0C1C83
Parameter3: %p, xrefs: 6E0C1DEE
heap_failure_unknown, xrefs: 6E0C1C75
Stack trace available at %p, xrefs: 6E0C1E86
heap_failure_lfh_bitmap_mismatch, xrefs: 6E0C1CD7
heap_failure_virtual_block_corruption, xrefs: 6E0C1C91

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: d0c26459be181edb4c3bb528dfa15c6153f4a1f46d1f60def36c77e0fcc370ce
Instruction ID: 16479a3aacd3d77e65afaa88a62080fb838dd5971b9ca4eb76f49251ad420d23
Opcode Fuzzy Hash: d0c26459be181edb4c3bb528dfa15c6153f4a1f46d1f60def36c77e0fcc370ce
Instruction Fuzzy Hash: 2C61D436411854EFE6119BCDE584F6C73F8EB09F64B89847AF809AB321C6349C568E0B

Uniqueness

Uniqueness Score: -1.00%

Function 6E006CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243COMMON

Download Yara Rule

APIs

RtlIpv6StringToAddressA.9419(?,00000000,?,00000000), ref: 6E006CE2

Strings

[, xrefs: 6E061CCC

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: c5254875208e34f28c6b02591592086361897374344acc657e4d9184544c8c9b
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: 8271F231914257AAFB408AE8E860BFE77F9AF063A4F14456ED4E4DB6C0D735C1898710

Uniqueness

Uniqueness Score: -1.00%

Function 6E00F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185librarymemorytimeCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.9419(6E0F52D8), ref: 6E00F574
RtlLeaveCriticalSection.9419(6E0F52D8,?,00000000,6E0F52D8), ref: 6E00F58C
RtlAcquireSRWLockExclusive.9419 ref: 6E00F5B7
RtlRbRemoveNode.9419(6E0F85FC,-0000008C), ref: 6E00F5D2
RtlRbRemoveNode.9419(6E0F85F4,-00000098,6E0F85FC,-0000008C), ref: 6E00F5E0
RtlReleaseSRWLockExclusive.9419(6E0F84D8), ref: 6E00F5EE
LdrUnloadAlternateResourceModuleEx.9419(?,00000000,6E0F52D8), ref: 6E00F667
RtlAcquireSRWLockExclusive.9419(6E0F84D8,6E0F52D8,?,00000000,6E0F52D8), ref: 6E00F692
RtlReleaseSRWLockExclusive.9419(6E0F84D8,?,6E0F84D8,6E0F52D8,?,00000000,6E0F52D8), ref: 6E00F6D3
RtlFreeHeap.9419(00000000,-00000054,6E0F84D8,?,6E0F84D8,6E0F52D8), ref: 6E00F6E8
RtlDebugPrintTimes.9419(-00000054,?,6E0F52D8), ref: 6E00F73A

Strings

LdrpUnloadNode, xrefs: 6E065D28
Unmapping DLL "%wZ", xrefs: 6E065D21
minkernel\ntdll\ldrsnap.c, xrefs: 6E065D32

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: 480fda98febf8dafe428bd5e77b6bc79d2decfa711a7ebdc2506daa99579db9a
Instruction ID: b6c1c0357a5eafa97e3633901995cf0b1c00f7266166178ebfdd93c93279b79d
Opcode Fuzzy Hash: 480fda98febf8dafe428bd5e77b6bc79d2decfa711a7ebdc2506daa99579db9a
Instruction Fuzzy Hash: 11515731218702DFE714DFF8C884B9A73E9BF85358F200A2DE5958B291DB30A851DB96

Uniqueness

Uniqueness Score: -1.00%

Function 6E008EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6E06353D
SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6E063577
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6E0634FF
SsHd, xrefs: 6E008F1B
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6E06359D
SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6E06358E
SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6E0634F1
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6E06355D
RtlpCrackActivationContextStringSectionHeader, xrefs: 6E0634EC, 6E0634FA, 6E063517, 6E063538, 6E063548, 6E063558, 6E063572, 6E063589, 6E063598
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6E06354D
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6E06351C

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: ca4d5df0f47eecde60d9433b23941fc195944ee5d47c534c805a560ef31923dc
Instruction ID: 00cc5c3684bdf22c1d9bc663d39d413e3b3a9db92672ad50e21567a4c21d38ef
Opcode Fuzzy Hash: ca4d5df0f47eecde60d9433b23941fc195944ee5d47c534c805a560ef31923dc
Instruction Fuzzy Hash: BF4186B1600202BFB7148E9ECC85F3B77AEEBD97487608159B404AB112E772ED4287B1

Uniqueness

Uniqueness Score: -1.00%

Function 6E006D10, Relevance: 21.3, APIs: 14, Instructions: 316stringCOMMON

Download Yara Rule

APIs

__isascii.9419(?,?,?,00000000,?,00000000,?,00000000), ref: 6E006D5C
isdigit.9419(?,?,?,00000000,?,00000000,?,00000000), ref: 6E006D67
__isascii.9419(?,?,?,00000000,?,00000000,?,00000000), ref: 6E006D76
isxdigit.9419(?,?,?,00000000,?,00000000,?,00000000), ref: 6E006D81
__isascii.9419(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6E006DD4
isdigit.9419(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6E006DDF
__isascii.9419(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6E006DEA
isxdigit.9419(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6E006DF5
strtol.9419(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6E061F53

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: 6315aace69f3132c5d6fc94b586c5225466885b91fc0ba2b1d00edb2c963d718
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 77B1E870E2425ADFEB04CFE9D890BEEB7F6AF46344F10402AD844EB748D73099818790

Uniqueness

Uniqueness Score: -1.00%

Function 6E0946A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

DbgPrintEx.9419(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6E0517F0,00000000,?,00000000,?), ref: 6E0946ED

Part of subcall function 6E031D47: memset.9419(00000000,00000000,6E0517F0,?,00000001,00000000,?,6E008D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6E031D87

DbgPrintEx.9419(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6E0DFE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6E09474E
memcpy.9419(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6E0517F0,00000000,?,00000000), ref: 6E094831
memcpy.9419(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6E0517F0,00000000,?,00000000), ref: 6E0948A2

Strings

SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6E0946E5
SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6E094746
RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6E0946E0, 6E094741

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: 0bc0dda9e970eeed285c83bf31f01fcc88c6ae6479f0bf0c109fb5ca43c90cf0
Instruction ID: 3587446faa1a6a586d29136686f53e5b1dcef972d0f0affbb69009238f159e7e
Opcode Fuzzy Hash: 0bc0dda9e970eeed285c83bf31f01fcc88c6ae6479f0bf0c109fb5ca43c90cf0
Instruction Fuzzy Hash: 68812075D0021AEFDB00CF89C8C1AAEF7B5FF45345B149559E824AB315D330EA52EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E094496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

DbgPrintEx.9419(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6E0517F0,00000000,?,?), ref: 6E0944DB

Part of subcall function 6E031D47: memset.9419(00000000,00000000,6E0517F0,?,00000001,00000000,?,6E008D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6E031D87

memcpy.9419(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6E0517F0,00000000,?,?), ref: 6E0945F6
memcpy.9419(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6E0517F0,00000000,?,?), ref: 6E094620
memcpy.9419(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6E0517F0,00000000,?,?), ref: 6E09464A
memcpy.9419(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6E0517F0,00000000,?,?), ref: 6E094674

Strings

SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6E0944D3
RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6E0944CE

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: db94a792e143c53a176257ab941ecd6f670e68353aebac313f6ce9fb2b0a7c9d
Instruction ID: 8b8f46e5ae7521a284e7e4541f278cea9c4903ea68dacaadeae725295f3f3879
Opcode Fuzzy Hash: db94a792e143c53a176257ab941ecd6f670e68353aebac313f6ce9fb2b0a7c9d
Instruction Fuzzy Hash: 618104B5A00606EFC750CF69C880A9AB7F4FF08358B155569E818DB701E332F9A2DB95

Uniqueness

Uniqueness Score: -1.00%

Function 6E0C3518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

DbgPrint.9419(HEAP[%wZ]: ,-0000002C,00000000,?,?,6E05FC67), ref: 6E0C354D
DbgPrint.9419(HEAP: ,00000000,?,?,6E05FC67), ref: 6E0C355A
DbgPrint.9419(May not destroy the process heap at %p,?,00000000,?,?,6E05FC67), ref: 6E0C3566

Strings

HEAP: , xrefs: 6E0C3555
RtlDestroyHeap, xrefs: 6E0C3571
May not destroy the process heap at %p, xrefs: 6E0C3561
HEAP[%wZ]: , xrefs: 6E0C3548

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: 08b208c40b69222075054f1308e9b61fbd8748c4b3945031ceaae2bb5ca09de9
Instruction ID: 3d8f77b4a1abcd31e3095ddf026dd05cfdab3b0450e4f1c3c5269c51e86fc676
Opcode Fuzzy Hash: 08b208c40b69222075054f1308e9b61fbd8748c4b3945031ceaae2bb5ca09de9
Instruction Fuzzy Hash: F7012632120604EFC750DBE98448BEA73ECEF49F54F008895F8059B341DB39E945CA96

Uniqueness

Uniqueness Score: -1.00%

Function 6E01EC7F, Relevance: 12.3, APIs: 8, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.9419(6E0F84D8,6E0517F0,00000000,?,6E02F715,6E02F5C0,?,?,?,00000001,-00000F38), ref: 6E01ECAD
RtlReleaseSRWLockExclusive.9419(6E0F84D8,6E0F84D8,6E0517F0,00000000,?,6E02F715,6E02F5C0,?,?,?,00000001,-00000F38), ref: 6E01ECD2
RtlFreeHeap.9419(00000000,?,6E0F84D8,6E0F84D8,6E0517F0,00000000,?,6E02F715,6E02F5C0,?,?,?,00000001,-00000F38), ref: 6E01ED04
RtlReleaseActivationContext.9419(-00000F38,6E0F84D8,6E0F84D8,6E0517F0,00000000,?,6E02F715,6E02F5C0,?,?,?,00000001,-00000F38), ref: 6E01ED28
_wcsicmp.9419(6E0DFE98,?,6E0DFB78,00000030,6E0F84D8,6E0517F0,00000000,?,6E02F715,6E02F5C0,?,?,?,00000001,-00000F38), ref: 6E01EE13
_wcsicmp.9419(6E0DFE98,?,6E0DFB78,00000030,6E0F84D8,6E0517F0,00000000,?,6E02F715,6E02F5C0,?,?,?,00000001,-00000F38), ref: 6E01EE74
RtlFreeHeap.9419(00000000,?,6E0517F0,6E02F715,6E02F5C0,?,?,?,00000001,-00000F38), ref: 6E03C28C

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: 04e509c94d383fc5a3db936306e7620a1309d349f7e5ce7ca167e8f6f66422bd
Instruction ID: bac5f7393b909f152280cbddec9485a5d8ddd253bdd125a3651a5a883700fc6a
Opcode Fuzzy Hash: 04e509c94d383fc5a3db936306e7620a1309d349f7e5ce7ca167e8f6f66422bd
Instruction Fuzzy Hash: 3781C170A082068FCB14CFE9C950BDEB7F6BF85358B24852DE5559FA98E730A843CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E005C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452COMMON

Download Yara Rule

APIs

_wcsnicmp.9419(?,xl--,00000004,?,?,?,?), ref: 6E005CC7

Strings

xl--, xrefs: 6E005CB7
$, xrefs: 6E0614C8
$, xrefs: 6E0614CF
xn--, xrefs: 6E005CBE, 6E005CC5
H, xrefs: 6E061428

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: 1371a85bc2cab75bb24995664409c8aa6c71b42bc56f7e65eea7776ea41b6e44
Instruction ID: c4abd36d0187ad9de90fb71d4156af308f6e1ce39796dd4552a9bcc66187c7df
Opcode Fuzzy Hash: 1371a85bc2cab75bb24995664409c8aa6c71b42bc56f7e65eea7776ea41b6e44
Instruction Fuzzy Hash: D0F1D275E0024A8BEF34CFE8C4847ADB7F1EF48354F24856BD995AB684E7708985CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E0274C0, Relevance: 10.8, APIs: 7, Instructions: 264COMMON

Download Yara Rule

APIs

RtlEqualUnicodeString.9419(?,6DFE1040,00000001,?,00000024,01000000), ref: 6E02769A
RtlEqualUnicodeString.9419(?,6DFE1050,00000001,?,6DFE1040,00000001,?,00000024,01000000), ref: 6E0276AE
RtlEqualUnicodeString.9419(?,6DFE1048,00000001,?,6DFE1050,00000001,?,6DFE1040,00000001,?,00000024,01000000), ref: 6E0276C2
RtlEqualUnicodeString.9419(?,6DFE1058,00000001,?,6DFE1048,00000001,?,6DFE1050,00000001,?,6DFE1040,00000001,?,00000024,01000000), ref: 6E0276D6
RtlEqualUnicodeString.9419(000FFFF0,6DFE1060,00000001,6DFE1068,00000001,6DFE18F8,00000001), ref: 6E027700
iswdigit.9419(000E6DFE,6DFE1048,00000001,?,6DFE1050,00000001,?,6DFE1040,00000001,?,00000024,01000000), ref: 6E02771D
RtlEqualUnicodeString.9419(00100000,6DFE18F8,00000001), ref: 6E06F9B0

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: e86116d2b944a071453921d28a6c598168838119389314a667fa9efa2fceede7
Instruction ID: 0531a89ba14cb3ee052f078880a33af253cbf57fbda056003ccc60eb103058ea
Opcode Fuzzy Hash: e86116d2b944a071453921d28a6c598168838119389314a667fa9efa2fceede7
Instruction Fuzzy Hash: B18127718142339EDF608EEDC4A47BEB3E6AF06784F9C0977E8A4D75C0E37185858292

Uniqueness

Uniqueness Score: -1.00%

Function 6E008D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

memcpy.9419(-00000030,?,00000000,?,00000000,?,?,6E0517F0,00000000,?,00000000,?), ref: 6E008E86
memcpy.9419(-00000030,?,?,?,00000000,?,?,6E0517F0,00000000,?,00000000,?), ref: 6E008EBF

Strings

RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6E06348C
SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6E063491

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: f30449a0864eea6043160f567a5bd4d4fda35fd35fb3415b8d047b7ab1cb0f75
Instruction ID: ed05ad4606070f1cc60f19bf29203b800a91d2a2059d363b8b3e13ac3a346e7d
Opcode Fuzzy Hash: f30449a0864eea6043160f567a5bd4d4fda35fd35fb3415b8d047b7ab1cb0f75
Instruction Fuzzy Hash: F2714EB1A0020ADFDB44CF98C880B9AB7F4FF58354F254599E8189B352D331ED92CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6E01A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

RtlValidSid.9419(00000050,?), ref: 6E01A523
wcscpy_s.9419(?,00000100,S-1-,?,00000050,?), ref: 6E01A54A

Part of subcall function 6E01A6C0: memcpy.9419(00000000,?,?,?,00000050,?,00000000), ref: 6E01A781

memcpy.9419(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6E01A663
RtlCreateUnicodeString.9419(?,?,00000000,000000FC,?,?,00000050,?), ref: 6E01A6A3
wcscat_s.9419(?,00000100,6DFF292C,?,00000050,?), ref: 6E06A2DB

Strings

S-1-, xrefs: 6E01A539

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: 50e8a3994560c791cf042e8fabdaefd3259caff254ac2cb5ba4f21069c509a0f
Instruction ID: d1883757a79303a96c981621a6080c8ed50479fa91d1c9e94f37bb495dadda6a
Opcode Fuzzy Hash: 50e8a3994560c791cf042e8fabdaefd3259caff254ac2cb5ba4f21069c509a0f
Instruction Fuzzy Hash: CA513BB1D082275ADB248BE88C147F9F7F8AF05380F1541A6D46DD7281E3789A98CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E00CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

DbgPrint.9419(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6E064E05
DbgPrint.9419(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6E064E0F
DbgPrint.9419(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6E064E1C

Strings

RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6E064E00
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6E064E17
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6E064E0A

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: ea68d31b957ac91b7f0a3213af6b4ecd852f392284b5a9ba9617f1f876920391
Instruction ID: 28f361e27533dcc318bf276933bc4e54aa6cf42c14e28937d3df5d535224013a
Opcode Fuzzy Hash: ea68d31b957ac91b7f0a3213af6b4ecd852f392284b5a9ba9617f1f876920391
Instruction Fuzzy Hash: CC414572A142059EEB18CB99E8E0BBDB7F5E785350F50023BEA55DB784DB3A5850C2A0

Uniqueness

Uniqueness Score: -1.00%

Function 6E00649B, Relevance: 10.6, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

RtlLcidToLocaleName.9419(?,?,00000002,00000000), ref: 6E0064F1
RtlGetParentLocaleName.9419(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6E00651A
RtlLocaleNameToLcid.9419(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6E00656D
RtlLcidToLocaleName.9419(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6E06192B
RtlGetParentLocaleName.9419(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6E061962

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: f505619f8a8af50015eb71838be7d11c4e7a67d99bc5c591af0cd6c21a1da54d
Instruction ID: c0dac9c4d13f1d99ba7192024b8d3a4079e45fb2a57790bc4ba2b2a2e0a52295
Opcode Fuzzy Hash: f505619f8a8af50015eb71838be7d11c4e7a67d99bc5c591af0cd6c21a1da54d
Instruction Fuzzy Hash: 42418D725187069EE311CFA5D840B9BB7E9EF84B58F40092AF984D7250E730CE598BA3

Uniqueness

Uniqueness Score: -1.00%

Function 6E03645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109timeCOMMON

Download Yara Rule

APIs

memset.9419(?,00000000,00000030,?,00000000,00000000), ref: 6E036490
RtlDebugPrintTimes.9419(?,00000030,00000030,00000030), ref: 6E03651A
RtlAcquireSRWLockExclusive.9419(?,?,00000000,00000000), ref: 6E036553
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,00000000), ref: 6E036588

Strings

0, xrefs: 6E0364FA
0, xrefs: 6E0364E5

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 9d5c83fcebf6c6a58c58da897f633c083e3232342c68bdfed52580ed12e18dda
Instruction ID: 6fa7c757c05b1e45db61ade1dd83295ef764c136fa625ce38d32716dc7369ca4
Opcode Fuzzy Hash: 9d5c83fcebf6c6a58c58da897f633c083e3232342c68bdfed52580ed12e18dda
Instruction Fuzzy Hash: EA416DB16187129FC340CF68D444B5ABBE4FB89744F144A2EF888DB340D731EA05CB86

Uniqueness

Uniqueness Score: -1.00%

Function 6E004510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

DbgPrint.9419(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6E073AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6E0608F2
DbgPrint.9419(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6E073AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6E0608FC
DbgPrint.9419(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6E060909

Strings

RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6E0608ED
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6E060904
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6E0608F7

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 9b017f742976c34b6d3854ac98111b758f793f55db612261689dd6a12233fc15
Instruction ID: cc74e143cc2c7598c1bece9020f0bbc65b5c59efd50b0a446aa3c9fca691d6c4
Opcode Fuzzy Hash: 9b017f742976c34b6d3854ac98111b758f793f55db612261689dd6a12233fc15
Instruction Fuzzy Hash: D6219A326280067EF76456DED8907BC33A2D795381F810326F650D72D7EB59C8A1C2EA

Uniqueness

Uniqueness Score: -1.00%

Function 6E0D740D, Relevance: 9.1, APIs: 6, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

RtlCompareMemory.9419(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6E0814C4,0000000C,?,?,00000000,00000066,00000000), ref: 6E0D743C
RtlAllocateHeap.9419(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6E0814C4,0000000C,?,?,00000000,00000066,00000000), ref: 6E0D7464
memcpy.9419(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6E0814C4,0000000C,?,?), ref: 6E0D7484
RtlAllocateHeap.9419(?,00000008,00000018,00000000,00000066,00000000), ref: 6E0D74AC
memcmp.9419(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6E0814C4,0000000C,?,?), ref: 6E0D7527
RtlAllocateHeap.9419(?,00000008,00000018,00000000,00000066,00000000), ref: 6E0D7546

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: b9b143d5dd05d881870478d8a00beb2da52bcbe99e9e65da0568a46e8301dbe4
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: 29517D71600606EFDB16CF94C580B86BBF9FF45344F1884BAE9089F255E3B1E94ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E004439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

0, xrefs: 6E0044A3
Flst, xrefs: 6E004476

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: dd5f89e5bc210edce49beda8e182b091d8de91b63bc73486cd3e824d9fb32c62
Instruction ID: a6efa977434aa46fca77d3078fe92e11717af2072e671f4a3ea06df9ea552b29
Opcode Fuzzy Hash: dd5f89e5bc210edce49beda8e182b091d8de91b63bc73486cd3e824d9fb32c62
Instruction Fuzzy Hash: 474188B1A04648DFEB24CFDAC58079DFBF6FF54364F20802AD0499B644E7709846CB84

Uniqueness

Uniqueness Score: -1.00%

Function 6E010C30, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.9419(6E0F8550,?,?,00000000,000000FF,6E0DF868,00000038,6E00F563), ref: 6E010C6F
RtlReleaseSRWLockShared.9419(6E0F8550,6E0F8550,?,?,00000000,000000FF,6E0DF868,00000038,6E00F563), ref: 6E010C98

Strings

LdrpCallTlsInitializers, xrefs: 6E066433
minkernel\ntdll\ldrtls.c, xrefs: 6E06643D
Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6E06642C

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-70613900
Opcode ID: 3e999b715d73c8afc4bc4c89962b0d7eae875599b9098b413aff2793669d9eee
Instruction ID: 873078e8da9865dfb207e6667cd9f2acc358aaa7fadb516641deb982eb8cf9bf
Opcode Fuzzy Hash: 3e999b715d73c8afc4bc4c89962b0d7eae875599b9098b413aff2793669d9eee
Instruction Fuzzy Hash: EB21E071D08B19ABCB10CFD9D941F9ABBF9FB04B94F114629EC656B240E730AC208A91

Uniqueness

Uniqueness Score: -1.00%

Function 6E023690, Relevance: 7.9, APIs: 5, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2eb48f9cec96af57e3d4b17193141923b51d87a1d84db67e234c4d324d4bb17
Instruction ID: 84160f216c3e1b38bc15c8b34852144fdbf9419f196a8159e330821a2f27e3dd
Opcode Fuzzy Hash: c2eb48f9cec96af57e3d4b17193141923b51d87a1d84db67e234c4d324d4bb17
Instruction Fuzzy Hash: BFD18E75D0425ACBDF60EFD9C4507AEB7F2FF48750FA5402AD891AB248D335A882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E02C4A0, Relevance: 7.6, APIs: 5, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.9419(?,00000000,?,00000000,?,?,?,?,?,6E0CC9F8,000000FE), ref: 6E02C4E9
RtlReleaseSRWLockExclusive.9419(?,?,?,?,00000000,?,00000000,?), ref: 6E02C52D
TpIsTimerSet.9419(?,?,?,00000000,?,00000000,?), ref: 6E02C550
RtlReleaseSRWLockExclusive.9419(?,?,?,00000000,?,00000000,?), ref: 6E072E52
RtlDebugPrintTimes.9419(?,?,?,?,00000000,?,00000000,?), ref: 6E072E69

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: a2a854d4356aeb10437c4d6015e90ad059c29e522e3d211d1e60c51af1d00c2d
Instruction ID: ff1ccdec1040f81281a9063a09fdc1d067dee83eed9b9359f32df895b8056d18
Opcode Fuzzy Hash: a2a854d4356aeb10437c4d6015e90ad059c29e522e3d211d1e60c51af1d00c2d
Instruction Fuzzy Hash: C0212230600269AFCB008FF58890BEF77E8AF46398F048878EC515F200DB31D9449B90

Uniqueness

Uniqueness Score: -1.00%

Function 6E0017B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.9419(?,6E0DF2C8,00000018), ref: 6E0017D7
RtlGetIntegerAtom.9419(?,?,?,6E0DF2C8,00000018), ref: 6E0017F3

Part of subcall function 6E00187D: _wcsicmp.9419(0000001C,?,?,?,00000000,?,?,?,?), ref: 6E001921

RtlReleaseSRWLockExclusive.9419(?,?,?,?,6E0DF2C8,00000018), ref: 6E00185D

Part of subcall function 6E001986: RtlIsValidIndexHandle.9419(?,?,00000000,?,?,6E0013F2,6E0DF288,00000044), ref: 6E001995

Strings

Atom, xrefs: 6E0017C7

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: 561d51de0c177520a8ec1a701cc293f43df6430feb6ec613c7a3b3c662962a32
Instruction ID: 980fe93a8831c28c702622e5607fd65f6ebef8d97de65c64e0c3ea90b582b279
Opcode Fuzzy Hash: 561d51de0c177520a8ec1a701cc293f43df6430feb6ec613c7a3b3c662962a32
Instruction Fuzzy Hash: F2319335D10616DFEB40CFD584507EEB3B9BF09758B01856AE864AB340DB34CE4A8BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6E083E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

wcschr.9419(?,0000002C,?,?,00000000,?,?,6E06060B), ref: 6E083E23
wcstoul.9419(-00000002,6E06060B,00000010,?,?,00000000,?,?,6E06060B), ref: 6E083E3D
DbgPrintEx.9419(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6E06060B), ref: 6E083E5A

Part of subcall function 6E083C93: wcschr.9419(?,0000003D,00000000,?), ref: 6E083CAC
Part of subcall function 6E083C93: RtlInitUnicodeString.9419(?,-00000002,00000000,?), ref: 6E083CD0
Part of subcall function 6E083C93: RtlAnsiStringToUnicodeString.9419(?,?,00000001,00000000,?), ref: 6E083D72
Part of subcall function 6E083C93: RtlCompareUnicodeString.9419(?,?,00000001,?,?,00000001,00000000,?), ref: 6E083D89
Part of subcall function 6E083C93: RtlFreeUnicodeString.9419(?,00000000,?), ref: 6E083DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6E083E51

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: 9be935e83ecc71093542a6ba08eaa00fff1fdcc286f7e424ffc5d570c4c48c6e
Instruction ID: 95f132c1c67478b8da1a667a1dfbd9dc0e24b7c5f406316f9381cc3bdff4adcb
Opcode Fuzzy Hash: 9be935e83ecc71093542a6ba08eaa00fff1fdcc286f7e424ffc5d570c4c48c6e
Instruction Fuzzy Hash: 84F0F63220060436EA18569AAC5BFE77B9DCFD56A0F11055DF9189B281EA959D10C2F4

Uniqueness

Uniqueness Score: -1.00%

Function 6E001FA1, Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

APIs

memcpy.9419(?,?,00000000,?,?,?), ref: 6E0020AB

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9121d132f4c054a93bcdc1e540eb7ddbe3f36c2d639821427c99a9598ee4e6eb
Instruction ID: 268afdeed284eed10f06032a13a9d1e3e6db9108153fa3a1e1038ba1a44c3686
Opcode Fuzzy Hash: 9121d132f4c054a93bcdc1e540eb7ddbe3f36c2d639821427c99a9598ee4e6eb
Instruction Fuzzy Hash: 3AA1927190021A9BEB60CA98C950BEE73FDFF84354F2085A99999D3341DF359A92CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 6E001E50, Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.9419(C000000D,?,00000000,6E0DF330,00000018), ref: 6E05F223
RtlNtStatusToDosError.9419(C000000D), ref: 6E05F2A6
RtlEnterCriticalSection.9419(?), ref: 6E05F2BB
RtlNtStatusToDosError.9419(C000000D), ref: 6E05F2E2

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: c1f66ae7d83bcc21c6b0db70930384b771b9a64136c7a97958a94353de3690ee
Instruction ID: 72c3ba069a3cf5708fa6330ae02f99c05ca115ad92ba08f2271f6f28986ff3ea
Opcode Fuzzy Hash: c1f66ae7d83bcc21c6b0db70930384b771b9a64136c7a97958a94353de3690ee
Instruction Fuzzy Hash: 1651F4B1A04786DFEB40CFE4C6907AE7BF9AF49348F248919D865A7744C734AC15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E038ED7, Relevance: 6.1, APIs: 4, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

wcsrchr.9419(?,0000005C,00000000,00000000,00000000), ref: 6E038F1B
memcpy.9419(?,?,?,00000000,00000000,00000000), ref: 6E038F72
LdrFindEntryForAddress.9419(?,?,00000000,00000000,00000000), ref: 6E038F9D
memcpy.9419(?,?,00000004,?,?,00000000,00000000,00000000), ref: 6E038FD3

Part of subcall function 6E0392FC: RtlEnterCriticalSection.9419(6E0F6D80,6E0E0158,00000018,6E0063DB), ref: 6E039331

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$AddressCriticalEnterEntryFindSectionwcsrchr
String ID:
API String ID: 3299649961-0
Opcode ID: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction ID: 94ef531e322118ab9b3fd0b2116aba3485b675d4597d5e51fa4fc0569d5fc66b
Opcode Fuzzy Hash: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction Fuzzy Hash: 4131BF762086139FD704CFA8C850B6AB7E6FF84350F288669F9559B7D0D730D820CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6E02ECE0, Relevance: 6.1, APIs: 4, Instructions: 103timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.9419(?,00000000,00000000), ref: 6E02ED2C
RtlReleaseSRWLockExclusive.9419(?,00000000,00000000,?,00000000,00000000), ref: 6E02ED90
TpSetWaitEx.9419 ref: 6E0742DE
RtlDebugPrintTimes.9419(?,?,00000000,00000000,?,00000000,00000000), ref: 6E07432F

Part of subcall function 6E02FC39: ZwAssociateWaitCompletionPacket.9419(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6E02FC71

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockWait$AcquireAssociateCompletionDebugPacketPrintReleaseTimes
String ID:
API String ID: 1549838691-0
Opcode ID: 16b47c64793b85f62b477e47ade97e92d940d3504bea7869c7a55938bc53456c
Instruction ID: 4cb2dc01151edc20af0d0f301451b872d4259516fd7c70c00e0b94fe59830a5a
Opcode Fuzzy Hash: 16b47c64793b85f62b477e47ade97e92d940d3504bea7869c7a55938bc53456c
Instruction Fuzzy Hash: C231BE35644B17AFCB15CEB488447AAB7E9BF85354F044A39DCA987240DB30E8268BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E092D0B, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.9419(?,00000000,00000000,00000008,?,?,6E05FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6E092D24
RtlAcquireSRWLockShared.9419(0000000C,?,00000000,00000000,00000008,?,?,6E05FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6E092D3C

Part of subcall function 6E02FAD0: RtlDllShutdownInProgress.9419(00000000), ref: 6E02FB35
Part of subcall function 6E02FAD0: ZwWaitForAlertByThreadId.9419(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6E02FBE3

RtlReleaseSRWLockShared.9419(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6E05FFD2,00000000,?), ref: 6E092D6A
RtlReleaseSRWLockShared.9419(?,?,00000000,00000000,00000008,?,?,6E05FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6E092D95

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: 540c0183bd4f475cbe68e2ba797b36a902ec2f78ecb33bdbc5cfc8fdcec143f5
Instruction ID: ae450bf60c9d887ff67c903d6fc435c056854e9688fcc3f164b813601533e1d8
Opcode Fuzzy Hash: 540c0183bd4f475cbe68e2ba797b36a902ec2f78ecb33bdbc5cfc8fdcec143f5
Instruction Fuzzy Hash: EC11C2715026099FCF20CED5E490BD6B3FCEB86798B14886EE98A93600D731FD45EB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E02E63F, Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlSetThreadWorkOnBehalfTicket.9419(?,?,?), ref: 6E02E68B
TpCallbackMayRunLong.9419(?,?,?), ref: 6E02E6A3
RtlActivateActivationContextUnsafeFast.9419(?,?,?,?,?,6E039688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6E05E258

Memory Dump Source

Source File: 00000011.00000002.343644828.000000006DFE1000.00000020.00020000.sdmp, Offset: 6DFE0000, based on PE: true

Associated: 00000011.00000002.343634825.000000006DFE0000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.343826431.000000006E0F5000.00000008.00020000.sdmp Download File
Associated: 00000011.00000002.343836498.000000006E0FB000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.343847016.000000006E0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: 3002786d932c4528237c2053dfb45c90d403f20056efc5fe75ac25a332083030
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: 660126311846018FD761CFBAC888783B7ECFF46368F500A79D9488B285E771E882CB84

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report http___citycapproperty.ru_localmod_nmode.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: SmokeLoader

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Function 6E001C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Function 6DF7C9BF, Relevance: 51.2, APIs: 18, Strings: 11, Instructions: 412
memorynativeCOMMON

Function 6DF6A309, Relevance: 49.7, APIs: 22, Strings: 6, Instructions: 687
COMMONCrypto

Function 6E004AEF, Relevance: 47.8, APIs: 18, Strings: 9, Instructions: 529
COMMONCrypto

Function 6E004496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Function 6DF62990, Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 521
COMMONCrypto

Function 6DF7CF6A, Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 321
memorynativefileCOMMON

Function 6DF699BF, Relevance: 33.8, APIs: 16, Strings: 3, Instructions: 572
COMMONCrypto

Function 6DF48239, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 233
nativememoryCOMMON

Function 6DF440FD, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 195
nativeCOMMON

Function 6DFFCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Function 6DF42FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Function 6DF7CCC0, Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 218
nativeCOMMON

Function 6DF465A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Function 6DF62430, Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 461
COMMONCrypto

Function 6DF6A229, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 183
nativememoryCOMMON

Function 6DF46F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235
nativememoryCOMMON

Function 6DF4F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Function 6DFD5F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161
memorynativefileCOMMON

Function 6DF63360, Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 355
COMMONCrypto

Function 6DF43ACA, Relevance: 21.3, APIs: 14, Instructions: 348
COMMON

Function 6DF7AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205
nativeCOMMON

Function 6DF7D7CA, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192
nativememoryCOMMON

Function 6DF4395E, Relevance: 19.7, APIs: 13, Instructions: 172
COMMON

Function 6DF6A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350
COMMONCrypto

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre